# JupiterOne Documentation

> JupiterOne is a security and asset intelligence platform. This documentation covers the platform, API references, J1QL, the data model, and integrations.

Source: /

# JupiterOne Documentation

JupiterOne provides continuous monitoring to surface problems impacting critical assets and infrastructure. Secure your attack surface with continuous asset discovery and attack path analysis. Reduce risk, triage incidents, and prioritize vulnerability findings with greater clarity and 85% fewer SecOps resources.

## Get Started

Start configuring your JupiterOne workspace:

[

![](/icons/illustrations/shuttle.svg)![](/icons/illustrations/shuttle.svg)

Assets

Start importing your assets and devices to build out your environment.





](/features/assets/ingesting-assets.md)[

![](/icons/illustrations/puzzle.svg)![](/icons/illustrations/puzzle.svg)

Integrations

Learn more about configuring integrations within your JupiterOne workspace.





](/integrations.md)[

![](/icons/illustrations/orbit.svg)![](/icons/illustrations/orbit.svg)

J1QL

Explore J1QL and querying your data to gain a deeper understanding about your security posture.





](/j1ql.md)[

![](/icons/illustrations/cloud-upload.svg)![](/icons/illustrations/cloud-upload.svg)

API Reference

Interface with JupiterOne's API to programmatically to streamline workflows and tool management.





](/reference.md)

### Join the Community

JupiterOne is used to secure hundreds of organizations. Team up with others in the JupiterOne community using the following resources:

-   [Slack:](https://join.slack.com/t/askj1/shared_invite/zt-9b0a2htx-m8PmSWMbkjqCzF2dIZiabw) A great place for asking questions and sharing ideas.
-   [Twitter:](https://twitter.com/jupiterone) Where we post updates and share content from the JupiterOne community.
-   [GitHub:](https://github.com/jupiterone) JupiterOne ❤️'s Open Source Software!

---

Source: /api/alert-rules

# Alert rules API

An **alert rule** runs one or more J1QL queries on a schedule, evaluates the results against a filter, and runs a configured set of actions when the filter matches. Actions can create alerts, send email or Slack, open Jira tickets, call webhooks, publish to AWS messaging services, and more.

This page covers two things:

-   [**API operations**](#api-operations) — the GraphQL mutations and queries for managing rules programmatically.
-   [**Rule definition reference**](#rule-definition-reference) — the full schema of a rule's body: properties, operations, every action type, the templating language, parameters, and filtering.

Rule [exemptions](#exemptions), which exclude individual entities from a rule's results, are covered under API operations.

For the conceptual product overview, see [Alerts and rules](/features/insights-and-alerts/alerts.md).

## API operations

### List alert instances

Returns the active, inactive, or dismissed alerts produced by your rules.

```graphql
  query ListAlertInstances(
    $alertStatus: AlertStatus
    $limit: Int
    $cursor: String
  ) {
    listAlertInstances(
      alertStatus: $alertStatus
      limit: $limit
      cursor: $cursor
    ) {
      instances {
        id
        accountId
        ruleId
        level
        status
        lastUpdatedOn
        lastEvaluationBeginOn
        lastEvaluationEndOn
        createdOn
        dismissedOn
        lastEvaluationResult {
          rawDataDescriptors {
            recordCount
          }
        }
        questionRuleInstance {
          id
          name
          description
          question {
            queries {
              query
              name
            }
          }
        }
      }
      pageInfo {
        endCursor
        hasNextPage
      }
    }
  }
```

**Variables**:

Filtering for ACTIVE Alerts:

```json
{
  "alertStatus": "ACTIVE"
}
```

Filtering for INACTIVE Alerts:

```json
{
  "alertStatus": "INACTIVE"
}
```

Filtering for DISMISSED Alerts:

```json
{
  "alertStatus": "DISMISSED"
}
```

To apply a limit to the number of results returned, pass a limit variable:

```json
{
  "limit": 10
}
```

To paginate through the results, pass the `endCursor` received in the response as the `cursor` variable in the request. If `endCursor` is `null` then there are no more results to retrieve.

### Create an inline alert rule from J1QL

This operation was formerly named `createQuestionRuleInstance`. That name is now deprecated, and you should update all usages.

```graphql
mutation CreateInlineQuestionRuleInstance(
  $instance: CreateInlineQuestionRuleInstanceInput!
) {
  createInlineQuestionRuleInstance(instance: $instance) {
    id
    name
    description
    version
    pollingInterval
    question {
      queries {
        query
        version
      }
    }
    operations {
      when
      actions
    }
    outputs
  }
}
```

**Variables**:

```json
{
  "instance": {
    "name": "unencrypted-prod-data",
    "description": "Data stores in production tagged critical and unencrypted",
    "version": "v1",
    "pollingInterval": "ONE_DAY",
    "outputs": ["alertLevel"],
    "operations": [
      {
        "when": {
          "type": "FILTER",
          "version": 1,
          "condition": [
            "AND",
            ["queries.unencryptedCriticalData.total", "!=", 0]
          ]
        },
        "actions": [
          {
            "type": "SET_PROPERTY",
            "targetProperty": "alertLevel",
            "targetValue": "CRITICAL"
          },
          {
            "type": "CREATE_ALERT"
          }
        ]
      }
    ],
    "question": {
      "queries": [
        {
          "query": "Find DataStore with (production=true or tag.Production=true) and classification='critical' and encrypted!=true as d return d.tag.AccountName as Account, d.displayName as UnencryptedDataStores, d._type as Type, d.encrypted as Encrypted",
          "version": "v1",
          "name": "unencryptedCriticalData"
        }
      ]
    }
  }
}
```

Note that the recommended interval for query based alert rules (aka a `question`) is `ONE_DAY`. \\

Supported intervals for enterprise customers are: `DISABLED`, `THIRTY_MINUTES`, `ONE_HOUR`, `FOUR_HOURS`, `EIGHT_HOURS`, `TWELVE_HOURS`, `ONE_DAY`, and `ONE_WEEK`.

Free accounts only have access to the `ONE_WEEK` interval by default, but any upgrades to Compliance, Security, or Integrations will provide access to the `ONE_DAY` polling interval too.

### Update an inline alert rule

This operation was formerly named `updateQuestionRuleInstance`. That name is now deprecated, and you should update all usages.

```graphql
mutation UpdateInlineQuestionRuleInstance(
  $instance: UpdateInlineQuestionRuleInstanceInput!
) {
  updateInlineQuestionRuleInstance(instance: $instance) {
    id
    name
    description
    version
    pollingInterval
    question {
      queries {
        query
        version
      }
    }
    operations {
      when
      actions
    }
    outputs
  }
}
```

**Variables**:

```json
{
  "instance": {
    "id": "b1c0f75d-770d-432a-95f5-6f59b4239c72",
    "name": "unencrypted-prod-data",
    "description": "Data stores in production tagged critical and unencrypted",
    "version": "v1",
    "pollingInterval": "ONE_DAY",
    "outputs": ["alertLevel"],
    "operations": [
      {
        "when": {
          "type": "FILTER",
          "version": 1,
          "condition": [
            "AND",
            ["queries.unencryptedCriticalData.total", "!=", 0]
          ]
        },
        "actions": [
          {
            "type": "SET_PROPERTY",
            "targetProperty": "alertLevel",
            "targetValue": "CRITICAL"
          },
          {
            "type": "CREATE_ALERT"
          }
        ]
      }
    ],
    "question": {
      "queries": [
        {
          "query": "Find DataStore with (production=true or tag.Production=true) and classification='critical' and encrypted!=true as d return d.tag.AccountName as Account, d.displayName as UnencryptedDataStores, d._type as Type, d.encrypted as Encrypted",
          "version": "v1",
          "name": "unencryptedCriticalData"
        }
      ]
    }
  }
}
```

Note that the only difference for `update` is the `"id"` property associated with the rule instance. You can modify all settings of a rule instance.

### Create an alert rule by referencing a saved question

```graphql
mutation CreateReferencedQuestionRuleInstance(
  $instance: CreateReferencedQuestionRuleInstanceInput!
) {
  createReferencedQuestionRuleInstance(instance: $instance) {
    id
    name
    description
    version
    pollingInterval
    questionId
    questionName
    operations {
      when
      actions
    }
    outputs
  }
}
```

**Variables**:

```json
{
  "instance": {
    "name": "unencrypted-prod-data",
    "description": "Data stores in production tagged critical and unencrypted",
    "version": "v1",
    "pollingInterval": "ONE_DAY",
    "outputs": ["alertLevel"],
    "operations": [
      {
        "when": {
          "type": "FILTER",
          "version": 1,
          "condition": [
            "AND",
            ["queries.unencryptedCriticalData.total", "!=", 0]
          ]
        },
        "actions": [
          {
            "type": "SET_PROPERTY",
            "targetProperty": "alertLevel",
            "targetValue": "CRITICAL"
          },
          {
            "type": "CREATE_ALERT"
          }
        ]
      }
    ],
    "questionId": "uuid-of-saved-question",
    "questionName": "name-of-saved-question" // either questionId or questionName must be specified
  }
}
```

Note that you must specify either `questionName` or `questionId` in the `instance` for creation.

If you specify both, they must refer to the same question. After the rule is saved, subsequent requests will return both `questionId` and `questionName`.

### Update an alert rule with a referenced question

```graphql
mutation UpdateReferencedQuestionRuleInstance(
  $instance: UpdateReferencedQuestionRuleInstanceInput!
) {
  updateReferencedQuestionRuleInstance(instance: $instance) {
    id
    name
    description
    version
    pollingInterval
    questionId
    questionName
    operations {
      when
      actions
    }
    outputs
  }
}
```

**Variables**:

```json
{
  "instance": {
    "id": "b1c0f75d-770d-432a-95f5-6f59b4239c72",
    "name": "unencrypted-prod-data",
    "description": "Data stores in production tagged critical and unencrypted",
    "version": "v1",
    "pollingInterval": "ONE_DAY",
    "outputs": ["alertLevel"],
    "operations": [
      {
        "when": {
          "type": "FILTER",
          "version": 1,
          "condition": [
            "AND",
            ["queries.unencryptedCriticalData.total", "!=", 0]
          ]
        },
        "actions": [
          {
            "type": "SET_PROPERTY",
            "targetProperty": "alertLevel",
            "targetValue": "CRITICAL"
          },
          {
            "type": "CREATE_ALERT"
          }
        ]
      }
    ],
    "questionId": "uuid-of-saved-question",
    "questionName": "name-of-saved-question"
  }
}
```

Note that the only difference in `update` is the `"id"` property associated with the rule instance. You can modify any of the settings of a rule instance. Updates are not required to specify `questionId` or `questionName`, but you can specify either for `update`, and if you specify both they must refer to the same saved question.

### Delete an alert rule

You can use this operation to delete any rule instance, regardless of whether it uses an inline question or a referenced question.

```graphql
mutation DeleteRuleInstance($id: ID!) {
  deleteRuleInstance(id: $id) {
    id
  }
}
```

**Variables**:

```json
{
  "id": "b1c0f75d-770d-432a-95f5-6f59b4239c72"
}
```

> **NOTE**
> 
> Deleting an alert rule this way does **not** dismiss active alerts already triggered by this rule. It is recommended that you **Disable** the rule from the Rules page instead of deleting one.

### Trigger an alert rule on demand

```graphql
mutation EvaluateRuleInstance($id: ID!) {
  evaluateRuleInstance(id: $id) {
    outputs {
      name
      value
    }
  }
}
```

**Variables**:

```json
{
  "id": "b1c0f75d-770d-432a-95f5-6f59b4239c72"
}
```

### Exemptions

EARLY ACCESS

An **exemption** excludes one entity from a rule's results, so it is left out of the totals the rule's condition is evaluated against and triggers none of the rule's actions. For what exemptions do and which rules can accept them, see [Exemptions](/features/insights-and-alerts/rule-exemptions.md).

Exemptions are not managed by the JupiterOne Terraform provider.

#### Check whether results can be exempted

Ask this before offering an exempt action. Exemptability is a property of **the evaluation whose rows you hold**, not of the rule alone, so `evaluatedRuleVersion` is required: pass the stored result's `collectionOwnerVersion`, which is the rule version that produced those rows.

```graphql
query RuleExemptionEligibility($ruleId: ID!, $evaluatedRuleVersion: Int!) {
  ruleExemptionEligibility(
    ruleId: $ruleId
    evaluatedRuleVersion: $evaluatedRuleVersion
  ) {
    eligible
    reason
    message
    ruleSupported
    evaluationSupported
    queriesMatch
  }
}
```

**Variables**:

```json
{
  "ruleId": "b1c0f75d-770d-432a-95f5-6f59b4239c72",
  "evaluatedRuleVersion": 14
}
```

| Field | Description |
| --- | --- |
| `eligible` | True only when the rule accepts exemptions **and** these results came from the queries it runs now. |
| `reason` | An `ExemptionUnsupportedReason`. Null when eligible. |
| `message` | Display-ready explanation, suitable for showing to a user as-is. Null when eligible. |
| `ruleSupported` | Whether the rule's current queries can accept an exemption at all. |
| `evaluationSupported` | Whether the queries that produced these results could be exempted. |
| `queriesMatch` | Whether those are the same queries. Compared by query text, so renaming, retagging, or rescheduling a rule does not invalidate its results. For a rule that references a saved question, only the question id is compared. |

`eligible: false` with `ruleSupported: false` means the rule can never accept exemptions in its current shape. `eligible: false` with `ruleSupported: true` and `queriesMatch: false` means the rule is fine but these particular results are stale—re-run the rule and exempt from the new results.

`reason: NOT_AVAILABLE` means exemptions are not enabled for the account. Treat it as "the feature is absent" rather than as a refusal.

#### Exempt entities from a rule's results

One call files one decision: the justification, reason, and expiry are shared across every entity in the request, and every row written carries the returned `groupId`.

```graphql
mutation CreateRuleExemptions($input: CreateRuleExemptionsInput!) {
  createRuleExemptions(input: $input) {
    groupId
    exemptions {
      ruleId
      entityId
      entityDisplayName
      justification
      reason
      expiresOn
      status
      createdBy
      createdOn
    }
  }
}
```

**Variables**:

```json
{
  "input": {
    "ruleId": "b1c0f75d-770d-432a-95f5-6f59b4239c72",
    "entities": [
      {
        "entityId": "5f9d1e2c-8a3b-4c7d-9e1f-2a3b4c5d6e7f",
        "entityKey": "arn:aws:ec2:us-east-1:123456789012:instance/i-0abc123",
        "entityScope": "d4e5f6a7-b8c9-4d0e-1f2a-3b4c5d6e7f80",
        "entityType": "aws_instance",
        "entityDisplayName": "bastion-prod-1"
      }
    ],
    "justification": "Bastion host is managed outside this policy; risk accepted by the platform team.",
    "reason": "RISK_ACCEPTED",
    "expiresOn": 1798761600000
  }
}
```

| Input field | Description |
| --- | --- |
| `ruleId` | The rule the entities are exempted from. |
| `entities` | Up to 100 entities per request, and a rule may hold at most 100 unexpired exemptions in total. Only `entityId` is matched when results are filtered; the other fields are stored as diagnostic detail and are worth supplying, because they are what makes an exemption identifiable after the entity is gone. |
| `justification` | Required, and must not be empty. |
| `reason` | `RISK_ACCEPTED`, `NOT_APPLICABLE`, `FALSE_POSITIVE`, or `COMPENSATING_CONTROL`. |
| `expiresOn` | Optional. Epoch milliseconds, and must be in the future. Omit for an exemption that never expires. |

`entityId` is the graph entity `_id`.

Re-exempting an entity replaces its previous exemption rather than creating a second one, so it does not count again toward the rule's total.

A rule may hold at most **100 unexpired exemptions**. A request that would take it past that is refused, and the error reports how many the rule already has and how many the request would add. Expired exemptions do not count toward the limit, so a rule that has cycled through short-lived exemptions does not run out of room with nothing actually exempt.

The mutation is refused when the rule's current queries cannot accept exemptions, and the error carries the same `message` that `ruleExemptionEligibility` returns. That refusal is judged from the rule's current queries only—it cannot detect that the entity ids you supplied came from a superseded query, so check eligibility for the evaluation you chose them from first.

Exemptions take effect on the rule's **next scheduled evaluation**. Nothing is re-evaluated when the mutation returns.

#### Revoke exemptions

Revoke by `groupId` (the whole decision), by `entityIds`, or by both, which revokes the intersection. At least one selector is required—revoking a rule's entire set in one call is not supported.

```graphql
mutation RevokeRuleExemptions($ruleId: ID!, $groupId: ID, $entityIds: [ID!]) {
  revokeRuleExemptions(
    ruleId: $ruleId
    groupId: $groupId
    entityIds: $entityIds
  ) {
    revokedCount
  }
}
```

**Variables**:

```json
{
  "ruleId": "b1c0f75d-770d-432a-95f5-6f59b4239c72",
  "groupId": "9c8b7a65-4321-4fed-cba9-876543210fed"
}
```

Revocation works regardless of whether the rule still accepts new exemptions, so a rule that has been edited into an unsupported shape can always have its exemptions cleared. Up to 100 entity ids per request.

#### Read a rule's exemptions

```graphql
query RuleExemptions($id: ID!, $limit: Int, $cursor: String) {
  questionRuleInstance(id: $id) {
    exemptions(limit: $limit, cursor: $cursor, includeExpired: true) {
      items {
        groupId
        entityId
        entityKey
        entityScope
        entityType
        entityDisplayName
        justification
        reason
        expiresOn
        status
        createdBy
        createdOn
      }
      pageInfo {
        endCursor
        hasNextPage
      }
    }
  }
}
```

**Variables**:

```json
{
  "id": "b1c0f75d-770d-432a-95f5-6f59b4239c72",
  "limit": 100
}
```

`includeExpired` defaults to true, so an expired exemption stays visible instead of disappearing.

> **NOTE**
> 
> When `includeExpired` is false, a page can come back with fewer items than `limit` while more still exist. Follow `endCursor` until `hasNextPage` is false rather than stopping on a short page.

`status` is derived when you read it and is never stored:

| Status | Meaning |
| --- | --- |
| `ACTIVE` | In effect. |
| `EXPIRED` | Past its `expiresOn`. It no longer applies, but it is retained so that a rule that started alerting again is explainable. |
| `ORPHANED` | The entity it covers no longer exists, so the exemption no longer applies to anything. See [the limitations](/features/insights-and-alerts/rule-exemptions.md#limitations-to-plan-around) for what causes this. |

`createdBy` is the caller that filed the exemption: a user name, an email address, or `token:<tokenId>` for an API token.

#### Download the included or exempted result set

`ruleEvaluationQueryResultsCSV` takes a `resultSet` argument. `INCLUDED` (the default) is the entities the evaluation counted; `EXEMPTED` is the entities it held back.

```graphql
query RuleEvaluationQueryResultsCSV(
  $rawDataKey: String!
  $resultSet: RuleEvaluationQueryResultSet
) {
  ruleEvaluationQueryResultsCSV(rawDataKey: $rawDataKey, resultSet: $resultSet) {
    csvKey
    status
  }
}
```

**Variables**:

```json
{
  "rawDataKey": "<rawDataKey from the evaluation's rawDataDescriptors>",
  "resultSet": "EXEMPTED"
}
```

Both sets come from the one stored result object for that evaluation, so the exempted set reflects what that particular run held back. Revoking an exemption later does not rewrite it.

#### Exemption reference

`ExemptionReason`, supplied when creating an exemption:

| Value | Shown in the product as |
| --- | --- |
| `RISK_ACCEPTED` | Risk accepted |
| `NOT_APPLICABLE` | Not applicable |
| `FALSE_POSITIVE` | False positive |
| `COMPENSATING_CONTROL` | Compensating control |

`ExemptionUnsupportedReason`, returned by `ruleExemptionEligibility` and carried by a refused `createRuleExemptions`. Render `message` rather than mapping these to your own wording, so what you show cannot drift from what the API enforces.

| Value | What it means |
| --- | --- |
| `NOT_AVAILABLE` | Exemptions are not enabled for this account. Says nothing about the rule. |
| `NO_QUERIES` | The rule has no query to exempt entities from. |
| `QUESTION_UNAVAILABLE` | The rule's saved question could not be loaded. |
| `QUERY_NOT_PARSEABLE` | The rule's query could not be read. |
| `AGGREGATED_QUERY` | The query aggregates, so its rows are counts and summaries. |
| `DISTINCT_QUERY` | The query uses `FIND UNIQUE`, so its rows are deduplicated values. |
| `TREE_RESULTS` | The query returns a graph, so it has no result rows. |
| `NO_RETURNED_ENTITIES` | The query's `RETURN` names only values, so its rows carry no entity identity. |
| `QUERY_CHANGED_SINCE_EVALUATION` | The rule's query changed after this evaluation ran. Re-run the rule and exempt from its current results. |
| `EVALUATED_VERSION_UNAVAILABLE` | The rule version that produced these results can no longer be read. |

The first four groups describe the rule's own queries and are reported by `ruleSupported: false`. The last two describe the stored evaluation rather than the rule, and can only come from `ruleExemptionEligibility`.

## Rule definition reference

A rule uses the results of one or more queries to execute one or more actions. You can author the rule body in the JupiterOne UI, or pass it directly into the [API operations](#api-operations) above.

### Configuring a rule

1.  Navigate to the JupiterOne Rules page ([https://apps.us.jupiterone.io/rules](https://apps.us.jupiterone.io/rules))
2.  Click **New rule**
3.  Click **Advanced editor (JSON)** to open the advanced rule editor.

JSON Example:

```json
{
  "name": "unencrypted-critical-data-stores",
  "description": "Unencrypted data store with classification label of 'critical' or 'sensitive' or 'confidential' or 'restricted'",
  "version": 1,
  "specVersion": 1,
  "pollingInterval": "ONE_DAY",
  "question": {
    "queries": [
      {
        "name": "query0",
        "query": "Find DataStore with classification=('critical' or 'sensitive' or 'confidential' or 'restricted') and encrypted!=true",
        "version": "v1"
      }
    ]
  },
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "condition": "{{queries.query0.total > 0}}"
      },
      "actions": [
        {
          "type": "CREATE_ALERT"
        }
      ]
    }
  ],
  "outputs": ["queries.query0.total", "alertLevel"]
}
```

You can also configure rules to include deleted data in the results. For example:

```json
  // ...
  "question": {
    "queries": [
      {
        "name": "query0",
        "query": "Find DataStore with classification='critical' and encrypted=false as d return d.tag.AccountName as Account, d.displayName as UnencryptedDataStores, d._type as Type, d.encrypted as Encrypted",
        "version": "v1",
        "includeDeleted": true
      },
      {
        "name": "query1",
        "query": "...",
        "version": "v1",
        "includeDeleted": false
      },
      {
        "name": "query2",
        "query": "...",
        "version": "v1"
      }
    ]
  },
  // ...
}
```

### Rule properties

| Property | Type | Description |
| --- | --- | --- |
| `id` | `string` | Auto-generated, globally unique ID of each rule. |
| `version` | `number` | Current version of the rule. Incremented each time the rule is updated. |
| `name` | `string` | Name of the rule, which is unique to each account. |
| `description` | `string` | Optional description of the rule. |
| `specVersion` | `number` | Rule evaluation version in the case of breaking changes. This should always be `1`. |
| `pollingInterval` | `PollingInterval` | Optional frequency of automated rule evaluation. Defaults to `ONE_DAY`. |
| `question` | `Question` | Contains properties related to queries used in the rule evaluation. |
| `questionId` | `string` | A known unique ID for a question in the question library. |
| `operations` | `RuleOperation[]` | Actions that are executed when a corresponding condition is met. |
| `templates` | `object` | Optional key/value pairs of template name to template. |
| `outputs` | `string[]` | Names of properties that can be used throughout the rule evaluation process and will be included in each record of a rule evaluation (for example, `queries.query0.total`). |
| `notifyOnFailure` | `boolean` | Will send a notification to stakeholders (account admins, assigned users) if the rule query or any of its actions does not succeed. This property defaults to true if not provided when creating a rule. |
| `triggerActionsOnNewEntitiesOnly` | `boolean` | Will only trigger actions to be run when entities that did not exist during the previous rule evaluation appear in the question results. This property defaults to true if not provided when creating a rule. |

#### PollingInterval

Enumeration of the scheduled frequencies on which rules will automatically be evaluated. Possible values are `DISABLED`, `THIRTY_MINUTES`, `ONE_HOUR`, `FOUR_HOURS`, `EIGHT_HOURS`, `TWELVE_HOURS`, `ONE_DAY`, and `ONE_WEEK`.

### Question and queries

#### Question

A `Question` contains a collection of named queries that should be executed during the rule evaluation process and whose responses can be used in any `RuleOperation`.

| Property | Type | Description |
| --- | --- | --- |
| `queries` | `QuestionQuery[]` | The collection of queries that are used during the rule evaluation. |

#### QuestionQuery

A named query that should be executed during the rule evaluation process and whose responses can be used in any `RuleOperation`.

| Property | Type | Description |
| --- | --- | --- |
| `name` | `string` | Optional name to assign the query that will be used when referencing query data in `RuleOperation`s. If not provided, the query name is automatically assigned based on the index in the `queries` array (for example, `query0`, `query1`). |
| `query` | `string` | JupiterOne query to execute. |
| `version` | `string` | JupiterOne query language execution version (for example, `v1`). |
| `includeDeleted` | `boolean` | Whether deleted data should be considered for the specific query (defaults to `false`). |

### Operations

A `RuleOperation` is a single `condition` and series of `action`s that are executed when the `condition` is met.

| Property | Type | Description |
| --- | --- | --- |
| `when` | `RuleOperationCondition|RuleOperationCondition[]` | Type of conditional used to determine whether the associated actions should be executed. |
| `actions` | `RuleOperationAction[]` | Actions that should be executed when the `when` conditions have been met. |

#### RuleOperationCondition

The condition that determines whether the associated actions should be executed. The type of `RuleOperationCondition` is determined using the `type` property.

##### FilterRuleOperationCondition

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation condition type: `FILTER`. |
| `condition` | `string` | Template condition (for example, `{{queries.query0.total > 0}}`). |

### Actions

Action that is executed when a corresponding condition is met. The type of `RuleOperationAction` is determined using the `type` property.

#### `SET_PROPERTY`

> Includes a property that can be used in rule evaluation input.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: \`SET\_PROPERTY. |
| `targetProperty` | `string` | Property to include in the evaluation input. |
| `targetValue` | \`number | string |

Example:

```json
{
  "type": "SET_PROPERTY",
  "targetProperty": "alertLevel",
  "targetValue": "CRITICAL"
}
```

#### `CREATE_ALERT`

> Creates a JupiterOne alert that is visible in J1 Alerts.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `CREATE_ALERT` |

Example:

```json
{
  "type": "CREATE_ALERT"
}
```

#### `TAG_ENTITIES`

> Adds queryable tag values to result entities. With a value of `null`, the tag will be removed.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `TAG_ENTITIES` . |
| `entities` | `obj[]` | Array of result entities with J1 metadata. Generally a direct reference to a query result set, e.g. `{{queries.query0.data}}` |
| `tags` | `obj[]` | Array of objects containing `name` and `value` properties specifying tags to add. The `value` can be any JSON primitive. |

Note:

> Depending on result count, tags may take up to 10 minutes after rule evaluation completes to be available for query.

Example:

```json
{
  "type": "TAG_ENTITIES",
  "entities": "{{queries.query0.data}}",
  "tags": [ { "name": "myTag", "value":"tag-value" } ]
}
```

#### `SEND_EMAIL`

> Sends an email to a list of recipients with details related to alerts that are created during the rule evaluation.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `SEND_EMAIL`. |
| `recipients` | `string[]` | Email addresses of the recipients of this alert. |
| `body` | `string` | Optional additional body information of the email. |

Example:

```json
{
  "type": "SEND_EMAIL",
  "body": "Number of items above threshold: {{queries.query0.total}}",
  "recipients": ["recipient@example.com"]
}
```

#### `CREATE_JIRA_TICKET`

> Creates a Jira ticket using a specific JupiterOne Jira integration configuration.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `CREATE_JIRA_TICKET.` |
| `integrationInstanceId` | `string` | The `id` of the JupiterOne Jira integration that should be used to create the ticket. |
| `entityClass` | `string` | The `class` of the new ticket entity that should be created in JupiterOne. (for example,`Vulnerability`) |
| `project` | `string` | The unique Jira project ID that the ticket is created in. |
| `summary` | `string` | Summary of the Jira ticket. Used as the ticket title. |
| `issueType` | `string` | The Jira issue type (for example, `Task`). |
| `additionalFields` | `object` | Optional additional fields that are passed directly to the Jira API. (see table below for details) |
| `createOnlyFields` | `array` | Optional list of top-level `additionalFields` keys set when the ticket is created and never rewritten. Use it for computed values, such as a due date, that must not shift on later runs. (see [computed additional fields](#computed-additional-fields)) |
| `updateContentOnChanges` | `boolean` | Optional (default `false`). When `true`, later runs update the ticket already created for this rule instead of creating a new one. |
| `autoResolve` | `boolean` | Optional (default `false`). When `true`, the ticket created for this rule is transitioned to `resolvedStatus` once the query returns no matching results. |
| `resolvedStatus` | `string` | The Jira status the ticket is transitioned to when `autoResolve` is `true` (for example, `Closed`). Required for auto-resolve to take effect. |

> **Note**: By default (when both `updateContentOnChanges` and `autoResolve` are `false`) this action creates a **new** Jira ticket on every run that matches results. Set either flag to have JupiterOne reuse the ticket it already created for the rule instead of creating duplicates.

##### Jira description field

The `description` field can have a raw string value or be passed as depicted in these examples as Jira [ADF](https://developer.atlassian.com/cloud/jira/platform/apis/document/structure/). **NOTE**: string in either the `text` or `description` keys supports markdown syntax.

##### Computed additional fields

`additionalFields` values support the full [rule evaluation templating language](#rule-evaluation-templating-language), including [custom transforms](#custom-templating-transforms), at any depth. This is how a mandatory date field is filled relative to each ticket instead of being hardcoded to a date that was current when the rule was written:

```json
{
  "type": "CREATE_JIRA_TICKET",
  "integrationInstanceId": "<JIRA_INTEGRATION_INSTANCE_ID>",
  "entityClass": "Vulnerability",
  "project": "81198",
  "summary": "Ticket summary",
  "issueType": "Task",
  "updateContentOnChanges": true,
  "additionalFields": {
    "custom_date": "{{ evaluationBeginOn | dateAdd(90, 'days') | formatDate('YYYY-MM-DD') }}"
  },
  "createOnlyFields": ["custom_date"]
}
```

`evaluationBeginOn` is the timestamp of the run that creates the ticket — see [evaluation reference variables](#evaluation-reference-variables) — and [`dateAdd`](#dateaddamount-number-unit-string) and [`formatDate`](#formatdateformat-string-timezone-string) shift and format it.

Whenever `updateContentOnChanges` is `true`, list computed fields in `createOnlyFields`. That flag re-sends every `additionalFields` value to the existing ticket on each run, so a value derived from the evaluation time is rewritten every time: a due date 90 days out would move 90 days further out on every run and never come due. Naming the field in `createOnlyFields` fixes its value at the moment the ticket was created, while the description keeps updating.

**`autoResolve` on its own needs `createOnlyFields` too.** With `updateContentOnChanges` off, the ticket is matched each run by a fingerprint that includes the rendered `additionalFields`. A computed value changes it every run, so the action stops recognizing the ticket it opened last time — leaving that one unresolved and opening another. Create-only fields are left out of the fingerprint.

**Freezing every field stops updates.** With nothing left to send, no update is made — and the description is an `additionalFields` key, so freezing everything freezes it too.

**Create-only values are never back-filled.** Adding a field to the list later does not write it to a ticket that already exists.

> **Note**: with neither `updateContentOnChanges` nor `autoResolve` set, every matching run creates a **new** ticket (see the note above), and each of those tickets gets a date computed from its own run. If you want a single ticket whose date is fixed when it is created, set `updateContentOnChanges` and name the field in `createOnlyFields`.

##### Other / custom additional fields

Fields passed into `additionalFields` will be passed directly to the Jira API and as such should match the required input format of each field type. This table outlines some of the common field types and their value formats. Please use the [Official Jira Rest API](https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-issue-fields/) for more information.

| Field Type Label | Schema Type | Input Format | Example |
| --- | --- | --- | --- |
| Text | textfield | String value | `"Value of Field"` |
| Number | number | Number value | `2` |
| Date | date | `YYYY-MM-DD` string | `"2026-10-30"` |
| DateTime | datetime | ISO 8601 string with numeric offset | `"2026-10-30T00:00:00.000+0000"` |
| Select | select | Object with value key | `{ "value": "Select Option Label"}` |
| MultiSelect | multiselect | Array of string values | `["Option 1", "Option 2"]` |
| MultiCheckBoxes | multicheckboxes | Array of Objects with value keys | `[{ "value": "Option 1" }, { "value": "Option 2"}]` |
| UserPicker | userpicker | Object with accountId | `{ "accountId": "userInternalId" }` |
| MultiUserPicker | multiuserpicker | Array of Objects with accountId keys | `[{ "accountId": "user1InternalId" }, { "accountId": "user2InternalId"}]` |

Example:

```json
{
  "type": "CREATE_JIRA_TICKET",
  "integrationInstanceId": "<JIRA_INTEGRATION_INSTANCE_ID>",
  "entityClass": "Vulnerability",
  "project": "81198",
  "summary": "Ticket summary",
  "issueType": "Task",
  "additionalFields": {
    "custom_text": "field_value",
    "custom_number": 2,
    "custom_select": {
      "value": "Select Option Label"
    },
    "custom_multi_select": ["Option 1", "Option 2"],
    "custom_multi_checkboxes": [
      {
        "value": "Option 1"
      },
      {
        "value": "Option 2"
      }
    ],
    "custom_user_picker": {
      "accountId": "usersInternalId"
    },
    "custom_multi_user_picker": [
      {
        "accountId": "user1InternalId"
      },
      {
        "accountId": "user2InternalId"
      }
    ],
    "description": {
      "type": "doc",
      "version": 1,
      "content": [
        {
          "type": "paragraph",
          "content": [
            {
              "type": "text",
              "text": "Jira description here! **Full Markdown Supported Text**"
            }
          ]
        }
      ]
    }
  }
}
```

#### `FOR_EACH_ITEM`

> Runs a set of actions for each item in a list. This list can be query results, or a composed list of items.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `FOR_EACH_ITEM`. |
| `itemRef` | `string` | Optional name of the item reference to use in the templates. Defaults to `item` |
| `items` | `string` | The list of items to iterate over. Can be a template (see example). |
| `actions` | `array` | The actions to run for each item. |

Examples:

```json
// will call POST https://example.com with the body { "name": "John Doe", "webLink": "https://apps.<region>.jupiterone.io/asset/reference/link" }
// for each user in the query results, e.g. `Find User`
{
  "type": "FOR_EACH_ITEM",
  "itemRef": "user",
  "items": "{{queries.query0.data}}",
  "actions": [
    {
      "type": "WEBHOOK",
      "method": "POST",
      "url": "https://example.com",
      "body": {
        "name": "{{user.properties.name}}",
        "webLink": "{{user.properties.webLink}}"
      },
    }
  ]
}
```

> **NOTE**
> 
> NOTE: If your query includes traversals and a `RETURN` statement (i.e. `Find User that USES Device as d RETURN d.name`), you must alias the returned properties to use them inside the body of the action.

**Updated query:** `Find User that USES Device as d RETURN d.name as deviceName`

```json

{
  "type": "FOR_EACH_ITEM",
  "itemRef": "device",
  "items": "{{queries.query0.data}}",
  "actions": [
   {
      "type": "WEBHOOK",
      "method": "POST",
      "url": "https://example.com",
      "body": {
        "name": "{{device.deviceName}}"
      }
    }
  ]
}
```

#### `JUPITERONE_QUERY`

> Runs a JupiterOne query and stores the results on the `queries` template parameter with a given `name`. It is recommended that you only use this action within a `FOR_EACH_ITEM` action. Including it in normal `operations` actions is not recommended, as you can retrieve results you want with the normal `question` queries.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `JUPITERONE_QUERY`. |
| `query` | `string` | The JupiterOne query to run. |
| `name` | `string` | The name of the query result to store. |

Example:

```json
//
{
  "type": "FOR_EACH_ITEM",
  "itemRef": "user",
  "items": "{{queries.query0.data}}",
  "actions": [
    // JUPITERONE_QUERY actions always run first in order to enable the use of the results in the templates
    // of other actions in a FOR_EACH_ITEM action
    {
      "type": "JUPITERONE_QUERY",
      "query": "Find Account with email='{{user.properties.email}}'",
      "name": "accountsOwnedByUserQuery"
    },
    {
      "type": "WEBHOOK",
      "method": "POST",
      "url": "https://example.com",
      "body": {
        "name": "{{user.properties.displayName}}",
        "accounts": "{{queries.accountsOwnedByUserQuery.data | mapProperty('displayName')}}"
      }
    }
  ]
}
```

#### `SEND_SLACK_MESSAGE`

> Sends a Slack message to a given Slack webhook URL.

| Property | Type | Description |
| --- | --- | --- |
| `integrationInstanceId` | `string` | The `id` of the JupiterOne Jira integration used to create the ticket. |
| `type` | `string` | Rule operation action type: `SEND_SLACK_MESSAGE`. |
| `channels` | `string` | A string or list of strings beginning with a `#` to denote Slack channels to send to. |
| `webhookUrl` | `string` | Webhook URL for the account/channel that this message should be delivered to. |
| `severity` | `string` | Optional severity of this alert that determined the color of the message shown in Slack. |

**NOTE**: By default, the color of the alert in Slack is derived from the value of the `alertLevel` that is created in a `SET_PROPERTY` action. You can override the color of the alert using the `severity` property.

Example:

After you have configured the integration, copy the integration ID from the integration instance page, which looks similar to `d1549f40-b9fd-447a-bec5-4360c9ca7e8c`.

Configure a rule with the `SEND_SLACK_MESSAGE` action and specify the `integrationInstanceId` with the unique identifier of the integration and `channels` denoting the destinations. The following is an example alert rule configuration with the `SEND_SLACK_MESSAGE` action:

**NOTE**: For the JupiterOne Slack bot to deliver messages to a private Slack channel, the JupiterOne Slack bot must be a member of that private channel.

```json
{
  "id": "83136d41-23d0-415c-8726-84363d5a8a30",
  "name": "acm-cert-expiry",
  "description": null,
  "version": 1,
  "specVersion": 1,
  "notifyOnFailure": null,
  "triggerActionsOnNewEntitiesOnly": null,
  "pollingInterval": "ONE_DAY",
  "templates": {},
  "outputs": [
    "alertLevel"
  ],
  "question": {
    "queries": [
      {
        "query": "Find aws_acm_certificate with inUse = true and expiresOn > date.now and expiresOn < date.now + 30days",
        "name": "query0",
        "version": "v1",
        "includeDeleted": false
      }
    ]
  },
  "questionId": null,
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "specVersion": 1,
        "condition": [
          "AND",
          [
            "queries.query0.total",
            ">",
            0
          ]
        ]
      },
      "actions": [
        {
          "targetValue": "CRITICAL",
          "id": "e1d40781-831f-43bf-b813-b28b6f2218ef",
          "type": "SET_PROPERTY",
          "targetProperty": "alertLevel"
        },
        {
          "type": "CREATE_ALERT",
          "id": "a3a32646-db5c-4c18-89be-c02798cd84c4"
        },
        {
          "integrationInstanceId": "8d677b84-c32e-45d3-9b46-902912a00304",
          "id": "c1a3a9bc-7c4f-4eba-afff-528f9cbd2ff1",
          "type": "SEND_SLACK_MESSAGE",
          "body": "*Affected Items:* \n\n- {{queries.query0.data|mapProperty('displayName')|join('\n- ')}}",
          "channels": []
        }
      ]
    }
  ],
  "state": null,
  "tags": []
}
```

#### `WEBHOOK`

> Sends an HTTP request to a given endpoint.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `WEBHOOK` |
| `endpoint` | `string` | Webhook endpoint to send the request to. |
| `method` | `string` | HTTP method to use when making the request Allowed values: `POST`, `PUT`, `GET`, `HEAD`, `PATCH`, `DELETE`. |
| `body` | `object` | Optional body data to include in the request. Can only be used with `POST`, `PUT`, and `PATCH`. |
| `headers` | `object` | Optional HTTP headers to include in the request. |

##### Webhook reference variables

You can reference the following variables via a template pattern (such as _{{alertLevel}}_) inside the webhook action:

| Property | Type | Description |
| --- | --- | --- |
| `alertLevel` | `string` | Level of severity of the rule. |
| `alertRuleName` | `string` | Name of the alert rule. |
| `alertRuleId` | `string` | Identifier for the alert in the J1 platform. |
| `alertRuleDescription` | `string` | Description saved in the rule. |

Example:

```json
{
  "type": "WEBHOOK",
  "method": "POST",
  "body": {
    "myApiPayload": " {{alertLevel}} alert has been triggered: {{alertRuleName}} "
  },
  "headers": {
    "Authorization": "Bearer abc123"
  }
}
```

##### Tines trigger

If you opt to use a Tines alert action when you create a rule, J1 creates a webhook with the Tines URL you provided and pushes the data to that endpoint. You can use any of the [Tines APIs](https://www.tines.com/api/actions/create) to configure the webhook action.

#### `PUBLISH_SNS_MESSAGE`

> Publishes a message to the specified SNS topic.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `PUBLISH_SNS_MESSAGE`. |
| `integrationInstanceId` | `string` | The ID of the AWS integration instance to use. The integration role must have `sns:Publish` permission. |
| `topicArn` | `string` | The ARN of the SNS topic to publish the message to. |
| `data` | `object` | User-provided data to include in the message. See [Operation Templating](#operation-templating) for details on using variable data. |

Example:

```json
{
  "type": "PUBLISH_SNS_MESSAGE",
  "integrationInstanceId": "<AWS_INTEGRATION_INSTANCE_ID>",
  "topicArn": "arn:aws:sns:<REGION>:arn:aws:sns:<ACCOUNT_ID>:<SNS_TOPIC_NAME>",
  "data": {
    "query0Data": "{{queries.query0.data}}",
    "anotherCustomProperty": true
  }
}
```

```text
!!! Note:
```

`data` is stringified in the payload. For example:

```js
{
  Sns: {
    Message: '{"data":{"query0Data": ..., "anotherCustomProperty": true}}';
  }
}
```

#### `SEND_SQS_MESSAGE`

> Publishes a message to the specified SQS queue.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `SEND_SQS_MESSAGE`. |
| `integrationInstanceId` | `string` | The ID of the AWS integration instance to use. The integration role must have `sqs:SendMessage` permission. |
| `queueUrl` | `string` | The URL of the SQS queue to publish the message to. |
| `data` | `object` | User-provided data to include in the message. See [Operation Templating](#operation-templating) for details on using variable data. |

Example:

```json
{
  "type": "SEND_SQS_MESSAGE",
  "integrationInstanceId": "<AWS_INTEGRATION_INSTANCE_ID>",
  "queueUrl": "https://sqs.<REGION>.amazonaws.com/<ACCOUNT_ID>/<SQS_QUEUE_NAME>",
  "data": {
    "query0Data": "{{queries.query0.data}}",
    "anotherCustomProperty": true
  }
}
```

!!! warning `data` is stringified in the payload. For example:

```js
{
  body: '{"data":{"query0Data": ..., "anotherCustomProperty": true}}';
}
```

#### `SEND_TO_S3`

> Uploads data to an AWS S3 bucket.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `SEND_TO_S3`. |
| `integrationInstanceId` | `string` | The ID of the AWS integration instance to use. The integration role must have `s3:PutObject` permission. |
| `bucket` | `string` | The name of the bucket to upload the data to. |
| `region` | `string` | The region in which the S3 bucket is located. |
| `data` | `object` | User-provided data to include in the message. See [Operation Templating](#operation-templating) for details on using variable data. |

**NOTE**: The data will be a `json` file with a filename of `${ruleId}_${evaluationTimestampMilliseconds}.json`. This may look like `83136d41-23d0-415c-8726-84363d5a8a30_1631619200000.json`.

Example:

```json
{
  "type": "SEND_TO_S3",
  "integrationInstanceId": "<AWS_INTEGRATION_INSTANCE_ID>",
  "bucket": "s3-bucket-name",
  "region": "us-east-1",
  "data": {
    "description": "**Affected Items:**\n\n* {{queries.query0.data|mapProperty('displayName')|join('\n* ')}}"
  }
}
```

### Patterns

#### Multiple queries in a single rule

You can pass multiple queries into an alert rule that allows each query to output its results into the same, single alert.

> Note the `when` condition in the example below will invoke actions if either query returns results.

This example shows multiple queries sending out an email alert to multiple recipients:

```json
{
  "name": "Multiple Queries in a Rule",
  "description": "",
  "version": 1,
  "specVersion": 1,
  "pollingInterval": "ONE_WEEK",
  "templates": {
    "tempMap": "Project: {{item.Project}}, ProjectFindings: {{item.ProjectFindings}}, RepoFindings: {{item.RepoFindings}}"
  },
  "outputs": [
    "alertLevel"
  ],
  "question": {
    "queries": [
      {
        "name": "query0",
        "query": "Find CodeRepo THAT RELATES TO Project with repoName!=undefined as p THAT HAS Finding as f RETURN p.repoName as Project, count(f) as ProjectFindings",
        "version": "v1",
        "includeDeleted": false
      },
      {
        "name": "query1",
        "query": "Find Project with repoName!=undefined THAT RELATES TO CodeRepo as p THAT HAS Finding as f RETURN p.displayName as Project, count(f) as RepoFindings",
        "version": "v1",
        "includeDeleted": false
      }
    ]
  },
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "specVersion": 1,
        "condition": [
          "OR",
          [
            "queries.query0.total",
            ">",
            0
          ],
          [
            "queries.query1.total",
            ">",
            0
          ]
        ]
      },
      "actions": [
        {
          "targetValue": "INFO",
          "type": "SET_PROPERTY",
          "targetProperty": "alertLevel"
        },
        {
          "type": "CREATE_ALERT"
        },
        {
          "type": "SEND_EMAIL",
          "body": "Affected Items: <br><br>* {{ queries.query0.data  | mapTemplate('tempMap') | join('<br>* ') }} / <br>* {{ queries.query1.data | mapTemplate('tempMap') | join('<br>* ') }}",
          "recipients": [
            "person1@example.com",
            "person2@example.com",
            "person3@example.com"
          ]
        }
      ]
    }
  ],
  "tags": []
}
```

This example shows multiple queries sending results to Jira to create a single Jira issue:

```json
{
  "name": "Multiple Queries in a Rule to Jira Example",
  "description": "Multiple queries can be composed into a Jira Alert",
  "version": 1,
  "specVersion": 1,
  "pollingInterval": "ONE_DAY",
  "templates": {
    "projectInfo": "Project: {{item.Project}}, ProjectFindings: {{item.ProjectFindings}}, RepoFindings: {{item.RepoFindings}}"
  },
  "outputs": [
    "alertLevel"
  ],
  "question": {
    "queries": [
      {
        "name": "query0",
        "query": "Find CodeRepo THAT RELATES TO Project with repoName!=undefined as p THAT HAS Finding as f RETURN p.repoName as Project, count(f) as ProjectFindings",
        "version": "v1",
        "includeDeleted": false
      },
      {
        "name": "query1",
        "query": "Find Project with repoName!=undefined THAT RELATES TO CodeRepo as p THAT HAS Finding as f RETURN p.displayName as Project, count(f) as RepoFindings",
        "version": "v1",
        "includeDeleted": false
      }
    ]
  },
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "specVersion": 1,
        "condition": [
          "OR",
          [
            "queries.query0.total",
            ">",
            0
          ],
          [
            "queries.query1.total",
            ">",
            0
          ]
        ]
      },
      "actions": [
        {
          "targetValue": "INFO",
          "type": "SET_PROPERTY",
          "targetProperty": "alertLevel"
        },
        {
          "type": "CREATE_ALERT"
        },
        {
          "summary": ": {{queries.query0.total}}",
          "issueType": "Task",
          "entityClass": "Finding",
          "integrationInstanceId": "<JIRA_INTEGRATION_INSTANCE_ID>",
          "additionalFields": {
            "description": {
              "type": "doc",
              "version": 1,
              "content": [
                {
                  "type": "paragraph",
                  "content": [
                    {
                      "type": "text",
                      "text": "{{alertWebLink}}\n\n**Affected Items:**\n\n* {{ queries.query0.data | mapTemplate('projectInfo') | join('\n* ') }} \n\n***************\n\n {{ queries.query1.data | mapTemplate('projectInfo') | join('\n* ') }}"
                    }
                  ]
                }
              ]
            }
          },
          "project": "CT",
          "type": "CREATE_JIRA_TICKET"
        }
      ]
    }
  ],
  "tags": []
}
```

#### One Jira ticket per query result with `FOR_EACH_ITEM`

If your query returns multiple results, you can run a second query using the results of the first query to create a Jira ticket for each item in the first query results. You do this by [editing the advanced JSON of the alert rule](#configuring-a-rule) to use the `FOR_EACH_ITEM` action type.

It is not recommended that you use this action type if your results sizes are very large. This example limits the number of possible Jira tickets created to a maximum of 100, and sends an email when the limit is exceeded. Additionally, the "Test" and "Preview" buttons will not include query data in them at this time.

> **NOTE**
> 
> For accessing values within result iterations:
> 
> Properties referenced by `{{obj.properties.displayName}}`
> 
> Tags referenced by `{{obj.properties['tag.AccountName']}}`
> 
> Metadata values referenced by `{{obj.entity._type}}`

For example:

```json
{
  "name": "Unencrypted critical data stores",
  "description": "",
  "specVersion": 1,
  "pollingInterval": "ONE_WEEK",
  "question": {
    "queries": [
      {
        "name": "query0",
        "query": "Find DataStore with classification='critical' and encrypted=false",
        "version": "v1",
        "includeDeleted": false
      }
    ]
  },
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "specVersion": 1,
        "condition": ["AND", ["queries.query0.total", ">", 0], ["queries.query0.total", "<=", 100]]
      },
      "actions": [
        {
          "type": "SET_PROPERTY",
          "targetValue": "CRITICAL",
          "targetProperty": "alertLevel"
        },
        {
          "type": "CREATE_ALERT"
        },
        {
          "itemRef": "obj",
          "type": "FOR_EACH_ITEM",
          "items": "{{queries.query0.data}}",
          "actions": [
            {
              "type": "CREATE_JIRA_TICKET",
              "summary": "{{alertRuleDescription}}",
              "issueType": "",
              "entityClass": "{{ obj.entity._type | join(',') }}",
              "integrationInstanceId": "{{ obj.entity._integrationInstanceId }}",
              "additionalFields": {
                "description": {
                  "type": "doc",
                  "version": 1,
                  "content": [
                    {
                      "type": "paragraph",
                      "content": [
                        {
                          "type": "text",
                          "text": "{{alertWebLink}}\n\n**Affected Items:**\n\n* {{obj.properties.webLink}}"
                        }
                      ]
                    }
                  ]
                }
              },
              "project": "{{param.MySpecialProject}}"
            }
          ]
        }
      ]
    }, {
      "when": {
        "type": "FILTER",
        "specVersion": 1,
        "condition": ["queries.query0.total", ">", 100]
      },
      "actions": [
        {
          "type": "SET_PROPERTY",
          "targetValue": "CRITICAL",
          "targetProperty": "alertLevel"
        },
        {
          "type": "CREATE_ALERT"
        },
        {
          "type": "SEND_EMAIL",
          "body": "The alert rule {{alertRuleName}} has {{queries.query0.total}} results. Please review the results in the JupiterOne app: {{alertWebLink}}.",
          "recipients": ["emergency@example.com"]
        }
      ]
    }
  ],
  "outputs": ["alertLevel"],
  "templates": {}
}
```

### Operation templating

You can use templates inside any property under the `operations` property on a rule. The templates can contain a JavaScript-like syntax that automatically have input variables injected for usage.

For example, `FilterRuleOperationCondition`s are often used with rules as the condition for whether rule actions should be executed. You can use query response data inside of the rule conditions:

```js
{
  "operations": [
    {
      "when": {
        "type": "FILTER",
        // Use the `.total` property from query named `query0`.
        "condition": "{{queries.query0.total > 0}}"
      },
      "actions": [
        {
          "type": "CREATE_ALERT"
        }
      ]
    }
  ]
}
```

You can use data from query results inside of rule operations by referencing the `query.query0.data` property and custom templating transforms. For example:

```js
{
  "name": "lambda-function-settings-check-runtime-nodejs610",
  "description": "Node.js 6.10 is end of life (EOL) and should no longer be used.",
  "specVersion": 1,
  "pollingInterval": "ONE_DAY",
  "templates": {
    // The email template that we will use later
    "emailBody": "({{itemIndex+1}} of {{itemCount}}) [{{item.account}}] Function Name: {{item.functionName}}<br>"
  },
  "question": {
    "queries": [
      {
        "name": "query0",
        "query": "Find aws_lambda_function with runtime='nodejs6.10' as f return f.name as functionName, f.version as version, f.tag.AccountName as account, f.tag.Project as project order by account",
        "version": "v1"
      }
    ]
  },
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "specVersion": 1,
        "condition": "{{queries.query0.total > 0}}"
      },
      "actions": [
        {
          "targetValue": "HIGH",
          "type": "SET_PROPERTY",
          "targetProperty": "alertLevel"
        },
        {
          "type": "CREATE_ALERT"
        },
        {
          "type": "SEND_EMAIL",
          // Reference the `query0` data and include it in a template
          "body": "Affected Functions: <br><br>{{ queries.query0.data | mapTemplate('emailBody') | join(' ') }}",
          "recipients": ["person1@example.com"]
        }
      ]
    }
  ],
  "outputs": ["queries.query0.total", "alertLevel"]
}
```

### Rule evaluation templating language

You can create a template in any `RuleOperation` using the `{{...}}` syntax. Inside the `{{...}}` is a JavaScript-like language that allows for powerful rule evaluation functionality. Additionally, if the template contains exactly one expression and nothing else, the original type of the computed value is preserved. If multiple expressions are used, the entire value is casted to a string.

The following is an example where the type `boolean` is preserved because there is only a single expression:

```text
{{true}}
```

The following is an example where the entire value would be cast to a string because it contains multiple expressions:

```text
{{age + 10}} is my age and my name is {{firstName + " " + lastName}}
```

All templating expressions support references to [account parameters](#parameters-in-rules):

```text
My name is {{param.myFirstName}} and I am {{age}}
```

#### Evaluation reference variables

Alongside query data and account parameters, every operation template can reference the following:

| Variable | Type | Description |
| --- | --- | --- |
| `evaluationBeginOn` | `number` | Unix timestamp in milliseconds for when the evaluation started. Pair it with [`dateAdd`](#dateaddamount-number-unit-string) and [`formatDate`](#formatdateformat-string-timezone-string) to compute a date relative to the run. |
| `alertRuleId` | `string` | Identifier of the rule being evaluated. |
| `alertRuleName` | `string` | Name of the rule being evaluated. |
| `alertRuleDescription` | `string` | Description saved on the rule. |
| `alertWebLink` | `string` | Link to the alert raised by this evaluation. Only present when the rule raises one. |

#### Unary operators

| Operation | Symbol |
| --- | --- |
| Negate | `!` |

#### Binary operators

| Operation | Symbol | | ---------------- | :----: | --- | --- | | Add, Concat | `+` | | Subtract | `-` | | Multiply | `*` | | Divide | `/` | | Divide and floor | `//` | | Modulus | `%` | | Power of | `^` | | Logical AND | `&&` | | Logical OR | `| |` |

#### Comparisons

| Comparison | Symbol |
| --- | --- |
| Equal | `==` |
| Not equal | `!=` |
| Greater than | `>` |
| Greater than or equal | `>=` |
| Less than | `<` |
| Less than or equal | `<=` |
| Element in array or string | `in` |

#### Ternary operator

| Expression | Result |
| --- | --- |
| `"" ? "Full" : "Empty"` | Empty |
| `"foo" in "foobar" ? "Yes" : "No"` | Yes |
| `{agent: "Archer"}.agent ?: "Kane"` | Archer |

#### Native types

| Type | Examples |
| --- | --- |
| Booleans | `true`, `false` |
| Strings | `"Hello \"user\""`, `'Hey there!'` |
| Numerics | `6`, `-7.2`, `5`, `-3.14159` |
| Objects | `{hello: "world!"}` |
| Arrays | `['hello', 'world!']` |

#### Groups

Grouping operations with parentheses:

| Expression | Result |
| --- | --- |
| `(83 + 1) / 2` | 42 |
| \`1 < 3 && (4 > 2 |  |

### Custom templating transforms

Some custom transforms are exposed in the rule templating language. These are functions that perform actions on an input, and can be chained together to accomplish some powerful actions.

#### `mapTemplate(templateName: string)`

`mapTemplate` is separates and reuses templates inside of a rule. The transform expects a single array and the first argument should be a string whose value matches a template in rule `templates` object.

The `mapTemplate` transform exposes additional input variable to the template:

| Property | Type | Description |
| --- | --- | --- |
| `item` | `any` | The individual item of this iteration. |
| `itemCount` | `number` | The total count of items in the array. |
| `itemIndex` | `number` | The index of the current `item` in the array |

!!! note The properties that are accessible on the `item` property are pulled from the `properties` object and the `entity` object if the `item` matches the schema for an entity.

Example operation:

```json
{
  "type": "SEND_EMAIL",
  // Reference the `query0` data and include it in a template
  "body": "{{ queries.query0.data | mapTemplate('emailBody') | join(' ') }}",
  "recipients": ["person1@example.com"]
}
```

Example `templates`:

```json
{
  "emailBody": "({{itemIndex+1}} of {{itemCount}}) [{{item.account}}] Function Name: {{item.somePropertyOnItem}}<br>"
}
```

#### `mapProperty(...properties: string)`

Allows for mapping individual properties from an array. You can supply a single or multiple properties. The properties that are accessible are pulled from the `properties` object and the `entity` object if the `item` matches the schema for an entity. If the array that is being evaluated with `mapProperty` matches the schema of an entity, the rule evaluator attempts to pull properties passed to `mapProperty` from the entity properties.

Example query data:

```json
{
  "query": "FIND Person",
  "data": [
    {
      "id": "",
      "entity": {
        "_createdOn": 1234
        // ...
      },
      "properties": {
        "firstName": "Jon"
        // ...
      }
    },
    {
      "id": "",
      "entity": {
        "_createdOn": 12345
        // ...
      },
      "properties": {
        "firstName": "Jane"
        // ...
      }
    }
  ]
}
```

This is an example of accessing `properties` data using `mapProperty` and the above data:

```json
{
  "type": "SEND_EMAIL",
  // This would return: `Jon,Jane`
  "body": "{{ queries.query0.data | mapProperty('firstName') | join}}",
  "recipients": ["person1@example.com"]
}
```

This is an example accessing `entity` data using `mapProperty` and the above data:

```json
{
  "type": "SEND_EMAIL",
  // This would return: `1234,12345`
  "body": "{{ queries.query0.data | mapProperty('_createdOn') | join}}",
  "recipients": ["person1@example.com"]
}
```

#### `merge(...data: array)`

Allows for merging 1 or more arrays together to create a new array of the combined results. This transform does not perform any deduplication; all elements of the input arrays are present in the output. This is usually used to combine the results of two or more J1QL queries into a common set of query results.

Example query configuration:

```json
{
  "queries": [
    {
      "query": "Find User with name ~=\"first.last\" as a RETURN a.displayName as DisplayName",
      "name": "query0",
      "version": "v1",
      "includeDeleted": false
    },
    {
      "query": "Find User with name ~=\"firstLast\" as b RETURN b.displayName as DisplayName",
      "name": "query1",
      "version": "v1",
      "includeDeleted": false
    }
  ]
}
```

This is an example of merging the results of these two queries together, and getting the number of deduplicated total results.

```json
{
  "type": "SEND_EMAIL",
  "body": "Total Query Results: {{ queries.query0.data | merge(queries.query1.data) | uniquePropertyValues('displayName') | length}}",
  "recipients": ["person1@example.com"]
}
```

#### `join(separator?: string)`

This function is similar to the `Array.prototype.join` function in JavaScript. It returns a new string by concatenating all of the elements in an array. If the `separator`argument is not passed to `join`, the array elements are separated by a comma, by default.

This transform is often used with `mapTemplate` or `mapProperty`.

Example:

```json
{
  "type": "SEND_EMAIL",
  "body": "{{ queries.query0.data | mapTemplate('emailBody') | join(' ') }}",
  "recipients": ["person1@example.com"]
}
```

Example of default if no `separator` is passed to `join`:

```json
{
  "type": "SEND_EMAIL",
  "body": "{{ queries.query0.data | mapTemplate('emailBody') | join }}",
  "recipients": ["person1@example.com"]
}
```

#### `uniquePropertyValues(propertyName: string)`

Creates a set of unique values for the given property name. The transform will pull all properties from the `entity` and `properties` sub-properties to the top level to try to access the passed in `propertyName`.

Example query data:

```json
{
  "query": "FIND Person",
  "data": [
    {
      "id": "1",
      "entity": {
        "_createdOn": 1234
        // ...
      },
      "properties": {
        "firstName": "Jon"
        // ...
      }
    },
    {
      "id": "2",
      "entity": {
        "_createdOn": 12345
        // ...
      },
      "properties": {
        "firstName": "Jane"
        // ...
      }
    },
    {
      "id": "3",
      "entity": {
        "_createdOn": 5555
        // ...
      },
      "properties": {
        "firstName": "Jon"
        // ...
      }
    },
  ]
}
```

This is an example of accessing deduplicating a property of an array of entities:

```json
{
  "type": "SEND_EMAIL",
  // This would return: ["Jon","Jane"]
  "body": "{{ queries.query0.data | uniquePropertyValues('firstName') }}",
  "recipients": ["person1@example.com"]
}
```

#### `length`

Returns the number of items in an array. This transform takes no arguments, and the templating language does not accept empty parentheses — write `| length`, not `| length()`.

Example:

```json
{
  "type": "SEND_EMAIL",
  "body": "{{ queries.query0.data | length }} people were found.",
  "recipients": ["person1@example.com"]
}
```

`length` is most useful at the end of a chain, to count what the transforms before it produced:

```json
{
  "type": "SEND_EMAIL",
  // The number of distinct first names across both queries
  "body": "Unique names: {{ queries.query0.data | merge(queries.query1.data) | uniquePropertyValues('firstName') | length }}",
  "recipients": ["person1@example.com"]
}
```

If the value piped into `length` is not an array — because a transform earlier in the chain produced no value, for example — `length` returns `0` rather than failing the render.

#### `capitalize`

Upper-cases the first character of a string and leaves the rest of it as it is. This transform takes no arguments, and, as with `length`, the templating language does not accept empty parentheses — write `| capitalize`, not `| capitalize()`.

Because only the first character changes, `capitalize` is for making a lower-case value read as a sentence rather than for normalizing casing throughout a value: `high` becomes `High`, `high severity` becomes `High severity`, and `HIGH` is unchanged.

This transform is often used inside a `mapTemplate` template, where each `item` property is a single value:

```json
{
  "type": "SEND_EMAIL",
  "body": "{{ queries.query0.data | mapTemplate('findingLine') | join(' ') }}",
  "recipients": ["person1@example.com"]
}
```

Example `templates`:

```json
{
  "findingLine": "{{item.displayName}} — {{item.severity | capitalize}} severity<br>"
}
```

Any value that is not a string, including an array, passes through `capitalize` unchanged.

#### `dateAdd(amount: number, unit?: string)`

Shifts a timestamp by a calendar amount and returns an ISO 8601 string.

The input may be Unix milliseconds, Unix milliseconds inside a string, or an ISO 8601 string, so it works with `evaluationBeginOn` as well as with date properties read from query data.

`amount` is required and may be negative to shift backwards. `unit` defaults to `days` and accepts `hours`, `days`, `weeks`, `months` and `years`, singular or plural. These are calendar units — weekends and holidays are not skipped.

Because the result is ISO 8601, it can be piped into `formatDate` to produce whatever format the destination field wants — most often `YYYY-MM-DD` for a Jira Date field:

```js
// evaluationBeginOn = 1785542400000, which is 2026-08-01T00:00:00.000Z

{{ evaluationBeginOn | dateAdd(90, 'days') }}
// 2026-10-30T00:00:00.000Z

{{ evaluationBeginOn | dateAdd(-30, 'days') }}
// 2026-07-02T00:00:00.000Z

{{ evaluationBeginOn | dateAdd(3, 'months') }}
// 2026-11-01T00:00:00.000Z
```

If the input is missing or is not a date, the transform produces no value and the field is left out of the request rather than being sent as an invalid date.

#### `formatDate(format?: string, timeZone?: string)`

Formats a timestamp, accepting the same inputs as `dateAdd`.

Jira has two distinct date field types, and they want different formats — see [other / custom additional fields](#other--custom-additional-fields):

-   A **Date** field (schema type `date`) wants `YYYY-MM-DD`. This is `format`'s default, so `formatDate` with no arguments produces it.
-   A **DateTime** field (schema type `datetime`) wants ISO 8601 with a numeric offset, which is `YYYY-MM-DDTHH:mm:ss.SSSZZ`.

Format tokens follow [Day.js](https://day.js.org/docs/en/display/format).

`timeZone` defaults to `UTC` and accepts an IANA time zone name. Rule evaluations run on a schedule with no user in context, so there is no time zone to infer — pass one explicitly if a UTC date is not what you want. Note that this changes which calendar day you get, not just the clock time.

```js
// evaluationBeginOn = 1785542400000, which is 2026-08-01T00:00:00.000Z

{{ evaluationBeginOn | formatDate('YYYY-MM-DD') }}
// 2026-08-01 — for a Date field

{{ evaluationBeginOn | formatDate('YYYY-MM-DDTHH:mm:ss.SSSZZ') }}
// 2026-08-01T00:00:00.000+0000 — for a DateTime field

{{ evaluationBeginOn | formatDate('YYYY-MM-DD', 'America/New_York') }}
// 2026-07-31 — still the previous day in New York
```

As with `dateAdd`, a missing or non-date input produces no value.

#### `queryDataDifference(renderDataProperty: string)`

Returns the items that one query found and another did not — the set difference between two sets of query results. Use it to report what is new since an earlier run, or which items a broad query found that a narrower one did not.

Unlike the other transforms, `queryDataDifference` operates on an array of two arrays, so the value piped into it has to be written as an array literal. No single path in the render data produces this shape:

```js
{{ [queries.query0.data, queries.query1.data] | queryDataDifference('newItems') }}
```

The first list is subtracted from the second, so the example above returns the items in `query1` that are not in `query0`.

Items are matched on `_id`, falling back to `_key` when the results carry no `_id`. Either key is read from the top level of an item or from its `entity` sub-object, so both raw and entity-shaped query data work. Which of the two keys is used is decided once, from the first item of the first non-empty list, and is then applied to every item — so both queries need to return the same shape of data. An item that carries none of these keys fails the render with `"_id" or "_key" is required`.

The `renderDataProperty` argument is required. Alongside returning the difference, the transform stores it in the render data under that name, so the rest of the rule can reference the same result without repeating the transform:

```json
{
  "type": "SEND_EMAIL",
  "body": "{{ [queries.query0.data, queries.query1.data] | queryDataDifference('newFindings') | length }} new findings: {{ newFindings | mapProperty('displayName') | join(', ') }}",
  "recipients": ["person1@example.com"]
}
```

#### Common templating examples

Filling a mandatory Jira Date field with a deadline relative to the run that creates the ticket

```js
// In your rule action's additionalFields
{{ evaluationBeginOn | dateAdd(90, 'days') | formatDate('YYYY-MM-DD') }}

// Will display something like:
// 2026-10-30

// For a DateTime field instead, ask for that format:
{{ evaluationBeginOn | dateAdd(90, 'days') | formatDate('YYYY-MM-DDTHH:mm:ss.SSSZZ') }}

// 2026-10-30T00:00:00.000+0000
```

Merging multiple query results to generate a unique set of values for a given property printed on a new line

```js
{{ queries.query0.data | merge(queries.query1.data) | uniquePropertyValues('firstName') | join('\n') }}

// Will display something like:
//
// firstName1
// firstName2
// ...
```

Using a template to display multiple properties from a set of query results

```js
// In the templates definition
{
  "myTemplateName": "Property1: {{item.propertyName1}} - Property2: {{item.propertyName2}}"
}

// In your rule action
{{ queries.query0.data | mapProperty('propertyName1', 'propertyName2') | mapTemplate('myTemplateName') | join('\n') }}

// Will display something like:

// Property1: value1 - Property2 - value2
// Property1: value3 - Property2 - value4
// ...
```

Filtering a set of query results to a specific name and using a template for extra propoerties

```js
// In the templates definition
{
  "myTemplateName": "Property1: {{item.name}} - Property2: {{item.id}}"
}

// In your rule action
{{ queries.query0.data[.name == 'repository1'] | mapProperty('name', 'id') | mapTemplate('myTemplateName') | join('\n') }}

// Will display something like:

// repository1 - anIdForEntity1
// repository1 - anIdForEntity2
// repository1 - anIdForEntity3
// ...
```

### Filtering collections

Collections, or arrays of objects, can be filtered by including a filter expression in brackets. Properties of each collection can be referenced by prefixing them with a leading dot. The result will be an array of the objects for which the filter expression resulted in a truthy value.

Example context:

```js
{
  employees: [
    {first: 'Sterling', last: 'Archer', age: 36},
    {first: 'Malory', last: 'Archer', age: 75},
    {first: 'Lana', last: 'Kane', age: 33},
    {first: 'Cyril', last: 'Figgis', age: 45},
    {first: 'Cheryl', last: 'Tunt', age: 28}
  ],
  retireAge: 62
}
```

| Expression | Result |
| --- | --- |
| `employees[.first == 'Sterling']` | `[{first: 'Sterling', last: 'Archer', age: 36}]` |
| `employees[.last == 'Tu' + 'nt'].first` | `Cheryl` |
| `employees[.age >= 30 && .age < 40]` | `[{first: 'Sterling', last: 'Archer', age: 36},{first: 'Lana', last: 'Kane', age: 33}]` |
| `employees[.age >= 30 && .age < 40][.age < 35]` | `[{first: 'Lana', last: 'Kane', age: 33}]` |
| `employees[.age >= retireAge].first` | `Malory` |

### Parameters in rules

Rules support reference to parameter values stored at the account-level. These parameters simplify the task of referencing long, sensitive, or widely reused values in rules or queries. For example, the following action trigger is nearly identical to [the slack webhook](#send_slack_message) example:

```json
{
  "type": "WEBHOOK",
  "method": "POST",
  "body": {
    "name": "Jon"
  },
  "headers": {
    "Authorization": "Bearer {{param.SlackAuthToken}}"
  }
}
```

This showcases a primary use case of parameter storage: a value that is long, not human-readable, and may represent a sensitive value which should not be leaked in the configuration.

`param.SlackAuthToken` invokes a parameter stored at the account level, which is referenced when the rule is evaluated. These parameters are always referenced with the preceding token `param.`. The subsequent string (without special characters) identifies the name of a parameter.

Parameters are supported anywhere that [Operation Templating](#operation-templating) is supported, and the value of a parameter can be any type of [native type](#native-types) with the **exclusion of objects**, which support comparison _against_ parameters but cannot be the contents of a parameter. Additionally, parameters can store lists of native types, and template expressions can invoke parameter lists similarly to examples above. For example, [using the email example](#send_email), we can parameterize the recipient list:

```json
{
  "type": "SEND_EMAIL",
  "body": "{{ queries.query0.data | mapTemplate('emailBody') | join(' ') }}",
  // a stored list of email strings:
  "recipients": "{{param.alertEmailRecipientList}}"
}
```

For more info on JupiterOne parameters, [reference the documentation](/features/admin/parameters.md).

---

Source: /api/authentication

# Authentication

The JupiterOne APIs use a Bearer Token for authentication. Include the API key in the header as a Bearer Token. You also need to include `JupiterOne-Account` as a header parameter. You can find the `Jupiterone-Account` value in your account settings by going to [https://apps.us.jupiterone.io/settings/account-management](https://apps.us.jupiterone.io/settings/account-management) and finding your Account ID.

## API Keys

API keys enable users to use the J1 APIs in queries and with integrations. You can enable the use of API keys for a group of users and create API keys for your organization account. This can be done both through our GraphQL public API and the JupiterOne dashboard.

## Create API Keys Using the GraphQL API

You can use GraphQL queries to create account-level API keys.

**To create an account-level API key**, enter:

```text
POST `https://graphql.us.jupiterone.io/`
```

```graphql
mutation CreateToken($token: TokenInput!) {
  createToken(token: $token) {
    token
    id
    name
    category
    policy
    revoked
    createdAt
    expiresAt
    __typename
  }
}
```

Response

```json
{
  "variables": {
    "token": {
      "name": "Token Name",
      "category": "tags",
      "policy": "{\n\t\"permissions\": [{\n\t\t\"effect\":\"ALLOW\",\n\t\t\"actions\":[\"dashboard:View\" ],\n\t\t\"resources\": [ \"dashboard:123456\" ]\n\t}]\n}"
    }
  }
}
```

> **NOTE**
> 
> Wildcards are not supported for account-level API tokens.

The `policy` variable is a JSON object formatted as follows:

```json
{
  "permissions": [
    {
      "effect": "ALLOW",
      "actions": ["dashboard:View"],
      "resources": ["dashboard:123456"]
    }
  ]
}
```

The effect parameter is ether `ALLOW` or `DENY` and is case-sensitive. Currently, JupiterOne only supports fully-qualified actions and resources or the wildcard `*`.

**Supported actions include:**

```text
"compliance:GetStandard",
"compliance:GetSummary",
"dashboard:View",
"persister:GetEntityRawData",
"persister:Synchronize",
"query:GetAccountEntity",
"query:ReadGraphData",
"settings:GetSettings",
"parameters:GetParameter",
"parameters:GetParameterList",
"parameters:SetParameter",
"parameters:DeleteParameter"

"*" // All actions
```

**Supported resources include:**

```text
"account:<resourceId>",
"api:<resourceId>",
"compliance-standard:<resourceId>",
"dashboard:<resourceId>",
"entity:<resourceId>",
"integration:<resourceId>",
"powerup:<resourceId>",
"settings-category:<resourceId>",
"parameter:<resourceId>"

"*" // All resources
```

The action `query:ReadGraphData` may be constrained by a condition. For the policy to allow access to a graph object, that graph object must have the properties specified in the condition and those properties must have the values specified in the condition. These J1QL Query Policies must include `effect: "ALLOW"`; `actions: ["ReadGraphData"]` (or `actions: ["*"]`); and `resources: ["*"]`. In addition, their `conditions` block must contain an object of the `stringEquals` comparison. For example, this policy only allows its user to query for graph objects that have the property `_type` equal to `github_repo`:

```json
{
  "permissions": [
    {
      "effect": "ALLOW",
      "actions": ["query:ReadGraphData"],
      "resources": ["*"],
      "condition": {
        "stringEquals": {
          "_type": "github_repo"
        }
      }
    }
  ]
}
```

### Revoke Account-Level API Keys

To revoke an account-level key, enter:

```text
POST `https://graphql.us.jupiterone.io/`
```

```graphql
mutation RevokeToken($id: String!) {
  revokeToken(id: $id) {
    token
    id
    name
    category
    policy
    revoked
    createdAt
    expiresAt
    __typename
  }
}
```

Response

```json
{
  "variables": {
    "id": "<tokenId>"
  }
}
```

## Creating API Keys within the dashboard

In addition to creating API keys via our GraphQL API, they can be created within the dashboard as outlined below.

> **NOTE**
> 
> You must have the Administrator permission to enable API key access.

### Enable User-Level API Key Access

Before creating Account-level API keys, it will be necessary to to enable API key access for a group of users:

1.  Go to **Settings > Users & Access**.
2.  Select the group for whom you want to enable API access.
3.  Select **API Key Management**.

An API key icon appears in the My Profile view for each user in the group that has API key access.

#### Create Account-Level API Keys

You can manage user-level keys in the Account Management page. You must have administrator permissions to make changes to account-level API keys.

To generate a new API key or manage existing API keys:

1.  Log in to the account you want to manage.
2.  Go to **Settings > Account Management**.
3.  In the left panel, click the **key icon**. ​
4.  In the User API Keys page, click **Add**.
5.  In the API Keys modal, enter the name of the key and the number of days before it expires, and click **Create**.

To revoke an API key, in the User API Keys page, go to the key you want to revoke and click the **trash icon**.

#### API Key Permissions Policy

You must set a permission policy in JSON for account-level API keys, similar to an IAM policy in AWS. The following is an example of a full control policy:

```json
{
  "permissions": [
    {
      "effect": "ALLOW",
      "actions": [
        "*"
       ],
      "resources": [
         "*"
      ]
    }
  ]
}
```

J1 supports the creation of `*` policies that permit all actions or resources:

```json
{
  "permissions": [ 
    {
      "effect": "ALLOW", 
      "actions": [
        "*"
       ],
      "resources": [
         "*"
      ]
    } 
  ] 
} 
```

```json
{
  "permissions": [ 
    {
      "effect": "ALLOW", 
      "actions": [
        "query:ReadGraphData"
       ],
      "resources": [
         "*"
      ]
    } 
  ] 
} 
```

```json
{
  "permissions": [ 
    {
      "effect": "ALLOW", 
      "actions": [
        "*"
       ],
      "resources": [
         "*"
      ]
    },
    {
      "effect": "DENY", /// Deny only ReadGraphData
      "actions": [
        "query:ReadGraphData"
      ],
      "resources": [
        "*"
      ]
    }
  ] 
} 
```

## Create Integration API Keys

Integration API keys can only be used to synchronize data within a particular integration's scope and cannot be used to read the graph or perform any other action in the system. This can be useful for local development and running the integration in your own infrastructure.

You must have administrator permissions to be able to create keys and the selected integration must have at least one configuration.

To create an Integration API key:

1.  From the top navigation of the J1 Search homepage, select **Integrations**.
2.  Select the integration and then the instance for which you want to create an API key.
3.  Select the **API Keys** tab and then click **New API Key**.
4.  When prompted, click **Create** again to confirm your action.

The key is now available for you to use to synchronize data in this integrations.

To delete the API key at any time, click **Revoke**.

---

Source: /api/entity-mutations

# Entity mutations

### Create Entity

This mutation creates a JupiterOne entity with the given specifications. This mutation requires three parameters (with two optional parameters):

-   `entityKey`: A string that gives the key value for the entity so that this entity can be referenced later.
-   `entityType`: A string that gives the type of the entity being created.
-   `entityClass`: A string that gives the class of the entity being created.
-   Optional Parameters
    -   `timestamp`:
    -   `properties`: A `JSON` list that gives specific properties that the entity will have.

```graphql
mutation CreateEntity (
  $entityKey: String!
  $entityType: String!
  $entityClass: [String!]!
  $timestamp: Long
  $properties: JSON
) {
  createEntity (
    entityKey: $entityKey,
    entityType: $entityType,
    entityClass: $entityClass,
    timestamp: $timestamp,
    properties: $properties
  ) {
    entity {
      _id
      ...
    }
    vertex {
      id,
      entity {
        _id
        ...
      }
      properties
    }
  }
}
```

**Variables**:

```json
{
  "entityKey": "<an entity key>",
  "entityType": "<an entity type>",
  "entityClass": "<an entity class>",
  "timestamp": 1529329792552,
  "properties": {
    // Custom properties on the Entity
    ...
  }
}
```

### Creating entities and a relationship between them

> The following mutations utilize a J1Client.

```graphql
const CREATE_ENTITY = gql`
  mutation createEntity (
    $entityKey: String!
    $entityType: String!
    $entityClass: [String!]!
    $timestamp: Long
    $properties: JSON
  ) {
    createEntity(
      entityKey: $entityKey
      entityType: $entityType
      entityClass: $entityClass
      properties: $properties
    ) {
  .
  .
  .
  }`;

const CREATE_RELATIONSHIP = gql`
  mutation CreateRelationship (
    $relationshipKey: String!
    $relationshipType: String!
    $relationshipClass: String!
    $fromEntityId: String!
    $toEntityId: String!
  ) {
    createRelationship (
      relationshipKey: $relationshipKey
      relationshipType: $relationshipType
      relationshipClass: $relationshipClass
      fromEntityId: $fromEntityId
      toEntityId: $toEntityId
    ) {
    .
    .
    .
  }`;


const entity1 = await j1Client.mutate({
  mutation: CREATE_ENTITY,
  variable: {
    entityKey: 'Example Key',
    entityType: 'ExampleType',
    entityClass: 'ExampleClass',
    properties: {
      'tag.key': 'tagvalue'
    }
  }
});

const entity2 = await j1Client.mutate({
  mutation CREATE_ENTITY,
  variable: {
    entityKey: 'Other Example Key',
    entityType: 'OtherType',
    entityClass: 'OtherClass',
    properties: {
      'tag.key': 'tag'
    }
  }
});

const relationship = await j1Client.mutate({
  mutation: CREATE_RELATIONSHIP,
  variable: {
    relationshipKey: entity1._key + ' |uses| ' + entity2._key,
    relationshipClass: 'entity_uses_entity',
    relationshipType: 'USES',
    toEntityId: entity2._id,
    toEntityKey: entity1._id,
  }
});
```

### Updating Entity

This mutation updates an already existing entity (does not create an entity). You cannot change the `entityKey`, `entityClass`, or `entityType`. This mutation requires one parameter (with two optional parameters):

-   `entityId`: A string specific to the entity that finds the entity.
-   Optional Parameters:
    -   `timestamp`:
    -   `properties`: A `JSON` list of properties to be changed.

```graphql
mutation UpdateEntity (
  $entityId: String!
  $timestamp: Long
  $properties: JSON
) {
  updateEntity (
    entityId: $entityId,
    timestamp: $timestamp,
    properties: $properties
  ) {
    entity {
      _id
      ...
    }
    vertex {
      id,
      entity {
        _id
        ...
      }
      properties
    }
  }
}
```

**Variables**:

```json
{
  "entityId": "<an entity Id (entity._id)>",
  "timestamp": 1529329792552,
  "properties": {
    // Custom properties to get updated
    ...
  }
}
```

#### Property persistence

Properties set with `updateEntity` **persist across future syncs of the source integration**. If you set `criticality = "tier-1"` on a GitHub repository entity, the value remains on the entity after every subsequent GitHub integration sync — you do not need to re-apply it. If the integration's own data later asserts a different value for the same property, your `updateEntity` value continues to win until you explicitly clear it.

This makes `updateEntity` the right tool for one-off persistent edits on entities owned by a managed integration — for example, tagging a single repository with a criticality tier or pinning a custom unification key on two specific hosts.

#### When to use `updateEntity` vs sync modes

| You want to… | Use |
| --- | --- |
| Set a property on **one entity** (or a handful, scripted one at a time) and have it survive every future integration sync. | `updateEntity` |
| Set a property on **a batch of up to 10,000 entities** under a stable scope, managed together, and have those values survive every future integration sync. | [`OVERRIDE`](/api/sync-jobs/override.md) sync mode |
| Refresh a property frequently on managed-integration entities, and you accept that each integration sync resets the value. | [`PATCH`](/api/sync-jobs/patch.md) sync mode |
| Add or remove entities and relationships in a dataset you fully own. | [`DIFF`](/api/sync-jobs/diff.md) sync mode |

If both an `OVERRIDE` sync job and an `updateEntity` mutation set the same property on the same entity, the value that **most recently changed** takes precedence. See [OVERRIDE vs the entity mutation API](/api/sync-jobs/override.md#override-vs-the-entity-mutation-api) for details.

Alert rule tags also take precedence. If an alert rule tags a property, `updateEntity` does not change that property on the entity: the request still succeeds and your value is recorded, but the rule's value stays in effect until no rule tags that property. This is evaluated per property, so the other properties in the same request are applied normally.

### Deleting Entity

This mutation deletes an existing entity. This mutation requires one parameter (with one optional parameter):

-   `entityId`: A string specific to the entity that finds the entity.
-   Optional Parameters:
    -   `timestamp`
    -   `hardDelete` - this flag completely removes all information related to the entity and is not recoverable.

```graphql
mutation DeleteEntity (
  $entityId: String!
  $timestamp: Long
) {
  deleteEntity (
    entityId: $entityId,
    timestamp: $timestamp,
  ) {
    entity {
      _id
      ...
    }
    vertex {
      id,
      entity {
        _id
        ...
      }
      properties
    }
  }
}
```

**Variables**:

```json
{
  "entityId": "<an entity Id (entity._id)>",
  "timestamp": 1529329792552
}
```

---

Source: /api/entity-relationship-queries

# Entity and relationship queries

This query will allow you to run J1QL queries for fetching data. The GraphQL resolver requires that one parameter is provided:

-   `query`: A J1QL query string that describes what data to return

Optionally, additional parameters can be provided:

-   `variables`: A `JSON` map of values to be used as parameters for the query
-   `cursor`: A token that can be exchanged to fetch the next page of information.
-   `includeDeleted`: When set to `true`, recently deleted information will be included in the results.
-   `deferredResponse`: This option allows for a deferred response to be returned. When a deferred response is returned, a `url` pointing the state of the query is provided. API consumers should poll the status of the deferred query by requesting the given `url` until the `status` property of the returned JSON document has a value of `COMPLETED` (see example below). Upon completion of the query, the `url` will provide a link to the query results. The results contain the same `type`, `data`, and `cursor` fields that the non-deferred GraphQL response would contain. Allowed values are `DISABLED` and `FORCE`.
-   `flags`:
    -   `computedProperties`: When set to `true`, vertices will be tagged with additional information to indicate if there are noteworthy traits that are worth surfacing.
    -   `rowMetadata`: When set to `true`, table results will return metadata about the requested objects under a `_meta` property.
    -   `variableResultSize`: When set to `true` the API will return the largest result size possible. Without this flag, the result size will be limited to 250 rows. This flag is recommended for use in cases where a larger result size is preferable and an indeterminate/variable number of return results is acceptable.
-   `scopeFilters`: An array of `JSON` map of filters that define the desired vertex. They have precedence over filters supplied in the query.

When working with additional variables, keep in mind some of the following considerations:

-   `variableResultSize` can increase the rate of your pagination flow because the API will return the largest number of rows possible per request. The exact number of rows returned will not always be the same, but will be larger than the default -- hence the name, _variable_ result size.
    
-   When paging through data, it is _highly_ recommended that cursors are leveraged instead of adding `limit` and `skip` clauses to queries.
    
-   Be sure to include `cursor` in the GraphQL response if you need to paginate through the results. The returned `cursor` will be `null` if there are no more pages available.
    
-   Queries that may take longer than 30 seconds should use the `FORCE` option for `deferredResponse` to avoid request timeouts. You should only use the `DISABLED` option when testing a simple query. It is _highly_ recommended that all automated processes use the the `FORCE` option when issuing J1QL queries.
    

**Example GraphQL query:**

```graphql
query J1QL($query: String!, $variables: JSON, $cursor: String, $scopeFilters: [JSON!], $flags: QueryV1Flags) {
  queryV1(query: $query, variables: $variables, cursor: $cursor, scopeFilters: $scopeFilters, flags: $flags) {
    type
    data
    cursor
  }
}
```

**Example variables:**

```json
{
  "query": "find Person with _type=${type} return Person.name",
  "variables": {
    "type": "employee"
  },
  "cursor": "eyJjYWNoZUtleSI6IjFlNDg3MT...",
  "scopeFilters": [
    {
      "org": "engineering"
    }
  ],
  "flags": {
    "computedProperties": true
  }
}
```

**Example `queryV1` resolver result:**

```json
{
  "type": "table",
  "data": [{ "Person.name": "Mochi" }],
  "cursor": "eyJjYWNoZUtleSI6IjFlNDg3MT..."
}
```

**Example GraphQL query with deferred responses:**

```graphql
query J1QL(
  $query: String!
  $variables: JSON
  $cursor: String
  $deferredResponse: DeferredResponseOption
) {
  queryV1(
    query: $query
    variables: $variables
    deferredResponse: $deferredResponse
    cursor: $cursor
  ) {
    type
    url
  }
}
```

**Example variables:**

```json
{
  "query": "find Person with _type=${type}",
  "deferredResponse": "FORCE",
  "variables": {
    "type": "employee"
  },
  "cursor": "eyJjYWNoZUtleSI6IjFlNDg3MT..."
}
```

**Example `queryV1` resolver result when using a deferred response:**

```json
{
  "type": "deferred",
  "url": "https://example.com/state.json"
}
```

**Example state responses:**

```json
{
  "status": "IN_PROGRESS",
  "correlationId": "912788f1-e0c7-43bd-b853-455c0031be8a"
}
```

```json
{
  "status": "COMPLETED",
  "url": "https://example.com/results.json",
  "correlationId": "912788f1-e0c7-43bd-b853-455c0031be8a"
}
```

### Retrieving a Single Vertex by ID

This query fetches a vertex and its properties by its ID. The query requires one of two parameters:

-   `id`: The ID as a string
-   `filters`: A set of filters that define the desired vertex.

The example below contains all of the currently available filters.

> **NOTE**
> 
> Only one of the variables (`id` or `filters`) is required. Specifying both is allowed but unnecessary unless you want to assert that a vertex with the specified `id` exists _and_ has specific entity properties.

```graphql
query VertexQuery($id: String!, $filters: VertexFilters) {
  vertex(id: $id, filters: $filters) {
    id
    entity {
      _id
      _key
      _type
      _accountId
      _integrationName
      _integrationDefinitionId
      _integrationInstanceId
      _version
      _createdOn
      _beginOn
      _endOn
      _deleted
      displayName
    }
    properties
  }
}
```

**Variables**:

```json
{
  "id": "<a vertex id>",
  "filters": {
    "_id": "<an entity id>",
    "_key": "<an entity key>",
    "_type": ["<a entity type>"],
    "_class": ["<a entity class>"]
  }
}
```

### Fetching Neighbors of a Vertex

The `Vertex` type allows you to retrieve vertex and edge neighbors up to a certain depth using the `neighbors` field. The return type of the `neighbors` resolver is the same as that of a graph query. This query requires two parameters:

-   `id`: The ID of the vertex as a string
-   `depth`: An integer specifying how many "levels" deep the query will go to look for neighbors.

```graphql
query VertexQuery($id: String!, $depth: Int) {
  vertex(id: $id) {
    id
    entity {
      displayName
    }
    neighbors(depth: $depth) {
      vertices {
        id
        entity {
          displayName
        }
      }
      edges {
        id
        relationship {
          displayName
        }
      }
    }
  }
}
```

**Variables**:

The depth that is supplied must be a value between 1 and 5 (inclusive).

```json
{
  "id": "<a vertex id>",
  "depth": 5
}
```

### Retrieving an Edge by ID

This query allows you to fetch an edge, its properties, and the relationship it describes by its ID or label and filters. The query requires one or two of three parameters:

-   `id`: The ID as a string.
-   `label`: The label displayed on the edge.
-   `filters`: A set of filters that define the desired vertex.

Only one of the variables (`id`, `label`, or `filters`) is required. Specifying `label` and `filters` with `id` is allowed but somewhat redundant unless you want to assert that a vertex with the specified `id` exists _and_ has the specific label and properties.

The example below contains all of the currently available filters.

```graphql
query VertexQuery($id: String!) {
  edge(id: $id, label: $id, filters: $id) {
    id
    relationship {
      _id
      _key
      _type
      _accountId
      _integrationName
      _integrationDefinitionId
      _integrationInstanceId
      _version
      _createdOn
      _beginOn
      _endOn
      _deleted
      _fromEntityKey
      _toEntityKey
      displayName
    }
    properties
  }
}
```

**Variables**:

```json
{
  "id": "<an edge id>",
  "label": "<edge label>",
  "filters": {
    "_id": "<a relationship id>",
    "_key": "<a relationship key>",
    "_type": "<a relationship type>",
    "_class": "<a relationship class>"
  }
}
```

### Fetching the Count of Entities Via a \_type and/or \_class

This query allows you to fetch the count of entities. The `_id`, `_key`, `_type`, or `_class` fields can be supplied as filters. This query only counts the latest versions of entities matching the filter criteria. This query requires two parameters:

-   `filters`: A set of vertex filters that describe the entities that are to be returned.
-   `filterType`: A `FilterType` (`AND` or `OR`).

If `OR` is specified as the filter type, any entity that has any class in the filter will be included in the count. By default, the query uses `AND`, which only includes entities that have _all_ of the specified classes in the count.

This resolver uses the `JSON` scalar as the return type:

```graphql
query testQuery($filters: VertexFilters, $filterType: FilterType) {
  entityCount(filters: $filters, filterType: $filterType)
}
```

Use field aliases to request the counts of multiple different entities:

```graphql
query testQuery {
  Users: entityCount(filters: { _class: ["User"] }, filterType: "AND")
  Repos: entityCount(filters: { _class: ["CodeRepo"] }, filterType: "OR")
}
```

**Example result**:

```json
{
  "User": 40,
  "CodeRepo": 153
}
```

### Fetching the Count of All Types and Classes

This query returns the entity counts for all types and classes. The following resolver uses the `JSON` scalar as the return type:

```graphql
query testQuery {
  allEntityCounts
}
```

**Example result**:

```json
{
  "typeCounts": {
    "iam_user": 12,
    "iam_managed_policy": 10,
    "iam_role_policy": 10
  },
  "classCounts": {
    "User": 12,
    "AccessPolicy": 20
  }
}
```

### Fetching the Count of All Types With a Set of Classes

The query below returns all types that have the specified classes. The query requires two parameters:

-   `classes`: An array of strings detailing which classes should be returned.
-   `filterType`: A `FilterType` (`AND` or `OR`).

If `OR` is specified as the filter type, any entity that has any class in the filter will be included in the count. By default, the query uses `AND`, which only includes entities that have _all_ of the specified classes in the count.

This resolver uses the `JSON` scalar as the return type:

```graphql
query testQuery ($classes: [String], $filterType: FilterType) {
  typeCounts (classes: $classes, filterType: $filterType)
}
```

**Example result**:

```json
{
  "iam_user": 12,
  "iam_managed_policy": 10,
  "iam_role_policy": 10
}
```

### Listing Entities Via a \_type and/or \_class

For fetching entities with specified filters. The `_id`, `_key`, `_type` and `_class` fields can be included in a J1QL query request.

This query has a deferred response flow and needs to be completed in three parts.

---

Source: /api/iam-operations

# IAM API

> **NOTE**
> 
> `accessAdmin` permission is required for all IAM operations.

**Endpoint:**

```text
POST https://graphql.us.jupiterone.io/
```

**Headers:**

```plain
Content-Type: application/json
Accept: application/json
JupiterOne-Account: {Account_ID}
Authorization: Bearer {API_Key}
```

### Get IAM groups

**Query: iamGroups**

Retrieves all account `groups` within the query limit.

-   `limit`: (required) max number of records to return
-   `cursor`: (optional) continuation token

```graphql
query Query($limit: Int!, $cursor: String) {
  iamGroups(limit: $limit, cursor: $cursor) {
    items {
      id
      name
      description
    }
    pageInfo {
      endCursor
      hasNextPage
    }
  }
}
```

**API Samples**

Sample (S1): `iamGroups`

(S1): Request

```json
{
  "limit": 5
}
```

(S1): Response

```json
{
  "data": {
    "iamGroups": {
      "items": [
        {
          "id": "12c2d370-89ef-4280-970b-d520ca1837be",
          "name": "Users",
          "description": ""
        },
        {
          "id": "dd354c7a-1b9b-4579-ac5e-873fe3b2c851",
          "name": "Administrators",
          "description": "Admin users"
        }
      ],
      "pageInfo": {
        "endCursor": "eyJhY2NvdW50I...",
        "hasNextPage": true
      }
    }
  }
}
```

### Get Users of IAM group

**Query: iamGroupUsers**

Retrieves all group members of the specified `group` (by `id`) within the query limit.

-   `groupId`: (required) unique group identifier
-   `limit`: (required) max number of records to return
-   `cursor`: (optional) continuation token
    
    > Note: The item.`id` property in the response is the JupiterOne `uid`.
    

```graphql
query Query($groupId: String!, $limit: Int!, $cursor: String) {
  iamGroupUsers(groupId: $groupId, limit: $limit, cursor: $cursor) {
    items {
      id
      email
    }
    pageInfo {
      endCursor
      hasNextPage
    }
  }
}
```

**API Samples**

Sample (S1): `iamGroupUsers`

(S1): Request

```json
{
  "groupId": "22c2d370-89ef-4280-970b-d520ca1837be",
  "limit": 5
}
```

(S1): Response

```json
{
  "data": {
    "iamGroupUsers": {
      "items": [
        {
          "id": "222xxx222_abc",
          "email": "abc@mycompany.com"
        },
        {
          "id": "222xxx222_def@mycompany.com",
          "email": "def@mycompany.com"
        }
      ],
      "pageInfo": {
        "endCursor": "eyJ1c2VyIjoiaj...",
        "hasNextPage": true
      }
    }
  }
}
```

### Add IAM User to Group

**Mutation: addIamUserToGroupByEmail**

Adds a `user` to a `group` using the specified email and group ID.

-   `groupId`: (required)
-   `userEmail`: (required)

```graphql
mutation Mutation($groupId: String!, $userEmail: String!) {
  addIamUserToGroupByEmail(groupId: $groupId, userEmail: $userEmail) {
    success
  }
}
```

**API Samples**

Sample (S1): `addIamUserToGroupByEmail`

(S1): Request

```json
{
  "groupId": "22c2d370-89ef-4280-970b-d520ca1837be",
  "userEmail": "abc@mycompany.com"
}
```

(S1): Response

```json
{
  "data": {
    "addIamUserToGroupByEmail": {
      "success": true
    }
  }
}
```

### Remove IAM user from group

**Mutation: removeIamUserFromGroupByEmail**

Removes a `user` from a `group` using the specified email and group ID.

-   `groupId`: (required)
-   `userEmail`: (required)

```graphql
mutation Mutation($groupId: String!, $userEmail: String!) {
  removeIamUserFromGroupByEmail(groupId: $groupId, userEmail: $userEmail) {
    success
  }
}
```

**API Samples**

Sample (S1): `removeIamUserFromGroupByEmail`

(S1): Request

```json
{
  "groupId": "22c2d370-89ef-4280-970b-d520ca1837be",
  "userEmail": "xyz@mycompany.com"
}
```

(S1): Response

```json
{
  "data": {
    "removeIamUserFromGroupByEmail": {
      "success": true
    }
  }
}
```

### Create IAM Group

**Mutation: `createIamGroup`**

Creates a new `group` with a specified `name` and optionally: `description`, `queryPolicy`, and/or `abacPermissions`.

-   `name`: (required) must be unique to all other groups.
-   `description`: (optional)
-   `abacPermissions`: (optional)
-   `queryPolicy`: (optional)

```graphql
mutation Mutation(
  $name: String!
  $description: String
  $abacPermissions: [String!]
  $queryPolicy: [JSON!]
) {
  createIamGroup(
    name: $name
    description: $description
    abacPermissions: $abacPermissions
    queryPolicy: $queryPolicy
  ) {
    id
    name
    description
  }
}
```

**API Type Definitions**

**queryPolicy**

Description: Group Query Policies define query access for members of a particular group. Setting this property via the IAM API will **overwrite** any existing queryPolicy for the given group. If updating this property, _always_ define the full `queryPolicy` to enforce.

Type: list of `JSON` objects with primitive values or an array or primitive values.

```typescript
type queryPolicy = [JSON!];
type JSON = {
  [key: string]: string | number | boolean || (string | number | boolean)[];
}
```

queryPolicy

**abacPermissions**

ABAC permissions define application access for members of a perticular group. Setting this property via the IAM API will **overwrite** any existing permissions for the given group. If updating this property, _always_ define the full list of `permissions` that should be granted.

Type: list of valid `permission` strings (see table below).

```typescript
type abacPermissions = [permission!]
type permission = string // must be a valid permission string
```

**Permission Strings: READ-ONLY**

| DISPLAY NAME (J1 APP) | ACCESS | PERMISSION |
| --- | --- | --- |
| _All Apps And Resources_ | READ | `fullReadAccess` |
| _Shared: Questions_ | READ | `readQuestions` |
| _GraphData_ | READ | `readGraph` |
| _Home Page_ | READ | `accessLanding` |
| _Assets_ | READ | `accessAssets` |
| _Policies_ | READ | `accessPolicies` |
| _Compliance_ | READ | `accessCompliance` |
| _Alerts_ | READ | `accessRules` |
| _GraphViewer_ | READ | `accessGalaxy` |
| _Insights_ | READ | `accessInsights` |
| _Integrations_ | READ | `accessIntegrations` |
| _Endpoint Compliance_ | READ | `accessEndpointCompliance` |
| _Vulnerabilities_ | READ | `accessVulnerabilities` |

**Permission Strings: ADMIN**

| DISPLAY NAME (J1 APP) | ACCESS | PERMISSION |
| --- | --- | --- |
| _All Apps And Resources_ | ADMIN | `accessAdmin` |
| _Shared: Questions_ | ADMIN | `writeQuestions` |
| _GraphData_ | ADMIN | `writeGraph` |
| _Home Page_ | ADMIN | `adminLanding` |
| _Assets_ | ADMIN | `adminAssets` |
| _Policies_ | ADMIN | `adminPolicies` |
| _Compliance_ | ADMIN | `adminCompliance` |
| _Alerts_ | ADMIN | `adminRules` |
| _GraphViewer_ | ADMIN | `adminGalaxy` |
| _Insights_ | ADMIN | `adminInsights` |
| _Integrations_ | ADMIN | `adminIntegrations` |
| _Endpoint Compliance_ | ADMIN | `adminEndpointCompliance` |
| _Vulnerabilities_ | ADMIN | `adminVulnerabilities` |
| _ENABLE API KEY ACCESS_ | \* | `apiKeyUser` |

**API Samples**

Sample (S1): `createIamGroup`

(S1): Request

```json
{
  "name": "Users"
}
```

(S1): Response

```json
{
  "data": {
    "createIamGroup": {
      "id": "90909-11ef-4280-970b-4444ca1837be",
      "name": "Users"
    }
  }
}
```

Sample (S2): `createIamGroup`

(S2): Request

```json
{
  "name": "UsersX",
  "description": "A group for X users"
}
```

(S2): Response

```json
{
  "data": {
    "createIamGroup": {
      "id": "11c2d370-89ef-4280-970b-d520ca1837be",
      "name": "UsersX",
      "description": "A group for X users"
    }
  }
}
```

Sample (S3): `createIamGroup`

(S3): Request

```json
{
  "name": "Support",
  "description": "A group for support users",
  "queryPolicy": [
    {
      "_type": ["aws_ecr_image", "bitbucket_pullrequest"]
    }
  ]
}
```

(S3): Response

```json
{
  "data": {
    "createIamGroup": {
      "id": "23434-454-45656-65656-4564564565",
      "name": "Support",
      "description": "A group for support users"
    }
  }
}
```

Sample (S4): `createIamGroup`

(S4): Request

```json
{
  "name": "Admins",
  "queryPolicy": [
    {
      "_type": "aws_ecs_task_definition",
      "_class": "Account"
    },
    {
      "_type": "aws_ecr_image"
    }
  ]
}
```

(S4): Response

```json
{
  "data": {
    "createIamGroup": {
      "id": "87787-6787-678678-778-6786786",
      "name": "Admins"
    }
  }
}
```

**Access All Actions and Resources**

You can use an API token to access all actions and resources

### Update IAM Group

**Mutation: `updateIamGroup`**

Updates a `group`'s properties: `name`, `description`, `queryPolicy`, and/or `abacPermissions`.

-   `id`: (required) must tie to an existing group.
-   `name`: (optional) must be unique to all other groups.
-   `description`: (optional)
-   `abacPermissions`: (optional)
-   `queryPolicy`: (optional)

```graphql
mutation Mutation(
  $id: String!
  $name: String
  $description: String
  $abacPermissions: [String!]
  $queryPolicy: [JSON!]
) {
  updateIamGroup(
    id: $id
    name: $name
    description: $description
    abacPermissions: $abacPermissions
    queryPolicy: $queryPolicy
  ) {
    id
    name
    description
  }
}
```

**API Type Definitions**

**queryPolicy**

Description: Group Query Policies define query access for members of a particular group. Setting this property via the IAM API will **overwrite** any existing queryPolicy for the given group. If updating this property, _always_ define the full `queryPolicy` to enforce.

Type: list of `JSON` objects with primitive values or an array or primitive values.

```typescript
type queryPolicy = [JSON!];
type JSON = {
  [key: string]: string | number | boolean || (string | number | boolean)[];
}
```

**abacPermissions**

Description: ABAC permissions define application access for members of a perticular group. Setting this property via the IAM API will **overwrite** any existing permissions for the given group. If updating this property, _always_ define the full list of `permissions` that should be granted.

Type: list of valid `permission` strings (see table below).

```typescript
type abacPermissions = [permission!];
type permission = string; // must be a valid permission string
```

**Permission Strings: READ-ONLY**

| DISPLAY NAME (J1 APP) | ACCESS | PERMISSION |
| --- | --- | --- |
| _All Apps And Resources_ | READ | `fullReadAccess` |
| _Shared: Questions_ | READ | `readQuestions` |
| _GraphData_ | READ | `readGraph` |
| _Home Page_ | READ | `accessLanding` |
| _Assets_ | READ | `accessAssets` |
| _Policies_ | READ | `accessPolicies` |
| _Compliance_ | READ | `accessCompliance` |
| _Alerts_ | READ | `accessRules` |
| _GraphViewer_ | READ | `accessGalaxy` |
| _Insights_ | READ | `accessInsights` |
| _Integrations_ | READ | `accessIntegrations` |
| _Endpoint Compliance_ | READ | `accessEndpointCompliance` |
| _Vulnerabilities_ | READ | `accessVulnerabilities` |

**Permission Strings: ADMIN**

| DISPLAY NAME (J1 APP) | ACCESS | PERMISSION |
| --- | --- | --- |
| _All Apps And Resources_ | ADMIN | `accessAdmin` |
| _Shared: Questions_ | ADMIN | `writeQuestions` |
| _GraphData_ | ADMIN | `writeGraph` |
| _Home Page_ | ADMIN | `adminLanding` |
| _Assets_ | ADMIN | `adminAssets` |
| _Policies_ | ADMIN | `adminPolicies` |
| _Compliance_ | ADMIN | `adminCompliance` |
| _Alerts_ | ADMIN | `adminRules` |
| _GraphViewer_ | ADMIN | `adminGalaxy` |
| _Insights_ | ADMIN | `adminInsights` |
| _Integrations_ | ADMIN | `adminIntegrations` |
| _Endpoint Compliance_ | ADMIN | `adminEndpointCompliance` |
| _Vulnerabilities_ | ADMIN | `adminVulnerabilities` |
| _ENABLED API KEY ACCESS_ | \* | `apiKeyUser` |

**API Samples**

Sample (S1): `updateIamGroup`

(S1): Request

```json
{
  "id": "90909-11ef-4280-970b-4444ca1837be",
  "name": "Users"
}
```

(S1): Response

```json
{
  "data": {
    "updateIamGroup": {
      "id": "90909-11ef-4280-970b-4444ca1837be",
      "name": "Users",
      "description": "original description.."
    }
  }
}
```

Sample (S2): `updateIamGroup`

(S2): Request

```json
{
  "id": "90909-11ef-4280-970b-4444ca",
  "name": "UsersX",
  "description": "A group for X users"
}
```

(S2): Response

```json
{
  "data": {
    "updateIamGroup": {
      "id": "90909-11ef-4280-970b-4444ca",
      "name": "UsersX",
      "description": "A group for X users"
    }
  }
}
```

Sample (S3): `updateIamGroup`

(S3): Request

```json
{
  "id": "90909-11ef-4280-970b-4444ca",
  "abacPermissions": ["accessPolicies", "writeQuestions", "accessGalaxy"],
  "queryPolicy": [
    {
      "_type": "aws_ecs_task_definition"
    }
  ]
}
```

(S3): Response

```json
{
  "data": {
    "updateIamGroup": {
      "id": "90909-11ef-4280-970b-4444ca",
      "name": "UsersX",
      "description": "A group for X users"
    }
  }
}
```

Sample (S4): `updateIamGroup`

(S4): Request

```json
{
  "id": "90909-11ef-4280-970b-4444ca",
  "description": "allow account class",
  "queryPolicy": [
    {
      "_type": "aws_ecs_task_definition",
      "_class": "Account"
    },
    {
      "_integrationType": ["whitehat"]
    }
  ]
}
```

(S4): Response

```json
{
  "data": {
    "updateIamGroup": {
      "id": "90909-11ef-4280-970b-4444ca",
      "name": "UsersX",
      "description": "allow account class"
    }
  }
}
```

### Set RBAC Permissions

Resource permissions are used to manage access to the following resources: integrations, dashboards, and rules. You can set resource permissions for a user group by using the following gql mutation:

**Mutation: `setResourcePermission`**

Creates/updates a resource permission for a `group`

-   `subjectType`: (required) Currently only supports `group` for user group
-   `subjectId`: (required) The id of the user group
-   `resourceArea`: (required) `dashboard`, `integration`, or `rule`
-   `resourceType`: (required) `*`, `resource_group`, `dashboard`, `integration`, or `rule`
-   `resourceId`: (required) The id of the resource or `*`
-   `canCreate`: (required)
-   `canRead`: (required) Must be true if `canCreate`, `canUpdate` or `canDelete` are true
-   `canUpdate`: (required)
-   `canDelete`: (required)

```graphql
mutation SetResourcePermission(
  $subjectType: String!
  $subjectId: String!
  $resourceArea: String!
  $resourceType: String!
  $resourceId: String!
  $canCreate: Boolean!
  $canRead: Boolean!
  $canUpdate: Boolean!
  $canDelete: Boolean!
) {
  setResourcePermission(
    input: {
      subjectType: $subjectType
      subjectId: $subjectId
      resourceArea: $resourceArea
      resourceType: $resourceType
      resourceId: $resourceId
      canCreate: $canCreate
      canRead: $canRead
      canUpdate: $canUpdate
      canDelete: $canDelete
    }
  ) {
    subjectType
    subjectId
    resourceArea
    resourceType
    resourceId
    canCreate
    canRead
    canUpdate
    canDelete
  }
}
```

---

Source: /api/integrations-operations

# Integrations API

### Scheduling Integration Jobs

Use the `pollingIntervalCronExpression` to set an `hour` or `dayOfWeek` value for an integration configuration to run.

#### Set the Hour

When using the `ONE_DAY` polling interval, you can pass an optional `pollingIntervalCronExpression` to specify a time of day for the integration to execute.

The following configuration sets an integration to execute daily between 00:00 and 01:00 UTC.

```graphql
{
  "pollingInterval": "ONE_DAY",
  "pollingIntervalCronExpression": { "hour": 0 }
}
```

`pollingIntervalCronExpression.hour` accepts an integer between 0 and 23.

#### Set the Day of the Week

When using the `ONE_WEEK` polling interval, you can pass an optional `pollingIntervalCronExpression` to specify both a `dayOfWeek` and `hour` for the integration to execute.

The following configuration sets an integration to execute weekly on Sunday between 00:00 and 01:00 UTC.

```graphql
{
  "pollingInterval": "ONE_WEEK",
  "pollingIntervalCronExpression": { "hour": 0, "dayOfWeek": 0 }
}
```

`pollingIntervalCronExpression.dayOfWeek` accepts an integer between 0 (Sunday) and 6 (Saturday).

#### Example Mutation

This is an example of a GraphQL mutation that updates the hour and day of the week for a specific configuration of an integration in JupiterOne:

```graphql
mutation integrationInstance(
  $id: String!
  $pollingIntervalCronExpression: IntegrationPollingIntervalCronExpressionInput
) {
  updateIntegrationInstance(
    id: $id
    update: { pollingIntervalCronExpression: $pollingIntervalCronExpression }
  ) {
    id
    name
    pollingInterval
    pollingIntervalCronExpression {
      hour
      dayOfWeek
    }
  }
}
```

Variables for the mutation:

```graphql
{
  "id": "00000000-0000-0000-0000-000000000000",
  "pollingIntervalCronExpression": {
    "hour": 0,
    "dayOfWeek": 0
  }
}
```

Variables:

`id`: the `id` of the configuration for which you want to update the hour and/or day of week. This ID is visible in each integration configuration in your account. To find the ID in your JupiterOne account, go to **Settings > Integration > {integration name} > {configuration name}** > value in the ID field.

`hour`: an integer between 0 and 23 that represents the hour of the day in UTC when you want the integration to run.

`dayofWeek`: an integer between 0 and 6 that represents the day of the week Sunday through Saturday on which you want the integration to run.

#### Example Query

This is an example of a GraphQL query that returns the current values in the `hour` and `dayOfWeek` parameters for a specific integration configuration:

```graphql
query integrationInstance($id: String!) {
  integrationInstance(id: $id) {
    id
    name
    pollingInterval
    pollingIntervalCronExpression {
      hour
      dayOfWeek
    }
  }
}
```

Variable for the query:

```graphql
{
  "id": "00000000-0000-0000-0000-000000000000"
}
```

Variables:

`id`: the `id` of the configuration for which you want to update the hour and/or day of week. This ID is visible in each integration configuration in your account. To find the ID in your JupiterOne account go to **Settings > Integration > {integration name} > {configuration name} >** value in the ID field.

### Finding an Integration Definition Based on a Type

For an end-customer guide to authoring custom integrations, see [Integration Development](/integrations/development/overview.md).

This query returns an Integration Definition. This query requires an Integration Type.

```graphql
query testQuery($integrationType: String!) {
  findIntegrationDefinition(integrationType: $integrationType) {
    id
    name
    type
    title
    integrationType
    integrationClass
    configFields {
      key
      displayName
      description
    }
  }
}
```

### Getting an Integration Definition with an ID

This query returns a Integration Definition. This query requires an ID.

```graphql
query getIntegrationDefinition($id: String) {
  integrationDefinition(id: $id) {
    id
    name
    type
    title
  }
}
```

### List Integration Definitions

This query returns a list of all Integration Definitions.

```graphql
query testQuery {
  integrationDefinitions {
    definitions {
      id
      name
      type
      title
    }
    pageInfo {
      endCursor
      hasNextPage
    }
  }
}
```

### List Integration Jobs

This query returns a list of Integration Jobs for a given Integration Instance.

```graphql
query testQuery (
  $integrationInstanceId: String!
  $cursor: String
  $size: Int
) {
  integrationJobs(
    integrationInstanceId: $integrationInstanceId
    cursor: $cursor
    size: $size
  ) {
    jobs {
      id
      createDate
      integrationInstanceId
      status
      errorsOccurred
      endDate
    }
    pageInfo {
      endCursor
      hasNextPage
    }
  }
}
```

### Integration Job Health

This section has been moved [here](/integrations/instance-management.md#instance-job-statues).

## Trigger an Integration Job via API

The following values are required in order to trigger an integration job via API: `API_KEY` - An API Key must be configured before leveraging the JupiterOne API. Review [Enable API Key Access](/api/authentication.md) for a guide in creating a JupiterOne API Key.

`ACCOUNT_ID` - This value is the unique ID of your JupiterOne Account, found in Settings under Account Management.

`INTEGRATION_INSTANCE_ID` - This value is the ID of the specific integration instance that will be triggered, found in Settings under Integrations and then selecting the specific integration that has been configured (Integrations - Configurations - Settings).

**Sample request:**

Endpoint:

```text
POST https://graphql.us.jupiterone.io
```

Headers:

```json
{
  "Content-Type": "application/json",
  "Accept": "application/json",
  "JupiterOne-Account": "{Account_ID}",
  "Authorization": "Bearer {API_Key}"
}
```

Body:

```graphql
{
  mutation Invoke {
    invokeIntegrationInstance(id: INTEGRATION_INSTANCE_ID) {
      success
    }
  }
}
```

## Retrieve JupiterOne Audit Events via API

User events in your JupiterOne account are logged and can be accessed via API.

**Sample request:**

Endpoint:

```text
POST https://graphql.us.jupiterone.io
```

Headers:

```json
{
  "Content-Type": "application/json",
  "JupiterOne-Account": "{Account_ID}",
  "Authorization": "Bearer {API_Key}"
}
```

Body:

```graphql
query Query($limit: Int, $cursor: String, $startTimestamp: Long, $endTimestamp: Long) {
  getAuditEventsForAccount(
    limit: $limit
    cursor: $cursor
    startTimestamp: $startTimestamp
    endTimestamp: $endTimestamp
  ) {
    items {
      id
      resourceType
      resourceId
      category
      timestamp
      performedByUserId
      data
    }
    pageInfo {
      endCursor
      hasNextPage
    }
  }
}
```

---

Source: /api/nodejs-client

# JupiterOne Node.js Client

JupiterOne's Node.js client and CLI support uploading entities in either JSON or YAML format making it easy to easy to add your own data not covered by our managed integrations.

> **NOTE**
> 
> This is currently an experimental project and subject to change.

## Installation

To install the client local to the current project:

```txt
npm install @jupiterone/jupiterone-client-nodejs
```

To install the client globally:

```txt
npm install @jupiterone/jupiterone-client-nodejs -g
```

## Using the Node.js client

```js
const { JupiterOneClient } = require('@jupiterone/jupiterone-client-nodejs');

const j1Client = await new JupiterOneClient({
  account: 'my-account-id',
  accessToken: 'my-api-token',
  apiBaseUrl: 'https://api.us.jupiterone.io' // Optional parameter 
}).init();
const integrationInstance = await j1Client.integrationInstances.get(
  'my-integration-instance-id',
);
```

## Using the JupiterOne CLI

```bash
$ j1 --help
Usage: j1 [options]

Options:
  -v, --version             output the version number
  -a, --account <id>        JupiterOne account ID.
  -u, --user <email>        JupiterOne user email.
  -k, --key <apiToken>      JupiterOne API access token.
  -q, --query <j1ql>        Execute a query.
  -o, --operation <action>  Supported operations: create, update, upsert, delete, bulk-delete, provision-alert-rule-pack
  --entity                  Specifies entity operations.
  --relationship            Specifies relationship operations.
  --alert                   Specifies alert rule operations.
  -f, --file <dir>          Input JSON file. Or the filename of the alert rule pack.
  --api-base-url <url>      Optionally specify base URL to use during execution. (defaults to `https://api.us.jupiterone.io`)
  -h, --help                output usage information
```

#### Relevant Environment Variables

-   `J1_API_TOKEN` - Sets the JupiterOne API access token as environment variable instead of passing it through -k parameter
-   `J1_DEV_ENABLED` - Alters the base url. Valid values: 'true' | 'false' (string)

## Examples

### Run a J1QL query

```bash
j1 -a j1dev -q 'Find jupiterone_account'
Validating inputs...
Authenticating with JupiterOne... OK
[
  {
    "id": "06ab12cd-a402-406c-8582-abcdef001122",
    "entity": {
      "_beginOn": 1553777431867,
      "_createdOn": 1553366320704,
      "_deleted": false,
      "displayName": "YCO, Inc.",
      "_type": [
        "jupiterone_account"
      ],
      "_key": "1a2b3c4d-44ce-4a2f-8cd8-99dd88cc77bb",
      "_accountId": "j1dev",
      "_source": "api",
      "_id": "1a2b3c4d-44ce-4a2f-8cd8-99dd88cc77bb",
      "_class": [
        "Account"
      ],
      "_version": 6
    },
    "properties": {
      "emailDomain": "yourcompany.com",
      "phoneNumber": "877-555-4321",
      "webURL": "https://yourcompany.com/",
      "name": "YCO"
    }
  }
]
Done!
```

#### Advanced Node Usage

You are able to pass in Apollo Query Options into the `queryV1` method. This is beneficial when you need to change how the cache behaves, for example. To do so:

```js

  // Pass in options like shown below:

  const options = {
    'fetchPolicy': 'network-only'
  }

  j1.queryV1('FIND jupiterone_account', options)
```

> **INFO**
> 
> More information about what data you can provide found here: [https://www.apollographql.com/docs/react/data/queries/#setting-a-fetch-policy](https://www.apollographql.com/docs/react/data/queries/#setting-a-fetch-policy).

### Create or update entities from a JSON input file

```bash
j1 -o create --entity -a j1dev -f ./local/entities.json
Validating inputs...
Authenticating with JupiterOne... Authenticated!
Created entity 12345678-fe34-44ee-b3b0-abcdef123456.
Created entity 12345678-e75f-40d6-858e-123456abcdef.
Done!

j1 -o update --entity -a j1dev -f ./local/entities.json
Validating inputs...
Authenticating with JupiterOne... Authenticated!
Updated entity 12345678-fe34-44ee-b3b0-abcdef123456.
Updated entity 12345678-e75f-40d6-858e-123456abcdef.
Done!
```

> **NOTE**
> 
> The `create` operation will also update an existing entity, if an entity matching the provided Key, Type, and Class already exists in JupiterOne. The `update` operation will fail unless that entity `Id` already exists.

The input JSON file is a single entity or an array of entities. For example:

```json
[
  {
    "entityId": "12345678-fe34-44ee-b3b0-abcdef123456",
    "entityKey": "test:entity:1",
    "entityType": "generic_resource",
    "entityClass": "Resource",
    "properties": {
      "name": "Test Entity Resource 1",
      "displayName": "TER1"
    }
  },
  {
    "entityId": "12345678-e75f-40d6-858e-123456abcdef",
    "entityKey": "test:entity:3",
    "entityType": "generic_resource",
    "entityClass": "Resource",
    "properties": {
      "name": "Test Entity Resource 2",
      "displayName": "TER2"
    }
  }
]
```

The `entityId` property is only necessary for `update` operations.

### Create or update alert rules from a JSON input file

```bash
j1 -o create --alert -a j1dev -f ./local/alerts.json
Validating inputs...
Authenticating with JupiterOne... OK
Created alert rule <uuid>.
Done!
```

The input JSON file is one or an array of alert rule instances. The following is an example of a single alert rule instance:

```json
{
  "instance": {
    "name": "unencrypted-prod-data",
    "description": "Data stores in production tagged critical and unencrypted",
    "specVersion": 1,
    "pollingInterval": "ONE_DAY",
    "outputs": ["alertLevel"],
    "operations": [
      {
        "when": {
          "type": "FILTER",
          "specVersion": 1,
          "condition": [
            "AND",
            ["queries.unencryptedCriticalData.total", "!=", 0]
          ]
        },
        "actions": [
          {
            "type": "SET_PROPERTY",
            "targetProperty": "alertLevel",
            "targetValue": "CRITICAL"
          },
          {
            "type": "CREATE_ALERT"
          }
        ]
      }
    ],
    "question": {
      "queries": [
        {
          "query": "Find DataStore with (production=true or tag.Production=true) and classification='critical' and encrypted!=true as d return d.tag.AccountName as Account, d.displayName as UnencryptedDataStores, d._type as Type, d.encrypted as Encrypted",
          "version": "v1",
          "name": "unencryptedCriticalData"
        }
      ]
    }
  }
}
```

Add `"id": "<uuid>"` property to the instance JSON when updating an alert rule.

### Bulk Delete

```bash
j1 -q 'Find SomeDataClass with someProp="some value"'
j1 -e -o bulk-delete -f ./results.json
```

The first CLI command queries data using a J1QL query and saves the data locally to `results.json`. The second CLI command takes `results.json` as input and bulk deletes all the entities in the file.

### Provision Alert Rules from Rule Pack

The following command will provision all the default alert rules from `jupiterone-alert-rules` with the rule pack name `aws-config`:

```bash
j1 -a <j1AccountId> -u <j1Username> -o provision-alert-rule-pack --alert -f aws-config
```

You can specify your own rule pack to provision as well, by specifying the full file path to the `rule-pack.json` file:

```bash
j1 -a <j1AccountId> -u <j1Username> -o provision-alert-rule-pack --alert -f path/to/your/rule-pack.json
```

For more details about the rules and rule packs, see the [`jupiterone-alert-rules` project](https://github.com/JupiterOne/jupiterone-alert-rules).

---

Source: /api/python-client

# JupiterOne Python SDK

[![Python 3.6](https://img.shields.io/badge/python-3.6-blue.svg)](https://www.python.org/downloads/release/python-360/) [![Python 3.7](https://img.shields.io/badge/python-3.7-blue.svg)](https://www.python.org/downloads/release/python-370/)

A Python library for the [JupiterOne API](https://docs.jupiterone.io/reference).

## Installation

Requires Python 3.6+

`pip install jupiterone`

## Usage

##### Create a new client:

```python
from jupiterone import JupiterOneClient

j1 = JupiterOneClient(
    account='<yourAccountId>',
    token='<yourApiToken>',
    url='https://graphql.us.jupiterone.io',
    sync_url='https://api.us.jupiterone.io'
)
```

## Regional or Custom Tenant Support

For users with J1 accounts in the EU region for example, the 'url' parameter will need to be updated to "[https://graphql.eu.jupiterone.io](https://graphql.eu.jupiterone.io)" and the 'sync\_url' parameter will need to be updated to "[https://api.eu.jupiterone.io](https://api.eu.jupiterone.io)".

If no 'url' parameter is passed, the default of "[https://graphql.us.jupiterone.io](https://graphql.us.jupiterone.io)" is used, and if no 'sync\_url' parameter is passed, the default of "[https://api.us.jupiterone.io](https://api.us.jupiterone.io)" is used.

## Method Examples:

### \*See the examples/examples.py for full usage example documentation

##### Execute a query:

```python
QUERY = 'FIND Host'
query_result = j1.query_v1(QUERY)

# Including deleted entities
query_result = j1.query_v1(QUERY, include_deleted=True)

# Tree query
QUERY = 'FIND Host RETURN TREE'
query_result = j1.query_v1(QUERY)

# Using cursor graphQL variable to return full set of paginated results
QUERY = "FIND (Device | Person)"
cursor_query_r = j1._cursor_query(QUERY)
```

##### Create an entity:

Note that the CreateEntity mutation behaves like an upsert, so a non-existent entity will be created or an existing entity will be updated.

```python
properties = {
    'myProperty': 'myValue',
    'tag.myTagProperty': 'value_will_be_a_tag'
}

entity = j1.create_entity(
   entity_key='my-unique-key',
   entity_type='my_type',
   entity_class='MyClass',
   properties=properties,
   timestamp=int(time.time()) * 1000 # Optional, defaults to current datetime
)
print(entity['entity'])
```

#### Update an existing entity:

Only send in properties you want to add or update, other existing properties will not be modified.

```python
properties = {
    'newProperty': 'newPropertyValue'
}

j1.update_entity(
    entity_id='<id-of-entity-to-update>',
    properties=properties
)
```

#### Delete an entity:

```python
j1.delete_entity(entity_id='<id-of-entity-to-delete>')
```

##### Create a relationship

```python
j1.create_relationship(
    relationship_key='this_entity_relates_to_that_entity',
    relationship_type='my_relationship_type',
    relationship_class='MYRELATIONSHIP',
    from_entity_id='<id-of-source-entity>',
    to_entity_id='<id-of-destination-entity>'
)
```

##### Delete a relationship

```python
j1.delete_relationship(relationship_id='<id-of-relationship-to-delete>')
```

##### Fetch Graph Entity Properties

```python
j1.fetch_all_entity_properties()
```

##### Fetch Graph Entity Tags

```python
j1.fetch_all_entity_tags()
```

##### Fetch Entity Raw Data

```python
j1.fetch_entity_raw_data(entity_id='<id-of-entity>')
```

##### Create Integration Instance

```python
j1.create_integration_instance(
    instance_name="Integration Name", 
    instance_description="Description Text")
```

##### Start Synchronization Job

```python
j1.start_sync_job(instance_id='<id-of-integration-instance>')
```

##### Upload Batch of Entities

```python
entities_payload = [
    {
      "_key": "1",
      "_type": "pythonclient",
      "_class": "API",
      "displayName": "pythonclient1",
      "propertyName": "value"
    },
    {
      "_key": "2",
      "_type": "pythonclient",
      "_class": "API",
      "displayName": "pythonclient2",
      "propertyName": "value"
    },
    {
      "_key": "3",
      "_type": "pythonclient",
      "_class": "API",
      "displayName": "pythonclient3",
      "propertyName": "value"
    }
]

j1.upload_entities_batch_json(instance_job_id='<id-of-integration-sync-job>',
                              entities_list=entities_payload)
```

##### Upload Batch of Relationships

```python
relationships_payload = [
    {
      "_key": "1:2",
      "_class": "EXTENDS",
      "_type": "pythonclient_extends_pythonclient",
      "_fromEntityKey": "1",
      "_toEntityKey": "2",
      "relationshipProperty": "value"
    },
    {
      "_key": "2:3",
      "_class": "EXTENDS",
      "_type": "pythonclient_extends_pythonclient",
      "_fromEntityKey": "2",
      "_toEntityKey": "3",
      "relationshipProperty": "value"
    }
]

j1.upload_relationships_batch_json(instance_job_id='<id-of-integration-sync-job>',
                                   relationships_list=relationships_payload)
```

##### Upload Batch of Entities and Relationships

```python
combined_payload = {
    "entities": [
    {
      "_key": "4",
      "_type": "pythonclient",
      "_class": "API",
      "displayName": "pythonclient4",
      "propertyName": "value"
    },
    {
      "_key": "5",
      "_type": "pythonclient",
      "_class": "API",
      "displayName": "pythonclient5",
      "propertyName": "value"
    },
    {
      "_key": "6",
      "_type": "pythonclient",
      "_class": "API",
      "displayName": "pythonclient6",
      "propertyName": "value"
    }
],
    "relationships": [
    {
      "_key": "4:5",
      "_class": "EXTENDS",
      "_type": "pythonclient_extends_pythonclient",
      "_fromEntityKey": "4",
      "_toEntityKey": "5",
      "relationshipProperty": "value"
    },
    {
      "_key": "5:6",
      "_class": "EXTENDS",
      "_type": "pythonclient_extends_pythonclient",
      "_fromEntityKey": "5",
      "_toEntityKey": "6",
      "relationshipProperty": "value"
    }
]
}

j1.upload_combined_batch_json(instance_job_id='<id-of-integration-sync-job>',
                              combined_payload=combined_payload)
```

##### Finalize Synchronization Job

```python
j1.finalize_sync_job(instance_job_id='<id-of-integration-sync-job>')
```

##### Fetch Integration Instance Jobs

```python

j1.fetch_integration_jobs(instance_id='<id-of-integration-instance>')
```

##### Fetch Integration Instance Job Events

```python
j1.fetch_integration_job_events(instance_id='<id-of-integration-instance>',
                                instance_job_id='<id-of-integration-instance-job>')
```

##### Create SmartClass

```python
j1.create_smartclass(smartclass_name='SmartClassName',
                     smartclass_description='SmartClass Description Text')
```

##### Create SmartClass Query

```python
j1.create_smartclass_query(smartclass_id='<id-of-smartclass>',
                           query='<J1QL-query-to-be-added>',
                           query_description='Query Description Text')
```

##### Run SmartClass Evaluation

```python
j1.evaluate_smartclass(smartclass_id='<id-of-smartclass>')
```

##### Get SmartClass Details

```python
j1.get_smartclass_details(smartclass_id='<id-of-smartclass>')
```

##### Generate J1QL from Natural Language Prompt

```python
j1.generate_j1ql(natural_language_prompt='<natural-language-input-text>')
```

##### List Alert Rules

```python
j1.list_alert_rules()
```

##### Get Alert Rule Details

```python
j1.get_alert_rule_details(rule_id='<id-of-alert-rule>')
```

##### Create Alert Rule

```python
# polling_interval can be DISABLED, THIRTY_MINUTES, ONE_HOUR, FOUR_HOURS, EIGHT_HOURS, TWELVE_HOURS, ONE_DAY, or ONE_WEEK
# severity can be INFO, LOW, MEDIUM, HIGH, or CRITICAL

j1.create_alert_rule(name="create_alert_rule-name",
                     description="create_alert_rule-description",
                     tags=['tag1', 'tag2'],
                     polling_interval="DISABLED",
                     severity="INFO",
                     j1ql="find jupiterone_user")
```

##### Create Alert Rule with Action Config

```python

webhook_action_config = {
            "type": "WEBHOOK",
            "endpoint": "https://webhook.domain.here/endpoint",
            "headers": {
              "Authorization": "Bearer <SECRET>",
            },
            "method": "POST",
            "body": {
              "queryData": "{{queries.query0.data}}"
            }
}

tag_entities_action_config = {
            "type": "TAG_ENTITIES",
            "entities": "{{queries.query0.data}}",
            "tags": [
              {
                "name": "tagKey",
                "value": "tagValue"
              }
            ]
}

j1.create_alert_rule(name="create_alert_rule-name",
                    description="create_alert_rule-description",
                    tags=['tag1', 'tag2'],
                    polling_interval="DISABLED",
                    severity="INFO",
                    j1ql="find jupiterone_user",
                    action_configs=webhook_action_config)
```

##### Delete Alert Rule

```python

j1.delete_alert_rule(rule_id='<id-of-alert-rule')
```

##### Update Alert Rule

```python

# polling_interval can be DISABLED, THIRTY_MINUTES, ONE_HOUR, FOUR_HOURS, EIGHT_HOURS, TWELVE_HOURS, ONE_DAY, or ONE_WEEK
# tag_op can be OVERWRITE or APPEND
# severity can be INFO, LOW, MEDIUM, HIGH, or CRITICAL
# action_configs_op can be OVERWRITE or APPEND

alert_rule_config_alert = [
    {
        "type": "CREATE_ALERT"
    }
]

alert_rule_config_tag = [
    {
        "type": "TAG_ENTITIES",
        "entities": "{{queries.query0.data}}",
        "tags": [
            {
                "name": "tagName",
                "value": "tagValue"
            }
        ]
    }
]

alert_rule_config_webhook = [
    {
        "type": "WEBHOOK",
        "endpoint": "https://webhook.example",
        "headers": {
            "Authorization": "Bearer <TOKEN>"
        },
        "method": "POST",
        "body": {
            "queryData": "{{queries.query0.data}}"
        }
    }
]

alert_rule_config_multiple = [
    {
        "type": "WEBHOOK",
        "endpoint": "https://webhook.example",
        "headers": {
            "Authorization": "Bearer <TOKEN>"
        },
        "method": "POST",
        "body": {
            "queryData": "{{queries.query0.data}}"
        }
    },
    {
        "type": "TAG_ENTITIES",
        "entities": "{{queries.query0.data}}",
        "tags": [
            {
                "name": "tagName",
                "value": "tagValue"
            }
        ]
    }
]

j1.update_alert_rule(rule_id="<id-of-alert-rule>",
                     name="Updated Alert Rule Name",
                     description="Updated Alert Rule Description",
                     j1ql="find jupiterone_user",
                     polling_interval="ONE_WEEK",
                     tags=['tag1', 'tag2', 'tag3'],
                     tag_op="OVERWRITE",
                     severity="INFO",
                     action_configs=alert_rule_config_tag,
                     action_configs_op="OVERWRITE")

j1.update_alert_rule(rule_id='<id-of-alert-rule>',
                     tags=['newTag1', 'newTag1'],
                     tag_op="OVERWRITE")

j1.update_alert_rule(rule_id='<id-of-alert-rule>',
                     tags=['additionalTag1', 'additionalTag2'],
                     tag_op="APPEND")
```

##### Evaluate Alert Rule

```python

j1.evaluate_alert_rule(rule_id='<id-of-alert-rule>')
```

##### Get Compliance Framework Item

```python

j1.get_compliance_framework_item_details(item_id="<id-of-item>")
```

##### List Alert Rule Evaluation Results

```python

j1.list_alert_rule_evaluation_results(rule_id="<id-of-rule>")
```

##### Fetch Evaluation Result Download URL

```python

j1.fetch_evaluation_result_download_url(raw_data_key="RULE_EVALUATION/<id-of-evaluation>/query0.json")
```

##### Fetch Evaluation Result Download URL

```python

j1.fetch_evaluation_result_download_url(raw_data_key="RULE_EVALUATION/<id-of-evaluation>/query0.json")
```

##### Fetch Downloaded Evaluation Results

```python

j1.fetch_downloaded_evaluation_results(download_url="https://download.us.jupiterone.io/<id-of-rule>/RULE_EVALUATION/<id-of-evaluation>/<epoch>/query0.json?token=<TOKEN>&Expires=<epoch>")
```

##### Get Integration Definition Details

```python

# examples: 'aws', 'azure', 'google_cloud'

j1.get_integration_definition_details(integration_type="<integration-type>")
```

##### Fetch Integration Instances

```python

j1.fetch_integration_instances(definition_id="<id-of-definition>")
```

##### Fetch Integration Instance Details

```python

j1.get_integration_instance_details(instance_id="<id-of-integration-instance>")
```

##### Get Account Parameter Details

```python

j1.get_parameter_details(name="ParameterName")
```

##### List Account Parameters

```python

j1.list_account_parameters()
```

##### Create or Update Acount Parameter

```python

j1.create_update_parameter(name="ParameterName", value="stored_value", secret=False)
```

---

Source: /api/questions-operations

# Questions API

### Create a Question

```graphql
mutation CreateQuestion($question: CreateQuestionInput!) {
  createQuestion(question: $question) {
    id
    title
    description
    queries {
      name
      query
      version
      resultsAre
    }
    variables {
      name
      required
      default
    }
    compliance {
      standard
      requirements
    }
    accountId
    integrationDefinitionId
  }
}
```

**Variables**:

```json
{
  "question": {
    "title": "What are my production data stores and their encryption status?",
    "tags": ["SecOps"],
    "description": "Returns a list of all production entities.",
    "queries": [
      {
        "name": "prod-datastores-encrypted",
        "query": "Find * with tag.Production=true and encrypted=true",
        "resultsAre": "GOOD"
      },
      {
        "name": "prod-datastores-unencrypted",
        "query": "Find * with tag.Production=true and encrypted!=true",
        "resultsAre": "BAD"
      }
    ],
    "compliance": [
      {
        "standard": "NIST CSF",
        "requirements": ["ID.AM-1"]
      }
    ]
  }
}
```

> **NOTE**
> 
> The `name` field is optional; `name` is recommended to be a single word without special characters, and `resultsAre` with values `GOOD`, `BAD`, and `UNKNOWN` are used to determine gaps/issues and to perform continuous compliance assessment. `INFORMATIVE` is the default value.

### Update a question

```graphql
mutation UpdateQuestion($id: ID!, $update: QuestionUpdate!) {
  updateQuestion(id: $id, update: $update) {
    id
    title
    description
    queries {
      name
      query
      version
      resultsAre
    }
    variables {
      name
      required
      default
    }
    compliance {
      standard
      requirements
    }
    accountId
    integrationDefinitionId
  }
}
```

**Variables**:

```json
{
  "id": "sj3j9f0j2ndlsj300swdjfjs",
  "update": {
    "title": "What are my production data stores and their encryption status?",
    "tags": ["SecOps"],
    "description": "Returns a list of all production entities.",
    "queries": [
      {
        "name": "prod-datastores-encrypted",
        "query": "Find * with tag.Production=true and encrypted=true",
        "resultsAre": "GOOD"
      },
      {
        "name": "prod-datastores-unencrypted",
        "query": "Find * with tag.Production=true and encrypted!=true",
        "resultsAre": "BAD"
      }
    ],
    "compliance": [
      {
        "standard": "NIST CSF",
        "requirements": ["ID.AM-1"]
      }
    ]
  }
}
```

> **NOTE**
> 
> That the only difference here for `update` is the `"id"` property associated with the question.

### Delete a question

```graphql
  mutation DeleteQuestion($id: ID!) {
    deleteQuestion(id: $id) {
      id
      title
      description
      queries {
        query
        name
        version
      }
      variables {
        name
        required
        default
      }
      tags
      accountId
      integrationDefinitionId
    }
  }
```

**Variables**:

```json
{
  "id": "slj3098s03j-i2ojd0j2-sjkkdjf"
}
```

### Search for questions

```graphql
query GetQuestions($searchQuery: String) {
	questions (searchQuery: $searchQuery) {
		questions {
			id
			name
			description
		}
	}
}
```

**Variables**:

```json
{
  "searchQuery": "encrypted"
}
```

### Evaluate a question:

```graphql
query EvaluateQuestion($id: ID!) {
	evaluateQuestion (id: $id) {
		answerText
		outputs {name, value}
	}
}
```

**Variables**:

```json
{
  "id": <some string>
}
```

---

Source: /api/rate-limiting

# GraphQL API Rate Limiting

> Rate limiting is a technique to limit network traffic to avoid exhausting system resources.

Rate limits are described in terms of tokens and the token-replenishment rate. Various actions performed using the JupiterOne public API deplete tokens and tokens are replenished at a predictable rate. If there are insufficient tokens to perform an action, then you receive a _rate exceeded_ (`429` HTTP response code) error. The rate limits are only when actions are performed using the public API. Scheduled or background activity (compliance report evaluation, rule evaluation, and so on) does not deplete tokens.

> **INFO**
> 
> Requests made through the [JupiterOne MCP Server](/integrations/jupiterone-mcp-server.md) count against the same API rate limits described below.

JupiterOne has public API rate limits for GraphQL API mutations/queries. The rate-limited APIs return the following headers to control request back-off and throttling:

-   **RateLimit-Limit**: The quota of the currently most-limited bucket, such as the maximum quota of the bucket with the fewest remaining, concatenated with the quota and time window (in seconds) of each applicable bucket. For example, 1000, 10000; window=60, 1000; window=60.
    
-   **RateLimit-Remaining**: Whichever bucket is the closest to being full. This is the maximum number of invocations minus the number that are currently counted against the limit. This means it is the largest amount of further invocations that could be executed without being rejected by rate-limiting at the moment of the request.
    
-   **RateLimit-Reset**: If no further invocations were made against any limits, this is the number of seconds remaining until **all** buckets that apply against the invocation would be entirely emptied. This means it is the greatest amount among all times-to-empty for applicable limits.
    
-   **RateLimit-Requested**: This is a custom header specified because of the concurrency model of GraphQL and the way J1 counts multiple invocations from a single GraphQL request. This response header is an integer that returns the number of invocations that were counted in the request, regardless of whether the request was served or dropped due to quotas.
    

##### Example 1

In this use case:

-   An account is permitted 10,000 invocations per 60 seconds.
-   In the last 60 seconds, there have been 9,900 invocations in the account.
-   A token is permitted 1,000 invocations per 60 seconds.
-   In the last 60 seconds, there have been 800 invocations using the token.
-   A new request using the token that would be counted as 50 invocations is now being processed.

The number of tentative invocations to be counted is added as RateLimit-Requested: RateLimit-Requested: 50

The request should be permitted, since pre-request the account limit has 100 remaining and the token limit has 200 remaining. After the request, the account limit has 50 remaining and the token limit has 150 remaining. Since the account limit is closer, it is used for RateLimit-Remaining and RateLimit-Limit headers:

```text
RateLimit-Remaining: 50
RateLimit-Limit: 10000, 1000;window=60, 10000;window=60
```

Supposing no other requests come in, it will take 9950/(10000/60) == 59.7 seconds for the account limit to clear, and it will take the token limit 800/(1000/60) == 48 seconds to clear. JupiterOne returns the greater number, rounded strictly _up_, i.e., `Math.ceil` (see IETF proposal – sub-second precision is disallowed).

```text
RateLimit-Reset: 60
```

##### Example 2

In this use case:

-   An account is permitted 10,000 invocations per 60 seconds.
-   In the last 60 seconds, there have been 9,900 invocations in the account.
-   A token is permitted 1,000 invocations per 60 seconds.
-   In the last 60 seconds, there have been 995 invocations using the token.
-   A new request using the token that would be counted as 50 invocations is now being processed.

The number of tentative invocations to be counted is added as RateLimit-Requested: RateLimit-Requested: 50

Because the token bucket has insufficient remaining invocations, the request should be dropped. Since the entire request is dropped, J1 does not count these invocations against the quota and, therefore, JupiterOne uses the pre-request numbers for the `Remaining` and `Limit` headers. The currently limiting bucket is the token bucket, which has 5 invocations remaining. The consumer can see that their request received `429` because 50 > 5:

```text
RateLimit-Remaining: 5
RateLimit-Limit: 1000, 1000;window=60, 10000;window=60
```

Supposing no other requests come in, it will take 9900/(10000/60) == 59.4 seconds for the account limit to clear, and it will take the token limit 995/(1000/60) == 59.7 seconds to clear. J1 returns the greater number, rounded strictly _up_, i.e. `Math.ceil` (see IETF proposal – sub-second precision is disallowed).

```text
RateLimit-Reset: 60
```

## GraphQL API Rate Limiting

Each GraphQL request can contain multiple mutations/queries and each individual mutation/query utilizes one _token_. To avoid a single end-user/client from depleting all tokens and impairing other clients, we apply hierarchical rate limiting at the _client level_ and _account level_. The client limit is configured to have a lower number of max tokens to better support fairness across multiple clients within a single account.

Each unique authenticated session or API token/key is considered to be a single client. It is possible for the same user to log in multiple times in different web browsers and each of these sessions is considered a unique client. Furthermore, if multiple API tokens are being used to send requests, then each API token is considered a unique client.

#### Account Rate Limit for GraphQL Mutations/Queries

-   2000 tokens per 2-minute period
    -   At any given time, there are a maximum of 2000 available tokens, which is the burst limit across the entire organization account.
    -   It takes two minutes to fully replenish 2000 tokens.
    -   JupiterOne discards mutations/queries when the rate exceeds 2000 tokens per 2-minute period.
    -   **Average rate allowed:** 16.67 GraphQL mutations/queries per second.
    -   **Configurable:** JupiterOne can adjust this rate limit on your behalf. Contact your J1 administrator.

#### Client Rate Limit for GraphQL Mutations/Queries

The default rate limit is `1000 tokens per 1-minute period`.

-   At any given time, there are a maximum of 1000 available tokens, which is the burst limit per client.
-   It takes 1 minute to fully replenish 1000 tokens.
-   JupiterOne discards invocations when the rate exceeds 1000 tokens per 1-minute period.
-   **Average rate allowed:** 16.67 GraphQL mutations/queries per second.
-   **Configurable:** An API token creator can adjust the rate limit when creating a token.

## J1QL Query Rate Limiting

J1QL queries executed via the [JupiterOne public API](#) are rate-limited separately from GraphQL API invocations covered previously in this article. Each J1QL query consumes one request token. All queries executed via the JupiterOne public API count towards the rate limit. This count includes user-initiated application queries (such as search and J1 Insights) _and_ queries via the JupiterOne public API. You should incorporate retry with backoff in response to rate-limiting responses from the JupiterOne API.

#### **Account Rate Limit for J1QL Queries**

-   Default limit: 120 tokens/120 seconds
-   Enterprise limit (available on request): 60 tokens/60 seconds
-   Enterprise customers are eligible for a rate limit increase up to 120 tokens/60 seconds, subject to usage analysis and approval. Contact your J1 TSE to request an increase.

---

Source: /api/relationship-mutations

# Relationship mutations

## Create Relationship

```graphql
mutation CreateRelationship (
  $relationshipKey: String!
  $relationshipType: String!
  $relationshipClass: String!
  $fromEntityId: String!
  $toEntityId: String!
  $timestamp: Long
  $properties: JSON
) {
  createRelationship (
    relationshipKey: $relationshipKey,
    relationshipType: $relationshipType,
    relationshipClass: $relationshipClass,
    fromEntityId: $fromEntityId,
    toEntityId: $toEntityId,
    timestamp: $timestamp,
    properties: $properties
  ) {
    relationship {
      _id
      ...
    }
    edge {
      id
      toVertexId
      fromVertexId
      relationship {
        _id
        ...
      }
      properties
    }
  }
}
```

**Variables**:

```json
{
  "relationshipKey": "<a relationship key>",
  "relationshipType": "<a relationship type>",
  "relationshipClass": "<a relationship class>",
  "fromEntityId": "<the _id of the from entity>",
  "toEntityId": "<the _id of the to entity>",
  "timestamp": 1529329792552,
  "properties": {
    // Custom properties on the relationship
    ...
  }
}
```

## Update Relationship

```graphql
mutation UpdateRelationship (
  $relationshipId: String!
  $fromEntityId: String!
  $toEntityId: String!
  $timestamp: Long
  $properties: JSON
) {
  updateRelationship (
    relationshipId: $relationshipId,
    fromEntityId: $fromEntityId,
    toEntityId: $toEntityId,
    timestamp: $timestamp,
    properties: $properties
  ) {
    relationship {
      _id
      ...
    }
    edge {
      id
      toVertexId
      fromVertexId
      relationship {
        _id
        ...
      }
      properties
    }
  }
}
```

**Variables**:

```json
{
  "relationshipId": "<a relationship Id (relationship._id)>",
  "fromEntityId": "<the _id of the from entity>",
  "toEntityId": "<the _id of the to entity>",
  "timestamp": 1529329792552,
  "properties": {
    // Custom properties to update on the relationship
    ...
  }
}
```

## Delete Relationship

```graphql
mutation DeleteRelationship (
  $relationshipId: String!
  $fromEntityId: String!
  $toEntityId: String!
  $timestamp: Long
  $hardDelete: Boolean
) {
  deleteRelationship (
    relationshipId: $relationshipId,
    fromEntityId: $fromEntityId,
    toEntityId: $toEntityId,
    timestamp: $timestamp,
    hardDelete: $hardDelete
  ) {
    relationship {
      _id
      ...
    }
    edge {
      id
      toVertexId
      fromVertexId
      relationship {
        _id
        ...
      }
      properties
    }
  }
}
```

**Variables**:

```json
{
  "relationshipId": "<a relationship Id (relationship._id)>",
  "fromEntityId": "<the _id of the from entity (optional)>",
  "toEntityId": "<the _id of the to entity (optional)>",
  "timestamp": 1529329792552,
  "hardDelete": true
}
```

> **CAUTION**
> 
> `hardDelete` is a flag that completely removes all information related to the relationship in a way that is not recoverable.

---

Source: /api/sync-jobs/api-reference

# Sync jobs API reference

This page is the endpoint-by-endpoint reference for the sync jobs API. For a conceptual introduction, the lifecycle, and how to choose between modes, start with the [overview](/api/sync-jobs/overview.md). For mode-specific guidance, see [DIFF](/api/sync-jobs/diff.md), [PATCH](/api/sync-jobs/patch.md), [CROSS\_SCOPE](/api/sync-jobs/cross-scope.md), and [OVERRIDE](/api/sync-jobs/override.md).

All sync job endpoints are mounted under `/persister/synchronization/jobs`.

## Authentication

Every request needs:

-   `Authorization: Bearer <api-key>`
-   `jupiterone-account: <account-id>`

See [Authentication](/api/authentication.md) for setup.

## Request body properties

The `start` endpoint accepts these top-level properties:

`source`

-   `api` for ad-hoc data uploaded by you.
-   `integration-external` for custom integrations. For setting up a custom integration that uses this source, see [Integration Development](/integrations/development/overview.md).

`scope`

-   Any string. Used to group everything in this sync job for the purposes of comparison on finalize.
-   Required when `syncMode` is `DIFF`.
-   Can only be used when `source` is `api`.

`syncMode`

-   `DIFF` (default): replaces the full dataset in scope. See [DIFF](/api/sync-jobs/diff.md).
-   `PATCH`: updates existing entities only; never creates or deletes. See [PATCH](/api/sync-jobs/patch.md).
-   `CROSS_SCOPE`: relationships between entities in different scopes. See [CROSS\_SCOPE](/api/sync-jobs/cross-scope.md).
-   `OVERRIDE`: pins property values on managed-integration entities. See [OVERRIDE](/api/sync-jobs/override.md).

`integrationInstanceId`

-   Required when referencing a custom integration (when `source` is `integration-external`).

### Request flags

`ignoreDuplicates`

-   Instructs the system not to throw an error if there are graph objects with duplicate keys. The latest object wins.

> **INFO**
> 
> The `CREATE_OR_UPDATE` mode is deprecated and no longer functions.

## Validation

The synchronization API performs comprehensive validation on all uploaded data. The required fields depend on the sync mode; see each mode's page for the full list.

### Property constraints

Custom properties:

-   Cannot start with underscore (`_`) — these are reserved for system properties.
-   Must be one of: `string`, `boolean`, `number`, `null`, or a homogenous array of one of those types.

Invalid values:

-   Mixed-type arrays (e.g., `["string", 123, true]`).
-   Nested objects (except `_rawData`).
-   `undefined`.

### Mapped relationships

Mapped relationships (used when one of the related entities isn't directly known) require:

-   `_key`, `_type`, `_class`.
-   `_mapping` object with:
    -   `sourceEntityKey` — required, the key of the source entity.
    -   `targetFilterKeys` — required, array of arrays for filtering target entities.
    -   `targetEntity` — required, object describing the target entity.
    -   `skipTargetCreation` — optional boolean.
    -   `relationshipDirection` — optional, `"FORWARD"` or `"REVERSE"`.

### Upload size constraints

Each upload request must contain at least one entity or one relationship. Both arrays can be present in the same request (mode permitting).

### Common validation errors

| Error | Cause | Fix |
| --- | --- | --- |
| `Missing JupiterOne-Account header` | Required header not provided. | Include `jupiterone-account`. |
| `/entities/0/_key is required` | Missing required field. | Add `_key` (required by DIFF). |
| `/entities/0 (entity key: "key-1") has invalid property name '_internal'` | Property name starts with `_`. | Rename without the leading underscore. |
| `/entities/0/_class (entity key: "key-1") has invalid type. Valid types are string or array of strings.` | Invalid `_class` type. | Use a string or array of strings. |
| `/entities/0/_key: maximum length exceeded` | Field exceeds character limit. | Shorten `_key` to ≤ 7000 characters. |
| `Relationships are not allowed in PATCH jobs` | Relationships uploaded in PATCH mode. | Use [DIFF](/api/sync-jobs/diff.md) or [CROSS\_SCOPE](/api/sync-jobs/cross-scope.md). |
| `Relationship uploads are not allowed for OVERRIDE sync jobs` | Relationships uploaded in OVERRIDE mode. | OVERRIDE only accepts entities. |
| `OVERRIDE sync jobs are limited to 10000 entities per job` | Per-job entity cap exceeded. | Split across multiple sync jobs. |
| `OVERRIDE sync mode is not enabled for this account` | Account not on the OVERRIDE allowlist. | Contact JupiterOne support. |
| `entities must have minimum 1 item` | Empty entities array. | Include at least one entity, or omit the array. |

## Endpoints

### Start a synchronization job

```text
POST /persister/synchronization/jobs
```

Request:

```json
{
  "source": "api",
  "syncMode": "DIFF",
  "scope": "my-sync-job"
}
```

Or with a custom integration source:

```json
{
  "source": "integration-managed",
  "integrationInstanceId": "5465397d-8491-4a12-806a-04792839abe3"
}
```

Response:

```json
{
  "job": {
    "source": "api",
    "scope": "my-sync-job",
    "id": "f445397d-8491-4a12-806a-04792839abe3",
    "status": "AWAITING_UPLOADS",
    "startTimestamp": 1586915139427,
    "numEntitiesUploaded": 0,
    "numRelationshipsUploaded": 0,
    "numMappedRelationshipsUploaded": 0
  }
}
```

### Get status of a synchronization job

```text
GET /persister/synchronization/jobs/{jobId}
```

Response:

```json
{
  "job": {
    "source": "api",
    "scope": "my-sync-job",
    "id": "f445397d-8491-4a12-806a-04792839abe3",
    "status": "AWAITING_UPLOADS",
    "startTimestamp": 1586915139427,
    "numEntitiesUploaded": 0,
    "numRelationshipsUploaded": 0,
    "numMappedRelationshipsUploaded": 0
  }
}
```

The response carries running counters of the data uploaded so far in this job: total entities, total relationships, and total mapped relationships. After [finalize](#finalize-a-synchronization-job) completes, these are the final totals applied to the graph.

### Upload a batch of entities and/or relationships

The upload endpoints accept `application/json` only. Send the body with `Content-Type: application/json`. Requests may be `gzip`\- or `brotli`\-compressed.

```text
POST /persister/synchronization/jobs/{jobId}/upload
```

```json
{
  "entities": [
    {
      "_key": "1",
      "_class": "DataStore",
      "_type": "fake_entity",
      "displayName": "my_datastore"
    },
    {
      "_key": "2",
      "_class": "Database",
      "_type": "fake_entity",
      "displayName": "my_database"
    }
  ],
  "relationships": [
    {
      "_key": "a",
      "_type": "fake_relationship",
      "_class": "IS",
      "_fromEntityKey": "1",
      "_toEntityKey": "2"
    }
  ]
}
```

### Upload entities only

```text
POST /persister/synchronization/jobs/{jobId}/entities
```

```json
{
  "entities": [
    { "_key": "1", "_type": "fake_entity" }
  ]
}
```

### Upload relationships only

```text
POST /persister/synchronization/jobs/{jobId}/relationships
```

```json
{
  "relationships": [
    {
      "_key": "a",
      "_type": "fake_relationship",
      "_class": "HAS",
      "_fromEntityKey": "1",
      "_toEntityKey": "2"
    }
  ]
}
```

### Finalize a synchronization job

```text
POST /persister/synchronization/jobs/{jobId}/finalize
```

Finalize is asynchronous. The response confirms the job has entered finalization; it does not wait for the graph to be updated.

```json
{
  "job": {
    "id": "f445397d-8491-4a12-806a-04792839abe3",
    "status": "FINALIZE_PENDING"
  }
}
```

Poll [get status](#get-status-of-a-synchronization-job) until `status` is `FINISHED` (or terminal: `ABORTED`, `FAILED`, `ERROR`).

## See also

-   [Sync jobs overview](/api/sync-jobs/overview.md) — concepts and decision guide.
-   [DIFF](/api/sync-jobs/diff.md), [PATCH](/api/sync-jobs/patch.md), [CROSS\_SCOPE](/api/sync-jobs/cross-scope.md), [OVERRIDE](/api/sync-jobs/override.md) — per-mode guidance and scenarios.
-   [Creating relationships between entities](/features/assets/relationships-across-scopes.md).

---

Source: /api/sync-jobs/cross-scope

# CROSS\_SCOPE sync mode

`CROSS_SCOPE` exists to solve one specific problem: connecting entities that live in different scopes. Each managed integration owns its own scope, so a relationship between, say, an Okta user and a Jamf laptop can't be created by either integration on its own — neither side owns both the from and to entities.

`CROSS_SCOPE` is the bridge. It accepts only relationships, requires you to label both the from and to entities with their respective scopes, and never creates or deletes entities.

## When to use CROSS\_SCOPE

-   Both the from and to entities of the relationship already exist in the graph, sourced from different integrations or sync jobs.
-   You only need to create relationships, not entities.
-   The relationships can change over time, and you want a single sync job that owns them.

If the entities in question are in the same scope, use [`DIFF`](/api/sync-jobs/diff.md) or [`PATCH`](/api/sync-jobs/patch.md). If you also need to create entities, use the appropriate mode for the scope that owns them and let `CROSS_SCOPE` handle the cross-cutting edges separately.

## Example use cases

### Okta users to Jamf laptops

You want to ask "show me every laptop assigned to a member of the SRE Okta group." Okta produces `User` entities in the Okta scope; Jamf produces `Device` entities in the Jamf scope. Neither integration produces the `OWNS` edge between them.

-   **Scope**: `okta-jamf-ownership`
-   **Mode**: `CROSS_SCOPE`
-   **Why CROSS\_SCOPE**: The relationship spans two integrations. You own the mapping (probably from a separate inventory system), so you push only the edges.

```json
POST /persister/synchronization/jobs
{
  "source": "api",
  "syncMode": "CROSS_SCOPE",
  "scope": "okta-jamf-ownership"
}
```

POST /persister/synchronization/jobs/{jobId}/upload

```json
{
  "relationships": [
    {
      "_key": "okta-user:alice|owns|jamf-device:laptop-001",
      "_type": "user_owns_device",
      "_class": "OWNS",
      "_fromEntityKey": "okta-user:alice",
      "_toEntityKey": "jamf-device:laptop-001",
      "_fromEntityScope": "okta-instance-id",
      "_toEntityScope": "jamf-instance-id"
    }
  ]
}
```

### GitHub repositories to deployed AWS resources

You want to query "for this S3 bucket, which repository deploys it?" The AWS integration produces the bucket. The GitHub integration produces the repo. Your CI/CD metadata maps deployments to repos.

-   **Scope**: `repo-deployment-edges`
-   **Mode**: `CROSS_SCOPE`
-   **Why CROSS\_SCOPE**: The from and to entities come from different integrations. The mapping changes when teams move services between repos, so you re-run this sync job whenever your deployment manifests change.

### IAM roles to the applications that assume them

You want to track which applications (modeled in your custom CMDB scope) assume which AWS IAM roles (in the AWS scope). This drives blast-radius queries during incident response.

-   **Scope**: `app-iam-assumption`
-   **Mode**: `CROSS_SCOPE`

## Restrictions

-   **Entities are rejected.** CROSS\_SCOPE only accepts relationships. The from and to entities must already exist in the graph from another sync job or integration.
-   **The related entities must live outside the sync job's scope.** Neither `_fromEntityScope` nor `_toEntityScope` may equal the sync job's `scope`. The two entity scopes can equal each other (for example, two entities from the same AWS integration linked by an external mapping) — the constraint is only that neither may match the CROSS\_SCOPE job's own scope. If both entities belong to the sync job's scope, write that relationship from the sync job that owns the scope instead.
-   **`source` must be `api`.**

## Required relationship fields

In addition to the standard relationship fields, CROSS\_SCOPE relationships need:

| Property | Type | Description |
| --- | --- | --- |
| `_fromEntityScope` | `string` | Scope identifier of the source entity. For managed integrations, this is the `_integrationInstanceId`. |
| `_toEntityScope` | `string` | Scope identifier of the target entity. |

The from and to entities can be referenced by either `_fromEntityKey`/`_toEntityKey` or `_fromEntityId`/`_toEntityId` — whichever you have available.

## Example: CROSS\_SCOPE sync job

POST /persister/synchronization/jobs

```json
{
  "source": "api",
  "syncMode": "CROSS_SCOPE",
  "scope": "repo-deployment-edges"
}
```

POST /persister/synchronization/jobs/{jobId}/upload

```json
{
  "relationships": [
    {
      "_key": "github-repo:platform-api|deploys|s3-bucket:platform-assets",
      "_type": "repo_deploys_bucket",
      "_class": "DEPLOYS",
      "_fromEntityKey": "github-repo:platform-api",
      "_toEntityKey": "s3-bucket:platform-assets",
      "_fromEntityScope": "github-instance-id",
      "_toEntityScope": "aws-instance-id"
    }
  ]
}
```

```text
POST /persister/synchronization/jobs/{jobId}/finalize
```

## Operational notes

-   **The entities must exist at finalize time.** If either entity is missing or has been soft-deleted, the relationship is not created.
-   **CROSS\_SCOPE behaves like DIFF for its own scope.** Relationships you previously created in this scope and don't include in the new upload are deleted. Use a stable scope so your edge set reconciles cleanly.
-   **One CROSS\_SCOPE job per logical mapping.** Putting unrelated cross-scope edge sets in the same scope mixes their lifecycles.

## Common errors

| Error | Cause | Fix |
| --- | --- | --- |
| Entities cannot be uploaded in CROSS\_SCOPE mode | Tried to upload entities. | Create entities in their owning scope; use CROSS\_SCOPE only for edges. |
| Same-scope relationships rejected | `_fromEntityScope` equals `_toEntityScope`. | Use the owning scope's sync job for these edges. |
| Relationship missing after finalize | An entity referenced by the relationship did not exist (or was soft-deleted). | Confirm both entities are in the graph; check their `_id`/`_key` and scope. |

See the [API reference](/api/sync-jobs/api-reference.md) for the complete error table.

---

Source: /api/sync-jobs/diff

# DIFF sync mode

`DIFF` is the default sync mode. On finalize, the persister treats your upload as the complete state of the scope: anything that existed in the scope last time and is missing from this upload is deleted.

This is the right mode when you control the source of truth and want missing rows to mean "this no longer exists." It is the wrong mode when you only want to add or update part of the data — for that, see [`PATCH`](/api/sync-jobs/patch.md) for partial updates in your own scope, or [`OVERRIDE`](/api/sync-jobs/override.md) for persistent partial updates on managed-integration entities.

## When to use DIFF

-   You own the full dataset and re-upload it on a schedule.
-   You want stale entities to disappear automatically when they fall off the source.
-   Both entities and relationships are in scope.
-   You can include the entire dataset in a single sync job (chunked across multiple uploads, but one finalize).

## Example use cases

### Nightly vulnerability scanner output

Your team runs an internal vulnerability scanner every night and pushes the findings into JupiterOne so analysts can pivot from finding to affected asset in J1QL.

-   **Scope**: `internal-vuln-scanner`
-   **Mode**: `DIFF`
-   **Why DIFF**: When a finding is remediated and stops appearing in the report, you want it gone from the graph automatically — no janitorial PATCH-and-delete needed.

```json
POST /persister/synchronization/jobs
{
  "source": "api",
  "syncMode": "DIFF",
  "scope": "internal-vuln-scanner"
}
```

Each entity is a finding; relationships connect findings to the assets they affect.

### Mirroring an internal CMDB

You maintain a system of record outside JupiterOne — say, an internal asset CMDB — and want it reflected as graph entities so your queries can join CMDB context to integration-sourced data.

-   **Scope**: `cmdb-assets`
-   **Mode**: `DIFF`
-   **Why DIFF**: Decommissioned assets disappear from the CMDB, and you want them to disappear from the graph the same day.

### HRIS mirror for `Person` entities

You sync your HRIS so departures, role changes, and new hires flow into the graph as `Person` entities.

-   **Scope**: `hris-people`
-   **Mode**: `DIFF`
-   **Why DIFF**: When someone leaves, the next sync drops them from the upload and the graph reconciles cleanly.

## Required entity fields

Every entity in a `DIFF` upload needs:

-   `_key` — unique within the scope.
-   `_type` — your entity type, in `snake_case`.
-   `_class` — JupiterOne class (string or array of strings, max 5 items).

## Required relationship fields

Standard relationships:

-   `_key`, `_type`, `_class`, `_fromEntityKey`, `_toEntityKey`.

Mapped relationships (for connecting to entities you don't own in this scope) require `_mapping` instead of `_fromEntityKey`/`_toEntityKey`. See the [API reference](/api/sync-jobs/api-reference.md) for the mapped-relationship shape.

> **NOTE**
> 
> `DIFF` is the only sync mode that writes mapped relationships to the graph. `PATCH`, `CROSS_SCOPE`, and `OVERRIDE` ignore mapped relationships in the upload payload.

> **WARNING**
> 
> In `DIFF` mode, do **not** use `_fromEntityId` or `_toEntityId` to point at entities outside the scope. Those fields are rejected by `DIFF`. Use mapped relationships, or switch to [`CROSS_SCOPE`](/api/sync-jobs/cross-scope.md) if you only need cross-scope edges.

## Example: full DIFF sync job

POST /persister/synchronization/jobs

```json
{
  "source": "api",
  "syncMode": "DIFF",
  "scope": "internal-vuln-scanner"
}
```

Response:

```json
{
  "job": {
    "id": "f445397d-8491-4a12-806a-04792839abe3",
    "scope": "internal-vuln-scanner",
    "status": "AWAITING_UPLOADS",
    "numEntitiesUploaded": 0
  }
}
```

Upload entities and relationships in one call:

POST /persister/synchronization/jobs/{jobId}/upload

```json
{
  "entities": [
    {
      "_key": "finding:CVE-2025-1234:host-42",
      "_type": "vuln_finding",
      "_class": "Finding",
      "severity": "high",
      "cve": "CVE-2025-1234"
    },
    {
      "_key": "host:host-42",
      "_type": "internal_host",
      "_class": "Host",
      "displayName": "host-42"
    }
  ],
  "relationships": [
    {
      "_key": "finding:CVE-2025-1234:host-42|affects|host:host-42",
      "_type": "finding_affects_host",
      "_class": "AFFECTS",
      "_fromEntityKey": "finding:CVE-2025-1234:host-42",
      "_toEntityKey": "host:host-42"
    }
  ]
}
```

Finalize:

```text
POST /persister/synchronization/jobs/{jobId}/finalize
```

After finalize, anything previously in `internal-vuln-scanner` that wasn't in this upload is deleted.

## Operational notes

-   **Always include the full dataset.** A partial DIFF upload deletes everything you left out.
-   **Stable `_key`s matter.** If your `_key` strategy changes between runs, every entity will look new (created + deleted) and downstream queries will see churn.
-   **Chunk across uploads, finalize once.** A single sync job can accept many upload calls before finalize. Use this to handle large datasets without holding the whole payload in memory.
-   **For partial updates, use [`PATCH`](/api/sync-jobs/patch.md) instead.** PATCH is designed for cases where you don't have the full dataset.

## Common errors

| Error | Cause | Fix |
| --- | --- | --- |
| `/entities/0/_key is required` | Missing `_key` in DIFF upload. | Add `_key` (DIFF requires it). |
| `Relationships are not allowed in PATCH jobs` | You meant to use DIFF but started a PATCH job. | Start a DIFF job. |
| Unintended deletions after a small upload | Partial dataset uploaded to the same scope. | Always include the full dataset, or split into multiple scopes. |

See the [API reference](/api/sync-jobs/api-reference.md) for the complete error table.

---

Source: /api/sync-jobs/override

# OVERRIDE sync mode

`OVERRIDE` is the answer to a recurring frustration: a managed integration owns an entity, you set a custom property on that entity, and the next time the integration runs, your property gets wiped out.

`OVERRIDE` fixes that. When you push an `OVERRIDE` for a property on an entity, JupiterOne records the override and reapplies it after every subsequent integration sync. Your value sticks.

> **WARNING**
> 
> OVERRIDE is a powerful tool — it lets you pin custom values onto entities owned by a managed integration so those values survive every future integration sync. That's exactly what makes it useful, and it's also why it's worth using deliberately.
> 
> Once you set a property with OVERRIDE, the source integration won't reconcile or correct it for you, so you become the source of truth for that value. That matters most when overrides touch properties that drive security decisions — things like `riskLevel`, `complianceTier`, or `publicAccessApproved` — because what you set is what alert rules, queries, and the people responding to them will see. A stale or incorrect override can quietly hide the integration's real view and lead to missed alerts or a misleading picture of risk.
> 
> This is why we gate access to OVERRIDE. Contact JupiterOne support to request access for your account.

## When to use OVERRIDE

-   The entity is managed by an integration (you can see `_integrationInstanceId` on it).
-   You want a custom property to persist across that integration's future runs.
-   You only need to set entity properties — relationships are not allowed.
-   You are working with up to 10,000 entities per sync job. Larger updates need to be split.

If the entity isn't owned by an integration, or you don't need persistence across integration runs, [`PATCH`](/api/sync-jobs/patch.md) is simpler.

## Example use cases

### Criticality tiers on managed repositories

Your platform team labels every GitHub repo with a `criticality` tier (`tier-1`, `tier-2`, `tier-3`) used by your incident response runbook. The labels live in an internal spreadsheet, not GitHub topics.

-   **Scope**: `repo-criticality`
-   **Mode**: `OVERRIDE`
-   **Why OVERRIDE**: GitHub doesn't store this attribute, so the GitHub integration never produces it — but it also re-syncs the entity completely each run, which would clear a property set with PATCH. OVERRIDE makes the criticality stick.

### Compliance scope on managed devices

Your compliance team determines which laptops are in scope for SOC 2 evidence collection. The Jamf integration provides device entities; your team pushes `complianceScope: "soc2"` onto the relevant subset.

-   **Scope**: `device-compliance-scope`
-   **Mode**: `OVERRIDE`

## Restrictions

-   **Entity-only.** Relationships are rejected with `Relationship uploads are not allowed for OVERRIDE sync jobs`.
-   **`_id` is required on every entity.** The entity must already exist; entries whose `_id` does not match a current entity are silently skipped on finalize.
-   **10,000 entities maximum per sync job.** Larger updates need to be split into separate sync jobs (different scopes).
-   **`source` must be `api`.**
-   **New sync mode.** OVERRIDE is in early release. Contact JupiterOne support to enable it for your account.

## Required entity fields

| Property | Type | Description |
| --- | --- | --- |
| `_id` | `string` | **Required.** The JupiterOne `_id` of the existing entity to override. Entries with no matching entity are silently skipped. |

Any custom property keys (those without a leading `_`) included alongside `_id` are applied as overrides. Properties starting with `_` are reserved for system metadata and ignored.

## Updating and removing overrides

Overrides are tracked per `(entity, scope)` pair. To change what's overridden:

-   **Update values for an entity**: re-upload the entity with the new property values to the same scope. Properties not included in the new upload are removed from that scope's overrides on that entity.
-   **Stop overriding a specific entity**: re-upload the scope without that entity included. Its overrides for that scope are dropped on the next finalize.
-   **Clear all overrides for a scope**: start a new `OVERRIDE` sync job with the same scope, finalize without uploading any entities. Every override registered in that scope is removed.
-   **Restore the integration's value immediately**: after clearing the override, re-run the source integration. The next integration sync writes its own value.

## Precedence when multiple scopes override the same property

Two `OVERRIDE` sync jobs in different scopes can target the same entity. The rule is **the override that most recently changed the value wins, per property**:

-   If scope `A` (created Monday) overrides `criticality` on entity `X`, and scope `B` (created Tuesday) also overrides `criticality` on entity `X`, the value from scope `B` takes effect — it is the more recent override. Scope `A`'s value is recorded but does not apply for that property while `B`'s override exists.
-   This is evaluated **per property**, not per scope. If scope `B` overrides a _different_ property on the same entity (say, `owner`), each property is resolved independently — `B` wins `criticality`, and whichever scope most recently changed `owner` wins that one.
-   If the winning scope's override is removed, the property falls back to the **next most recent** remaining override for that property, and only when no scope overrides it at all does it return to the integration's value.

This behavior is deliberate: the override that most recently changed a property takes effect immediately rather than being silently blocked by an older scope. To take over a property, change its value in another scope; to hand it back, remove the override that currently wins.

> **NOTE**
> 
> Prior to this change, precedence was **oldest scope wins** — the first scope to override a property held it until removed, and later overrides were silently ignored. That could leave a stale scope pinning a value no live override could update. Precedence is now recency-based. If you relied on the old rule, review scopes that override the same property on the same entity.

### Example: newest override wins

Repository `X` is managed by the GitHub integration. Two teams each run an `OVERRIDE` scope that sets `criticality` on it.

| Step | Action | `criticality` on `X` | Why |
| --- | --- | --- | --- |
| 1 | GitHub integration syncs `X`; no override yet | _(integration value)_ | Nothing overrides `criticality`. |
| 2 | Scope `repo-criticality` overrides `criticality = tier-3` | `tier-3` | Only override present. |
| 3 | Scope `ir-priority` overrides `criticality = tier-1` | **`tier-1`** | `ir-priority` changed the value more recently, so it wins. |
| 4 | GitHub integration syncs `X` again | `tier-1` | Overrides are re-applied after every sync; the newest still wins. |
| 5 | `ir-priority` removes its override (re-finalize without `X`) | `tier-3` | Falls back to the next most recent remaining override — `repo-criticality`. |
| 6 | `repo-criticality` removes its override too | _(integration value)_ | No scope overrides `criticality`; it returns to what GitHub provides. |

The key point is step 3: the newer scope takes the property immediately — under the old oldest-wins rule, `repo-criticality` (step 2) would have kept `tier-3` and `ir-priority` would have been ignored. Steps 5–6 show the reverse on removal: the property falls back through remaining overrides by recency, and only returns to the integration value when nothing overrides it.

## OVERRIDE vs the entity mutation API

The GraphQL [`updateEntity`](/api/entity-mutations.md#updating-entity) mutation also sets properties that persist across managed-integration syncs. The two tools are complementary, not interchangeable:

-   **`OVERRIDE`** is a sync job. You group up to 10,000 entities under a `scope`, push them in one batch, and finalize. The scope is the unit of management — you update or remove the whole set together.
-   **`updateEntity`** is a single-entity mutation over GraphQL. It's the right tool for "I just need to set `criticality = tier-1` on this one repository" or scripts that walk a small list of entities. There's no scope and no finalize step.

If both an `OVERRIDE` sync job and an `updateEntity` call have set the same property on the same entity, the one that **most recently changed the value** takes precedence — they are resolved by recency, the same way two OVERRIDE scopes are. Removing the winner restores the other channel's value, and removing both restores the integration's value.

> **NOTE**
> 
> This changed alongside the precedence rule above. Previously the `OVERRIDE`\-supplied value always took precedence over `updateEntity`. Overrides applied by a **tagging rule** are a separate case and still outrank both `OVERRIDE` sync jobs and `updateEntity` regardless of recency.

In practice, pick one channel per property to avoid surprises. Use `OVERRIDE` when you have a list and want it managed as a unit; use `updateEntity` when you don't.

## Edge case: PATCH followed by OVERRIDE

If a `PATCH` sync job previously set the same property on an entity, and you later create an `OVERRIDE` for that property and then remove the override, the value visible immediately after removal may be the old PATCH value rather than the integration's value. The next managed-integration run reconciles this and restores the integration's value.

In practice, this rarely matters — but if you're switching a property from PATCH to OVERRIDE management, expect a brief window after override removal where the property shows the PATCH value.

## Example: full OVERRIDE sync job

POST /persister/synchronization/jobs

```json
{
  "source": "api",
  "syncMode": "OVERRIDE",
  "scope": "repo-criticality"
}
```

POST /persister/synchronization/jobs/{jobId}/upload

```json
{
  "entities": [
    {
      "_id": "b75aad77-89eb-5ce6-939c-86322517af6b",
      "criticality": "tier-1"
    },
    {
      "_id": "da1c53ef-a543-5daa-8206-37e652c795cf",
      "criticality": "tier-2"
    }
  ]
}
```

```text
POST /persister/synchronization/jobs/{jobId}/finalize
```

After finalize, the two repositories carry the `criticality` property, and they will continue to do so after every GitHub integration sync.

## Operational notes

-   **Find a target entity's `_id` with J1QL.** For example: `FIND github_repo WITH name='platform-api' RETURN _id`.
-   **Reuse stable scopes.** Treat each scope as a long-lived label for one logical override set (`repo-criticality`, not `override-2026-04-28`). Reusing the scope is how you update or remove overrides cleanly.
-   **OVERRIDE does not create entities.** If `_id` doesn't match an existing entity, that row is silently skipped — no error, no creation.
-   **Custom property names cannot start with `_`.** Those are reserved for system metadata.

## Common errors

| Error | Cause | Fix |
| --- | --- | --- |
| `OVERRIDE sync mode is not enabled for this account` | Account is not on the allowlist. | Contact JupiterOne support to request access. |
| `Relationship uploads are not allowed for OVERRIDE sync jobs` | Uploaded relationships to an OVERRIDE job. | OVERRIDE only accepts entities. |
| `OVERRIDE sync jobs are limited to 10000 entities per job` | Upload exceeds the per-job entity cap. | Split across multiple sync jobs. |
| Entity property not visible after finalize | `_id` did not match any existing entity. | Confirm the `_id` exists; OVERRIDE silently skips unknown `_id`s. |

See the [API reference](/api/sync-jobs/api-reference.md) for the complete error table.

---

Source: /api/sync-jobs/overview

# Overview

Sync jobs are how data enters JupiterOne from the API. Whether you are pushing a nightly inventory from an internal CMDB, layering risk scores onto entities owned by a managed integration, connecting assets that live in different integrations, or pinning a custom value so it survives the next integration run — each of those flows is a sync job.

A sync job groups a batch of changes under a `scope`, runs a comparison against the existing data in that scope when finalized, and applies the result to the graph. The behavior of that comparison depends on the sync mode you pick.

## The four sync modes

| Mode | What finalize does | Entities | Relationships | Typical use |
| --- | --- | --- | --- | --- |
| [`DIFF`](/api/sync-jobs/diff.md) | Replaces the full dataset in scope. Anything not in the upload is deleted. | yes | yes | Full inventory refresh from a custom source. |
| [`PATCH`](/api/sync-jobs/patch.md) | Updates properties on existing entities. Nothing is created or deleted. | yes (existing only) | no | Enriching existing entities with extra properties. |
| [`CROSS_SCOPE`](/api/sync-jobs/cross-scope.md) | Adds/updates relationships whose from and to entities live in different scopes. | no | yes | Linking assets across integrations. |
| [`OVERRIDE`](/api/sync-jobs/override.md) | Pins property values on managed-integration entities so they persist across future integration syncs. | yes (existing only) | no | Preserving customer-applied values that an integration would otherwise overwrite. |

## Choose a mode

Use the questions below in order. The first "yes" picks your mode.

1.  **Are you setting custom values on entities that a managed integration owns, and you need those values to survive the next integration run?**
    -   For a batch of entities under a stable scope → [`OVERRIDE`](/api/sync-jobs/override.md)
    -   For one entity (or a handful of entities, scripted one at a time) → use the [`updateEntity`](/api/entity-mutations.md#updating-entity) GraphQL mutation instead — it's a per-entity persistent edit, no sync job needed.
2.  **Are you only creating relationships between entities that live in different scopes (different integrations or different sources)?** → [`CROSS_SCOPE`](/api/sync-jobs/cross-scope.md)
3.  **Do you want to add or update properties on existing entities without ever deleting anything, and you accept that the next managed-integration sync will reset the values?** → [`PATCH`](/api/sync-jobs/patch.md)
4.  **Are you the source of truth for this set of data and want the upload to fully replace what was there last time?** → [`DIFF`](/api/sync-jobs/diff.md)

> **TIP**
> 
> Sync jobs are batch-oriented: one scope, one finalize, many entities. The GraphQL [`updateEntity`](/api/entity-mutations.md#updating-entity) mutation is per-entity and gives you the same persistence guarantee as `OVERRIDE` for individual edits. Reach for it when you don't need a scope to manage a set together.

## Lifecycle of a sync job

Every sync job, regardless of mode, follows the same shape:

1.  **Start** — `POST /persister/synchronization/jobs` creates the job and returns an ID. The job begins in `AWAITING_UPLOADS`.
2.  **Upload** — One or more upload calls push entities and/or relationships into the job. The persister tracks counters as data arrives but does not yet apply changes to the graph.
3.  **Finalize** — `POST /persister/synchronization/jobs/{id}/finalize` triggers the comparison. The persister reads the new state, compares it against existing data in the scope, and applies creates, updates, and (depending on the mode) deletes.
4.  **Poll** — `GET /persister/synchronization/jobs/{id}` returns status. In AWS environments, finalize is asynchronous: status moves through `FINALIZE_PENDING` to `FINISHED`.

See the [API reference](/api/sync-jobs/api-reference.md) for endpoints and payloads.

## Scopes

A `scope` is a string label that groups everything in a sync job together for the purposes of comparison. Two sync jobs with the same `scope` and the same mode operate on the same logical dataset — the second finalize sees the first job's results as "the previous state."

A few rules of thumb:

-   Use a stable, descriptive `scope` for each pipeline you own (`vuln-scanner-nightly`, not `upload-2026-04-28`). If your scope name changes between runs, the previous data won't be reconciled and may linger.
-   Choose a `scope` granularity that matches how you want deletions to behave. A single scope across all of your custom data means dropping a row from your source removes it from the graph everywhere.
-   For [`CROSS_SCOPE`](/api/sync-jobs/cross-scope.md) and [`OVERRIDE`](/api/sync-jobs/override.md), `scope` works the same way but the mode-specific pages cover the wrinkles.

## Use case map

A handful of common patterns, with the mode each one calls for:

| Scenario | Mode |
| --- | --- |
| Push the output of an internal vulnerability scanner so stale findings disappear when they no longer appear in the report. | [`DIFF`](/api/sync-jobs/diff.md) |
| Mirror an HRIS into the graph as `Person` entities, deleting people who left the company. | [`DIFF`](/api/sync-jobs/diff.md) |
| Refresh a `lastErrorCount` on managed-integration entities every five minutes between hourly integration syncs (accepting that each integration sync resets the value). | [`PATCH`](/api/sync-jobs/patch.md) |
| Update a `lastGoogleLoginAt` property hourly on `Person` entities you already pushed via a custom HRIS DIFF. | [`PATCH`](/api/sync-jobs/patch.md) |
| Connect Okta `User` entities to the laptops they own in Jamf so you can query "show me every laptop assigned to a member of the SRE group." | [`CROSS_SCOPE`](/api/sync-jobs/cross-scope.md) |
| Link GitHub repositories to the AWS resources they deploy, where the integrations don't already produce that relationship. | [`CROSS_SCOPE`](/api/sync-jobs/cross-scope.md) |
| Tag a managed Jamf device with `complianceScope: "soc2"` so the value survives every Jamf integration run. | [`OVERRIDE`](/api/sync-jobs/override.md) |
| Set a `criticality` value on a managed GitHub repository entity so it stays put even after the GitHub integration re-syncs. | [`OVERRIDE`](/api/sync-jobs/override.md) for a batch; [`updateEntity`](/api/entity-mutations.md#updating-entity) for a single repository. |
| Pin a one-off custom property on a single managed entity (e.g. `betaForceDeviceUnificationKey` on two specific hosts) so the value survives every managed integration sync. | [`updateEntity`](/api/entity-mutations.md#updating-entity) |

## Validation, limits, and errors

Validation rules and error messages are consistent across modes. The [API reference](/api/sync-jobs/api-reference.md) lists every error you can hit and how to resolve it. Mode-specific limits (for example, the 10,000-entity cap on `OVERRIDE`) are called out on the mode pages.

## Authentication

Every sync job request needs:

-   An API key in the `Authorization: Bearer <token>` header.
-   The target account in the `jupiterone-account` header.

See [Authentication](/api/authentication.md) for full setup.

## Next steps

-   Pick a mode using the table or decision questions above.
-   Read the mode page for full request shape, scenarios, and constraints.
-   Skim the [API reference](/api/sync-jobs/api-reference.md) for the endpoint list.

---

Source: /api/sync-jobs/patch

# PATCH sync mode

`PATCH` updates existing entities. It never creates new entities, and unlike [`DIFF`](/api/sync-jobs/diff.md), it never deletes — anything not included in your upload is left alone.

This is the mode for layering data onto entities that already exist in the graph, whether they came from a managed integration or a different sync job. A PATCH upload is additive: properties you include are written, properties you don't include are untouched.

## When to use PATCH

-   You are enriching existing entities, not replacing a dataset.
-   Every entity in your upload already exists in the graph. PATCH cannot create entities — a patch targeting an entity that doesn't exist is skipped.
-   You don't have (or don't want to compute) the full set of entities — only the ones you have new data for.
-   You only need to change entity properties; PATCH does not accept relationships.
-   The properties you're setting do **not** need to survive a managed-integration re-sync. If they do, use [`OVERRIDE`](/api/sync-jobs/override.md) instead.

## Example use cases

PATCH is the right mode in two situations: you're refreshing data on managed-integration entities **faster than that integration's own DIFF cycle** (and you accept that each integration run will reset to the integration's truth), or you're updating entities in a **custom dataset** that no managed integration owns. If you need values to _survive_ a managed integration's next sync, use [`OVERRIDE`](/api/sync-jobs/override.md) instead.

### Higher-frequency updates between managed-integration runs

Your AWS integration runs once an hour. Between runs, an internal process polls CloudWatch every five minutes and refreshes a `lastErrorCount` property on `aws_lambda_function` entities so dashboards stay closer to real-time.

-   **Scope**: `lambda-error-counts`
-   **Mode**: `PATCH`
-   **Why PATCH**: You only need the value to live between integration runs. Each AWS sync re-asserts AWS's own state for these entities, and the next CloudWatch push refreshes `lastErrorCount` again. OVERRIDE would be wrong here because you do _not_ want the value to persist across integration syncs.

```json
POST /persister/synchronization/jobs
{
  "source": "api",
  "syncMode": "PATCH",
  "scope": "lambda-error-counts"
}
```

```json
{
  "entities": [
    { "_id": "lambda-fn-123", "lastErrorCount": 4, "lastSampledAt": "2026-04-28T14:05:00Z" },
    { "_id": "lambda-fn-456", "lastErrorCount": 0, "lastSampledAt": "2026-04-28T14:05:00Z" }
  ]
}
```

### Updating a custom dataset you already pushed

You maintain a `Person` dataset in JupiterOne by pushing a [`DIFF`](/api/sync-jobs/diff.md) from your HRIS each night. During the day, a separate process updates a `lastGoogleLoginAt` property on those Persons hourly from the Google Workspace audit log.

-   **Scope**: `google-login-activity`
-   **Mode**: `PATCH`
-   **Why PATCH**: No managed integration owns these entities; the only writers are your two custom syncs. PATCH lets the hourly update touch only `lastGoogleLoginAt` without disturbing anything the nightly DIFF set, and there's no integration DIFF to worry about resetting your values.

## Required entity fields

PATCH lets you target by either `_id` or `_key`:

-   **When `scope` is defined**: either `_key` or `_id` is required.
-   **When `scope` is not defined**: `_id` is required.

`_id` is unambiguous globally; `_key` requires the scope context to resolve.

You do **not** need to include `_type` or `_class` on a PATCH upload — those are creation-time fields, and PATCH never creates entities.

## Relationships are not allowed

PATCH rejects relationships:

```text
Relationships are not allowed in PATCH jobs
```

If you need to add relationships, use [`DIFF`](/api/sync-jobs/diff.md) (when you own both entities and the scope) or [`CROSS_SCOPE`](/api/sync-jobs/cross-scope.md) (when the from and to entities live in different scopes).

## PATCH vs OVERRIDE vs the entity mutation API

`PATCH`, [`OVERRIDE`](/api/sync-jobs/override.md), and the GraphQL [`updateEntity`](/api/entity-mutations.md#updating-entity) mutation can all write properties onto an existing entity, but they answer different questions about _persistence_:

| Tool | Property survives the next managed-integration sync? | Best for |
| --- | --- | --- |
| `PATCH` sync mode | **No.** PATCH writes the value onto the entity but does not register a persistent override. The next integration sync replaces the entity wholesale, and any PATCH-set property the integration doesn't itself assert is lost. | High-frequency refreshes of entities you own, or short-lived enrichments on managed entities that you actively re-PATCH. |
| `OVERRIDE` sync mode | **Yes.** OVERRIDE records the property as a persistent override; it is reapplied after every integration sync. | Bulk overrides across many managed entities (up to 10,000 per sync job) under a stable scope. |
| `updateEntity` GraphQL mutation | **Yes.** Properties set via `updateEntity` are recorded as persistent overrides on the target entity and survive every future integration sync. | One-off edits to a single entity, or scripts that touch a small number of entities and don't need to be grouped under a scope. |

Pick `PATCH` only when "wiped by the next integration run" is acceptable — usually because you're going to re-PATCH on a tight cadence, or because no managed integration owns the entity. If you need the value to last, use OVERRIDE for batches and `updateEntity` for one-offs.

## Example: PATCH sync job

POST /persister/synchronization/jobs

```json
{
  "source": "api",
  "syncMode": "PATCH",
  "scope": "google-login-activity"
}
```

POST /persister/synchronization/jobs/{jobId}/upload

```json
{
  "entities": [
    { "_id": "person-123", "lastGoogleLoginAt": "2026-04-28T14:00:00Z" },
    { "_id": "person-456", "lastGoogleLoginAt": "2026-04-28T13:42:00Z" }
  ]
}
```

```text
POST /persister/synchronization/jobs/{jobId}/finalize
```

After finalize, the two persons have updated `lastGoogleLoginAt`. No other persons were affected. No entities or relationships were created or deleted.

## Operational notes

-   **PATCH never creates entities.** If a targeted entity doesn't exist in the graph, that patch is silently skipped — no error is raised and no entity is created. Create the entity first (via a managed integration or a [`DIFF`](/api/sync-jobs/diff.md) job), then PATCH it.
-   **PATCH is non-destructive.** Re-running PATCH with no entities is a no-op.
-   **Setting a property to `null` clears it** for the targeted entity.
-   **Stale values aren't cleaned up.** If you stop sending a property for an entity, the previous value stays on the entity. To remove it, send the entity with that property set to `null`.
-   **PATCH does not protect properties from managed integrations.** A PATCH-set value lives on the entity until the source integration's next sync, at which point the entity is rewritten and any PATCH-set property the integration itself doesn't assert is lost. For values that need to survive every integration run, use [`OVERRIDE`](/api/sync-jobs/override.md) (sync-job batches) or the [`updateEntity`](/api/entity-mutations.md#updating-entity) GraphQL mutation (one-offs).

## Common errors

| Error | Cause | Fix |
| --- | --- | --- |
| `Relationships are not allowed in PATCH jobs` | Uploaded relationships to a PATCH job. | Use DIFF or CROSS\_SCOPE for relationships. |
| Required either `_id` or `_key` | Neither identifier present. | Include `_id` (preferred) or `_key`. |
| Property not visible after finalize | Property starts with `_`. | Custom property names cannot begin with `_`. |
| Entity unchanged after finalize, no error | The targeted entity doesn't exist — PATCH does not create entities; non-matching patches are silently skipped. | Create the entity first with [`DIFF`](/api/sync-jobs/diff.md) (or let the owning integration create it), then PATCH. |

See the [API reference](/api/sync-jobs/api-reference.md) for the complete error table.

---

Source: /api/validate-optimize-queries

# Validate Queries

The validate and optimize j1ql endpoints are used to validate j1ql queries.

## Validate queries

The validate endpoint takes in an array of queries sent as a json object in the request body. It returns an array of objects containing the query and a boolean flag indicating whether the query is valid or not.

### Sample request

```text
POST /j1ql/validate
```

```json
{
    "queries": [
        "Find Person as p that relates to User"
    ]
}
```

### Sample response

```json
[
    {
        "query": "Find Person as p that relates to User",
        "valid": true
    }
]
```

---

Source: /data-model/entity-ingestion-labels

# Entity ingestion labels

JupiterOne's standardized entity labels indicate how an entity is ingested into the graph. The Metadata tab in J1 Assets provides this information, and it can be used to filter queries with the `_source` property in a `WITH` clause.

## Ingestion labels

The labels for ingestion sources are:

-   `system-internal` for metadata about the JupiterOne instance.
-   `integration-managed` for entities ingested by integrations.
-   `system-mapper` for assets not ingested by an integration but exist another way, like inferred entity relationships or timing.
-   `api` for entities created through JupiterOne's APIs.
-   `sample-data` for entities created through the sample data feature.

### Example query

For example, you could find AWS instances that were ingested by integrations and use a data store by running the following query:

Which of my aws instances were ingested by an integration using a data store?

```sql
FIND aws_instance
WITH _source = 'integration-managed'
THAT USES DataStore
RETURN TREE
```

### `system-mapper` behavior

In JupiterOne, a `system-mapper` entity is created when it's inferred that a certain entity should exist based on correlation data with other entities, but it hasn't been ingested yet by an integration. For example, a `HostAgent` entity may require a corresponding `Host` entity to exist in the graph, which the `system-mapper` can create if it's missing.

Another use case for a `system-mapper` entity is when an asset likely exists based on relationship data, but other integration sources haven't yet had a chance to add it to the JupiterOne graph. In such cases, JupiterOne uses an entity with a `_source` value of `system-mapper` to represent the asset.

---

Source: /data-model/entity-property-normalization

# Normalization

JupiterOne normalizes some entity properties on specific classes to make querying easier and to make query results more consistent. In the event that we normalize properties into a property provided in a raw upload, or from an integration, the original raw value is persisted in `raw_<property>` to prevent any data loss.

Reading diffs:

```diff
{
  "property": "this is unchanged",
+ "newProperty": "this is added",
- "removedProperty": "this is removed"

- "changedProperty": "This gets Changed"
+ "changedProperty": "this has been changed"
}
```

## Devices and HostAgents

### Collect and normalize serial numbers

A property called `serials` is added containing normalized values of all matching properties. **Source properties are not modified**. This is primarily feature for improved reliability of our device consolidation features.

| \_class | matching property name (one of) | target property | matching property value (one of) |
| --- | --- | --- | --- |
| Device, HostAgent | `serial` OR `serialNumber` | `serials` | `/^((([^0-9a-f]*[0-9a-f]){7}[0-9a-z\W]*)$|(([^0-9a-z]*[0-9a-z]){12}[0-9a-z\W]*))$/i` |

#### Example Normalizations

```diff
// Example 1:
{
 "serial": "AB-CD-EF-12-34-56"
+ "serials": ["ab-cd-ef-12-34-56"] 
}

// Example 2:
{
  "serialNumber": ["123456789"]
+ "serials": ["123456789"]
}

// Example 3:
{
  "serial": "32CCBFD3-2436-41AA-8492-016D20241767",
  "serialNumber": ["A12345", "ABCD12345" ],
+ "serials": [
+   "32ccbfd3-2436-41aa-8492-016d20241767",
+   "a12345",
+   "abcd12345"
+ ]
}
```

### Collect associated IP(v4) addresses

A property called `associatedIpAddresses` is added containing normalized values of all matching properties. **Source properties are not modified**. This allows easier searching for entities that may be associated with an IP Address in an unknown way, regardless of the semantic meaning of the original IP Address properties.

| \_class | matching property name (one of) | target property | matching property value (one of) |
| --- | --- | --- | --- |
| Device, HostAgent | `ipAddresses` OR `ipAddress` OR `publicIpAddress` OR `privateIpAddress` OR `lastIpAddress` OR `network.ipAddress` OR `lastExternalIpAddress` OR `IP_Address` | `associatedIpAddresses` | `/^(((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))$/` |

#### Example normalizations

```diff
// Example 1:
{
  "ipAddress": "024.249.245.253",
+ "associatedIpAddresses": [ "024.249.245.253" ]
}
// Example 2:
{
  "ipAddress": "024.249.245.253",
  "publicIpAddress": "1.9.243.250",
  "privateIpAddress": "250.236.221.208",
+ "associatedIpAddresses": [ 
+   "024.249.245.253",
+   "1.9.243.250",
+   "250.236.221.208"
+ ]
}
```

### Collect associated email addresses

> [https://html.spec.whatwg.org/multipage/input.html#valid-e-mail-address](https://html.spec.whatwg.org/multipage/input.html#valid-e-mail-address)

A property called `associatedEmailAddresses` is added containing normalized values of all matching properties. **Source properties are not modified**. This allows easier searching on any entities that may be associated with an email address in any unknown way, regardless of relationships or the semantic meaning of the original email address properties.

| \_class | matching property name (one of) | target property | matching property value (one of) |
| --- | --- | --- | --- |
| Device | `email` OR `primaryEmail` OR `recoveryEmail` OR `contactEmails` OR `userEmail` OR `userEmails` OR `serviceAccountEmails` OR `serviceAccountEmail` OR `publisherEmail` OR `maintainerEmails` OR `homeEmail` OR `verifiedEmail` OR `verifiedEmails` OR `userEmails` OR `emailAddress` OR `workEmail` OR `Email` OR `general.assignedUserEmail` OR `techLeadEmail` OR `managerEmail` OR `cooEmail` OR `ceoEmail` OR `ctoEmail` OR `techContractEmail` OR `registrantContactEmail` OR `adminContactEmail` OR `abuseContactEmail` | `associatedEmailAddresses` | `/^([a-zA-Z0-9.!#$%&'*+/=?^_{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)\*$)/i` |

#### Example normalizations

```diff
// Example 1:
{
  "email": "support@jupiterone.io",
  "primaryEmail": "Support@JupiterOne.io",
  "recoveryEmail: "security@jupiterone.io",
+ "associatedEmails": [
+   "support@jupiterone.io",
+   "security@jupiterone.io
+ ]
}
```

### Normalize make

Source property `make` may be modified. If so, the original value will be maintained in `raw_make`.

| \_class | matching property name (one of) | target property | matching property value (one of) |
| --- | --- | --- | --- |
| Device, HostAgent | `make` OR `Manufacturer` OR `hardwareManufacturer` OR `hardwareVendor` | `make` | `/^(.+)$/` |

```diff
// Example 1:
{
  "make": "Intel" // no change
}

// Example 2:
{
  "Manufacturer": "intel",
+ "make": "Intel"
}
```

#### Further refine make based on MAC address

Source property `make` may be modified. If so, the original value will be maintained in `raw_make`.

Using IEEE OUI lookups based on the [registration authority](https://standards.ieee.org/products-programs/regauth/), we can determine device make from its MAC Address in over thirty thousand MAC address blocks. Below are a few examples:

| \_class | matching property name (one of) | target property |
| --- | --- | --- |
| Device, HostAgent | `macAddress` | `make` |

#### Example normalizations

```diff
// Example 1:
{
  "macAddress": "6C:29:95:6E:69:F6", 
+ "make": "Intel" // normalized from the macAddress based on IEEE OUI lookup
}

// Example 2 (make already defined):
{
  "macAddress": "6C:29:95:6E:69:F6",
- "make": "Dell",
+ "make": "Intel", // normalized from the macAddress based on IEEE OUI lookup
+ "raw_make": "Dell" // preserved original raw value
}
```

Other Example IEEE OUI lookups:

### Normalize OS versions

Source property `osVersion` may be modified. If so, the original value will be maintained in `raw_osVersion`.

| \_class | matching property name (one of) | target property | matching property value (one of) |
| --- | --- | --- | --- |
| Device, HostAgent | `osVersion` OR `os_version` OR `operatingSystemVersion` OR `os` OR `OS` OR `Operating System` OR `operatingSystem` OR `operatingsystem` | `osVersion` | `/^(?:.*?)(?:\b|\()(\d+(\.\d+)*)(?:\b|\))(?:.*)$/i` |

#### Example normalizations

```diff
// Example 1:
{
 "operatingSystemVersion": "16.5.0",
+ "osVersion": "16.5"
}

// Example 2:
{
- "osVersion": "Mac OS X 12.3.4"
+ "osVersion": "12.3.4", // normalized value
+ "raw_osVersion: "Mac OS X 12.3.4" // preserved original raw value
}
```

Other normalized values examples:

### Normalize OS types

Source property `osType` may be modified. If so, the original value will be maintained in `raw_osType`.

| \_class | matching property name (one of) | target into | matching property value (one of) |
| --- | --- | --- | --- |
| Device, HostAgent | `operatingSystem` OR `operatingsystem` OR `os` OR `OS` OR `osFamily` OR `os_family` OR `osName` OR `osname` OR `os_name` OR `Operating System` OR `os_version` OR `@osVersion` OR `osVersion` | `osType` | `/(^.*(ios [\d]|iphone).*$)/i` OR `/(^.*ipad.*$)/i` OR `/(^(Cupcake|Donut|Eclair|Froyo|Gingerbread|Honeycomb|Ice Cream Sandwich|Jelly Bean|KitKat|Lollipop|Marshmallow|Nougat|Oreo|Pie|Android).*$)/` OR `/(^.*ipad.*$)/i` OR `/(^.*(OS\s?x|macos).*$)/i` OR `/((^.*(windows|microsoft).*$)|(^.*\s+(win|ms)(\s|\d|-)+.*$)|(^(win|ms)(\s|\d|-)+.*$))/i` OR `/^(Linux|Debian|Ubuntu|Fedora|Red Hat|CentOS|Arch(\s?Linux)?|openSUSE|Gentoo|Slackware|Mint|Kali(\s?Linux)?|Zorin(\s?OS)?|Manjaro|Mageia).*$/i` |

#### Example normalizations

```diff
// Example 1:
{
  "Operating System": "Apple iOS 16.6.1"
+ "osType": "iOS"
}

// Example 2:
{
  "osName": "Debian GNU/Linux 10 (buster)"
+ "osType": "*nix (Debian)"
}

// Example 3:
{
- "osType": "Apple MAC OS X",
+ "osType": "MacOS",
+ "raw_osType": "Apple MAC OS X" // preserved original raw value
}
```

Other example value normalizations:

### Normalize and collect MAC addresses

Source property `macAddress` may be modified. If so, the original value will be maintained in `raw_macAddress`. _All_ matching fields will be merged into an array in the normalized `macAddress` field:

| \_class | matching property name (one of) | normalizes into | matching property value (one of) |
| --- | --- | --- | --- |
| Device, HostAgent, Host, Gateway, Finding, Record, NetworkInterface, Printer | `macAddress` OR `macAddresses` OR `MacAddress` OR `MACADDRESS` OR `MACAddress` OR `MAC_Address` OR `mac_address` OR `mac-address` OR `altMacAddress` OR `wifiMacAddress` OR `wifiMacAddresses` OR `wirelessDeviceMac` OR `recentDeviceMac` OR `wifiMac` OR `mac` OR `network.macAddress` OR `bluetoothMac` | `macAddress` | `/^([0-9a-f]{1,2})([.:-])?([0-9a-f]{1,2})([.:-])?([0-9a-f]{1,2})([.:-])?([0-9a-f]{1,2})([.:-])?([0-9a-f]{1,2})([.:-])?([0-9a-f]{1,2})$/i` |

#### Example normalizations

```diff
{
- "macAddress": "aabbccddeeff",
  "altMacAddress": "11.22.33.44.aa.bb",
+ "macAddress": [  // normalized AND collected into array
+   "AA:BB:CC:DD:EE:FF",
+   "11:22:33:44:AA:BB"
+ ],
+ "raw_macAddress": "aabbccddeeff" // preserved original raw value
}
```

### Normalize encryption status

Source property `encryptionStatus` may be modified. If so, the original raw value will be maintained in `raw_encryptionStatus`

| \_class | matching property name (one of) | target property | matching property value (one of) |
| --- | --- | --- | --- |
| Device, HostAgent | `encrypted` OR `encryptionStatus` OR `isEncryptionEnabled` OR `encryptionState` | `encryptionStatus` | `[true] OR` \[false\] OR `/^(encrypted|true|yes)/i` OR `/^(not encrypted|false|no|not_encrypted|notencrypted|unencrypted)$/i` OR `/^(unknown)?/i` |

#### Example normalizations

```diff
// Example 1:
{
  "encryped": true,
+ "encryptionStatus": "encrypted"
}

// Example 2:
{
  "isEncryptionEnabled": "FALSE",
+ "encryptionStatus": "unencrypted"
}

// Example 3:
{
- "encryptionStatus": "yes",
+ "encryptionStatus": "encrypted",
+ "raw_encryptionStatus: "yes" // preserved original raw value
}
```

## Findings

### Normalize severity

| \_class | \_type (one of) | matching property name (one of) | matching property value (one of) |
| --- | --- | --- | --- |
| Finding | `aws_accessanalyzer_finding` OR `aws_guardduty_finding` OR `aws_inspector_finding` OR `aws_inspectorv2_finding` OR `aws_macie_finding` OR `azure_advisor_recommendation` OR `bugcrowd_submission` OR `cbdefense_alert` OR `checkmarx_finding` OR `cobalt_finding` OR `crowdstrike_vulnerability` OR `cycognito_issue` OR `detectify_finding` OR `github_code_scanning_finding` OR `github_finding` OR `github_repo_finding` OR `gitlab_finding` OR `gitleaks_finding` OR `hacker_one_report` OR `hackerone_report` OR `microsoft_defender_vulnerability` OR `netskope_compliance_finding` OR `nowsecure_finding` OR `nuclei_finding` OR `orca_finding` OR `orca_finding_alert` OR `probely_finding` OR `sast_scan_finding` OR `snyk_finding` OR `sysdig_finding` OR `tenable_container_finding` OR `tenable_vulnerability_finding` OR `trivy_finding` OR `veracode_finding` OR `qualys_finding` OR `qualys_host_finding` OR `wiz_vunerability_finding` | `severity` OR `Severity` | `/(^(info(rmational)?|(very low)|none|negligible))/i` OR `/(^low)/i` OR `/(^(medium|moderate))/i` OR `/(^high)/i` OR `/(^(critical|(very high)|hazardous|urgent))/i` OR `/(^unknown)/i` |

> **NOTE**
> 
> `aws_ecr_image_scan_finding` entities DO NOT have their severity normalized by default. If you would like them to be normalized, please contact support.

### Example normalizations

```diff
// Example 1:
{
- "severity": "MEDIUM",
+ "severity": "medium",
+ "raw_severity": "MEDIUM" // preserved original value
}

// Example 2:
{
  "Severity": "very low",
+ "severity": "info"
}
```

---

Source: /data-model/entity-relationship-metadata

# Entity relationship metadata

JupiterOne assigns the following metadata internally to entities and relationships, and all internal metadata assigned by JupiterOne features a property name prefixed with and underscore (`_`).

### Class, Type, Key, and ID

| Property | Type | Description |
| --- | --- | --- |
| `_class` | \`string | string\[\]\` |
| `_type` | `string` | The specific type of the resource. |
| `_key` | `string` | An identifier of the resource unique within an integration instance or data source scope. |
| `_id` | `string` | A globally unique identifier of the resource within JupiterOne. |

### Timestamps

All timestamps are store in Epoch milliseconds and displayed in the UI in ISO date string format:

| Property | Type | Description |
| --- | --- | --- |
| `_createdOn` | `number` | The timestamp the entity/relationship was first created in JupiterOne. Usually represents a time after the resource was created in the provider environment. |
| `_beginOn` | `number` | The timestamp when the latest version of entity/relationship was created. Equivalent to last updated timestamp within JupiterOne (_not_ the timestamp of the resource updated in the provider environment). |
| `_endOn` | `number` | THe timestamp a version of the entity/relationship was deleted in JupiterOne. |

> If available, timestamps from the resource provider, are generally normalized to one of the following:
> 
> -   `createdOn`
> -   `updatedOn`
> -   `deletedOn`
> -   `startedOn`
> -   `stoppedOn`

### State and source related metadata

| Property | Type | Description |
| --- | --- | --- |
| `_deleted` | `boolean` | Indicates whether a resource was deleted from JupiterOne graph/CMDB. This typically means the resource was recently deleted from the provider source environment. |
| `_version` | `number` | The version number, which increments every time a change to the resource configuration/attribute is captured. |
| `_source` | `string` | The source from where the resource was created. Valid options include: `integration-managed`, `powerup-managed`, `system-internal`, `system-mapper`, and `api`. |

### Integration specific metadata

The following metadata only exists on resources created via an integration:

| Property | Type | Description |
| --- | --- | --- |
| `_integrationClass` | \`string | string\[\]\` |
| `_integrationType` | `string` | Type of the integration. Typically the service provider name. For example: `aws`, `google`, `azure`, `okta`, `knowbe4`, `vmware`, etc. |
| `_integrationName` | `string` | User-provided friendly name of the integration instance. |
| `_integrationDefinitionId` | `string` | Internal UUID that identifies the definition for this integration, e.g. AWS, Azure, etc. |
| `_integrationInstanceId` | `string` | Internal UUID that identifies the integration instance. An integration can have more than one configuration instances. For example, multiple AWS accounts have multiple AWS integration instances. |

---

Source: /data-model/jupiterone-data-model

# JupiterOne Data Model

The JupiterOne Data Model is a reference model that illustrates digital resources and their complex interconnections across all ingested resources of an organization within an entity-relationship graph.

The Data Model is defined by a set of **Entities** and their **Relationships**, operating as an adaptable model rather than a strict or rigid structure.

**[📋 Download OpenAPI 3.1 Specification](/assets/files/openapi-69de98b255a4d6e96c30bd1ec962b026.json)**

## Entities

An **Entity** is a node, or vertex, within the JupiterOne graph that represents a resource within your digital infrastructure.

Each entity has a specific type that defines what that entity is and is assigned one or more higher-level class that represents a more abstract categorization or labeling of the entity in the perspective of security and technical operations.

Entities have a dedicated **type** as well as a broader level **class** for categorization at a more abstract level:

-   Entity **Type**: denotes the specific entity type based on the entity's source. For example, an AWS resource may be of type `aws_instance`, `aws_s3_bucket`, or `aws_iam_use`.
-   Entity **Class**: an abstract, _super-type_ that classifies an entity within the general framework of IT and security operations. In the above example, an `aws_instance` entity has a class of `Host`, while an `aws_s3_bucket` is a `DataStore`, and an `aws_iam_user` a `User`.

### Common entity properties

Most entities will share the following common properties:

| Property | Type | Description |
| --- | --- | --- |
| `id` | `string`,`array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |
| `name` | `string` | Name of this entity |
| `displayName` | `string` | Display name, e.g. a person's preferred name or an AWS account alias |
| `summary` | `string` | A summary / short description of this entity. |
| `description` | `string` | An extended description of this entity. |
| `classification` | `string`,`null` | The sensitivity of the data; should match company data classification scheme |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned |
| `active` | `boolean` | Indicates if this entity is currently active. |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. |
| `createdBy` | `string` | The source/principal/user that created the entity |
| `updatedBy` | `string` | The source/principal/user that updated the entity |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |
| `tags` | `array` | An array of unnamed tags |
| `notes` | `array` | User provided notes about this entity |

#### Findings Severity Data Normalization

When JupiterOne ingests data from an integration or an API, it uses the property `severity` to normalize the severity rates of findings when severity is present. Normalizing the data simplifies searches and queries that apply to vendors with properties or values that are semantically equivalent but with different names and values. For example, `severity: LOW` and `Severity: Critical` properties would be normalized to `severity: low` and `severity: critical`, respectively but the original values remain available in `raw_severity`. Not all findings data has a severity rating. In that case, JupiterOne does not normalize a severity value. For more information about normalization, see [Entity Property Normalization](/data-model/entity-property-normalization.md).

### Additional entity properties

In addition to the common entity properties outlined above, there are additional properties that can exist on entities. These properties are dependant upon class or are custom defined.

#### Class-specific Entity properties

Each specific class of Entity also has its own defined properties. For example, a `Person` entity will have properties including `firstName` and `lastName`, while a `Device` entity may have properties such as `hardwareVendor`, `hardwareModel`, and `hardwareSerial`.

#### Custom entity properties

You can also define custom properties for entity types. These are defined by the source system to which the resource belongs and can also be defined by individuals or teams managing the property resource.

### Defined entities

Below is a list of reference entities as defined by the JupiterOne Data model, each with its own respective unique properties outside of the shared [common properties outlined above](#common-entity-properties).

| Entity | Description |
| --- | --- |
| [AccessKey](/data-model/schemas/AccessKey.md) | A key used to grant access, such as ssh-key, access-key, api-key/token, mfa-token/device, etc. |
| [AccessPolicy](/data-model/schemas/AccessPolicy.md) | A policy for access control assigned to a Host, Role, User, UserGroup, or Service. |
| [AccessRole](/data-model/schemas/AccessRole.md) | An access control role mapped to a Principal (e.g. user, group, or service). |
| [Account](/data-model/schemas/Account.md) | An organizational account for a service or a set of services (e.g. AWS, Okta, Bitbucket Team, Google G-Suite account, Apple Developer Account). Each Account should be connected to a Service. |
| [Alert](/data-model/schemas/Alert.md) | A notice of any unusual or dangerous circumstance that is sent to responsible parties for the purpose of triggering action. |
| [Application](/data-model/schemas/Application.md) | A software product or application. |
| [ApplicationEndpoint](/data-model/schemas/ApplicationEndpoint.md) | An application endpoint is a program interface that either initiates or receives a request, such as an API. |
| [Assessment](/data-model/schemas/Assessment.md) | An object to represent an assessment, including both compliance assessment such as a HIPAA Risk Assessment or a technical assessment such as a Penetration Testing. Each assessment should have findings (e.g. Vulnerability or Risk) associated. |
| [Attacker](/data-model/schemas/Attacker.md) | An attacker or threat actor. |
| [Backup](/data-model/schemas/Backup.md) | A specific repository or data store containing backup data. |
| [Certificate](/data-model/schemas/Certificate.md) | A digital Certificate such as an SSL or S/MIME certificate. |
| [Channel](/data-model/schemas/Channel.md) | A communication channel, such as a Slack channel or AWS SNS topic. |
| [Cluster](/data-model/schemas/Cluster.md) | A cluster of compute or database resources/workloads. |
| [CodeCommit](/data-model/schemas/CodeCommit.md) | A code commit to a repo. The commit id is captured in the \_id property of the Entity. |
| [CodeDeploy](/data-model/schemas/CodeDeploy.md) | A code deploy job. |
| [CodeModule](/data-model/schemas/CodeModule.md) | A software module. Such as an npm\_module or java\_library. |
| [CodeRepo](/data-model/schemas/CodeRepo.md) | A source code repository. A CodeRepo is also a DataRepository therefore should carry all the required properties of DataRepository. |
| [CodeReview](/data-model/schemas/CodeReview.md) | A code review record. |
| [Configuration](/data-model/schemas/Configuration.md) | A Configuration contains definitions that describe a resource such as a Task, Deployment or Workload. For example, an `aws_ecs_task_definition` is a `Configuration`. |
| [Container](/data-model/schemas/Container.md) | A standard unit of software that packages up code and all its dependencies and configurations. |
| [Control](/data-model/schemas/Control.md) | A security or IT Control. A control can be implemented by a vendor/service, a person/team, a program/process, an automation code/script/configuration, or a system/host/device. Therefore, this is most likely an additional Class applied to a Service (e.g. Okta SSO), a Device (e.g. a physical firewall), or a HostAgent (e.g. Carbon Black CbDefense Agent). Controls are mapped to security policy procedures and compliance standards/requirements. |
| [ControlPolicy](/data-model/schemas/ControlPolicy.md) | An technical or operational policy with rules that govern (or enforce, evaluate, monitor) a security control. |
| [CryptoKey](/data-model/schemas/CryptoKey.md) | A key used to perform cryptographic functions, such as an encryption key. |
| [DataCollection](/data-model/schemas/DataCollection.md) | An individual collection of data. The collection may exist in various formats, such as a table (e.g. a MySQL table). The exact data type is described in the \_type property of the Entity. |
| [DataObject](/data-model/schemas/DataObject.md) | An individual data object, such as an aws-s3-object, sharepoint-document, source-code, or a file (on disk). The exact data type is described in the \_type property of the Entity. |
| [DataStore](/data-model/schemas/DataStore.md) | A virtual repository where data is stored, such as aws-s3-bucket, aws-rds-cluster, aws-dynamodb-table, bitbucket-repo, sharepoint-site, docker-registry. The exact type is described in the \_type property of the Entity. |
| [Database](/data-model/schemas/Database.md) | A database cluster/instance. |
| [Deployment](/data-model/schemas/Deployment.md) | A deployment of code, application, infrastructure or service. For example, a Kubernetes deployment. An auto scaling group is also considered a deployment. |
| [Device](/data-model/schemas/Device.md) | A physical device or media, such as a server, laptop, workstation, smartphone, tablet, router, firewall, switch, wifi-access-point, usb-drive, etc. The exact data type is described in the \_type property of the Entity. |
| [Directory](/data-model/schemas/Directory.md) | Directory, such as LDAP or Active Directory. |
| [Disk](/data-model/schemas/Disk.md) | A disk storage device such as an AWS EBS volume |
| [Document](/data-model/schemas/Document.md) | A document or data object. |
| [Domain](/data-model/schemas/Domain.md) | An internet domain. |
| [DomainRecord](/data-model/schemas/DomainRecord.md) | The DNS Record of a Domain Zone. |
| [DomainZone](/data-model/schemas/DomainZone.md) | The DNS Zone of an Internet Domain. |
| [Entity](/data-model/schemas/Entity.md) | A node in the graph database that represents an Entity. This reference schema defines common shared properties among most Entities. |
| [Finding](/data-model/schemas/Finding.md) | A security finding, which may be a vulnerability or just an informative issue. A single finding may impact one or more resources. The `IMPACTS` relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The `IMPACTS` relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc. |
| [Firewall](/data-model/schemas/Firewall.md) | A piece of hardware or software that protects a network/host/application. |
| [Framework](/data-model/schemas/Framework.md) | An object to represent a standard compliance or technical security framework. |
| [Function](/data-model/schemas/Function.md) | A virtual application function. For example, an aws\_lambda\_function, azure\_function, or google\_cloud\_function |
| [Gateway](/data-model/schemas/Gateway.md) | A gateway/proxy that can be a system/appliance or software service, such as a network router or application gateway. |
| [GraphObject](/data-model/schemas/GraphObject.md) | Standard metadata properties of a graph object, maintained by the system. These are visible to users but may not be directly modified. |
| [Group](/data-model/schemas/Group.md) | A defined, generic group of Entities. This could represent a group of Resources, Users, Workloads, DataRepositories, etc. |
| [Host](/data-model/schemas/Host.md) | A Host represents a computer, virtual machine, or other device that can run software and connect to a network. |
| [HostAgent](/data-model/schemas/HostAgent.md) | A software agent or sensor that runs on a host/endpoint. |
| [Image](/data-model/schemas/Image.md) | A system image. For example, an AWS AMI (Amazon Machine Image). |
| [Incident](/data-model/schemas/Incident.md) | An operational or security incident. An event that negatively affects the confidentiality, integrity or availability of an organization's assets. |
| [Internet](/data-model/schemas/Internet.md) | The Internet node in the graph. There should be only one Internet node. |
| [IpAddress](/data-model/schemas/IpAddress.md) | An re-assignable IpAddress resource entity. Do not create an entity for an IP Address _configured_ on a Host. Use this only if the IP Address is a reusable resource, such as an Elastic IP Address object in AWS. |
| [IpRange](/data-model/schemas/IpRange.md) | consecutive set of IP addresses used for network addressing and management. |
| [Issue](/data-model/schemas/Issue.md) | An issue as used by GitHub, Jira, or other project trackers. |
| [Key](/data-model/schemas/Key.md) | An ssh-key, access-key, api-key/token, pgp-key, etc. |
| [Logs](/data-model/schemas/Logs.md) | A specific repository or destination containing application, network, or system logs. |
| [Model](/data-model/schemas/Model.md) | A system of postulates, data, and inferences presented as a mathematical description of an entity or state of affairs. For example, a machine learning model. |
| [Module](/data-model/schemas/Module.md) | A software or hardware module. Such as an npm\_module or java\_library. |
| [NHI](/data-model/schemas/NHI.md) | A non-human identity (NHI) — any digital identity that is not a person, such as a service account, machine credential, secret, OAuth app, bot, certificate, API key, webhook, or CI/CD identity. NHIs are typically used by software, automation, or workloads to access systems and services. |
| [Network](/data-model/schemas/Network.md) | A network, such as an aws-vpc, aws-subnet, cisco-meraki-vlan. |
| [NetworkEndpoint](/data-model/schemas/NetworkEndpoint.md) | A network endpoint for connecting to or accessing network resources. For example, NFS mount targets or VPN endpoints. |
| [NetworkInterface](/data-model/schemas/NetworkInterface.md) | An re-assignable software defined network interface resource entity. Do not create an entity for a network interface _configured_ on a Host. Use this only if the network interface is a reusable resource, such as an Elastic Network Interface object in AWS. |
| [Organization](/data-model/schemas/Organization.md) | An organization, such as a company (e.g. JupiterOne) or a business unit (e.g. HR). An organization can be internal or external. Note that there is a more specific Vendor class. |
| [PR](/data-model/schemas/PR.md) | A pull request. |
| [PasswordPolicy](/data-model/schemas/PasswordPolicy.md) | A password policy is a specific `Ruleset`. It is separately defined because of its pervasive usage across digital environments and the well known properties (such as length and complexity) unique to a password policy. |
| [Person](/data-model/schemas/Person.md) | An entity that represents an actual person, such as an employee of an organization. |
| [Policy](/data-model/schemas/Policy.md) | A written policy documentation. |
| [Port](/data-model/schemas/Port.md) | A number assigned to identify a network communication endpoint. |
| [Problem](/data-model/schemas/Problem.md) | A problem identified from the analysis and correlation of assets and findings that is a notable issue worthy of action. It could be (or become) the cause, or potential cause, of one or more incidents or findings. |
| [Procedure](/data-model/schemas/Procedure.md) | A written procedure and control documentation. A Procedure typically `IMPLEMENTS` a parent Policy. An actual Control further `IMPLEMENTS` a Procedure. |
| [Process](/data-model/schemas/Process.md) | A compute process -- i.e. an instance of a computer program / software application that is being executed by one or many threads. This is NOT a program level operational process (i.e. a Procedure). |
| [Product](/data-model/schemas/Product.md) | A product developed by the organization, such as a software product. |
| [Program](/data-model/schemas/Program.md) | A program. For example, a bug bounty/vuln disclosure program. |
| [Project](/data-model/schemas/Project.md) | A software development project. Can be used for other generic projects as well but the defined properties are geared towards software development projects. |
| [Question](/data-model/schemas/Question.md) | An object that represents an inquiry, usually around some matter of uncertainty or difficulty. |
| [Queue](/data-model/schemas/Queue.md) | A scheduling queue of computing processes or devices. |
| [Record](/data-model/schemas/Record.md) | A DNS record; or an official record (e.g. Risk); or a written document (e.g. Policy/Procedure); or a reference (e.g. Vulnerability/Weakness). The exact record type is captured in the \_type property of the Entity. |
| [RecordEntity](/data-model/schemas/RecordEntity.md) | A node in the graph database that represents a Record Entity, with a set of different defined common properties than standard (resource) entities. |
| [Repository](/data-model/schemas/Repository.md) | A repository that contains resources. For example, a Docker container registry repository hosting Docker container images. |
| [Requirement](/data-model/schemas/Requirement.md) | An individual requirement for security, compliance, regulation or design. |
| [Resource](/data-model/schemas/Resource.md) | A generic assignable resource. A resource is typically non-functional by itself unless used by or attached to a host or workload. |
| [Review](/data-model/schemas/Review.md) | A review record. |
| [Risk](/data-model/schemas/Risk.md) | An object that represents an identified Risk as the result of an Assessment. The collection of Risk objects in JupiterOne make up the Risk Register. A Control may have a `MITIGATES` relationship to a Risk. |
| [Root](/data-model/schemas/Root.md) | The root node in the graph. There should be only one Root node per organization account. |
| [Rule](/data-model/schemas/Rule.md) | An operational or configuration compliance rule, often part of a Ruleset. |
| [Ruleset](/data-model/schemas/Ruleset.md) | An operational or configuration compliance ruleset with rules that govern (or enforce, evaluate, monitor) a security control or IT system. |
| [Scanner](/data-model/schemas/Scanner.md) | A system vulnerability, application code or network infrastructure scanner. |
| [Secret](/data-model/schemas/Secret.md) | A stored encrypted secret, accessed by permitted users or applications. |
| [Section](/data-model/schemas/Section.md) | An object to represent a section such as a compliance section. |
| [Service](/data-model/schemas/Service.md) | A service provided by a vendor. |
| [Site](/data-model/schemas/Site.md) | The physical location of an organization. A Person (i.e. employee) would typically has a relationship to a Site (i.e. located\_at or work\_at). Also used as the abstract reference to AWS Regions. |
| [Standard](/data-model/schemas/Standard.md) | An object to represent a standard such as a compliance or technical standard. |
| [Subscription](/data-model/schemas/Subscription.md) | A subscription to a service or channel. |
| [Task](/data-model/schemas/Task.md) | A computational task. Examples include AWS Batch Job, ECS Task, etc. |
| [Team](/data-model/schemas/Team.md) | A team consists of multiple member Person entities. For example, the Development team or the Security team. |
| [ThreatIntel](/data-model/schemas/ThreatIntel.md) | Threat intelligence captures information collected from vulnerability risk analysis by those with substantive expertise and access to all-source information. Threat intelligence helps a security professional determine the risk of a vulnerability finding to their organization. |
| [Training](/data-model/schemas/Training.md) | A training module, such as a security awareness training or secure development training. |
| [User](/data-model/schemas/User.md) | A user account/login to access certain systems and/or services. Examples include okta-user, aws-iam-user, ssh-user, local-user (on a host), etc. |
| [UserGroup](/data-model/schemas/UserGroup.md) | A user group, typically associated with some type of access control, such as a group in Okta or in Office365. If a UserGroup has an access policy attached, and all member Users of the UserGroup would inherit the policy. |
| [Vault](/data-model/schemas/Vault.md) | A collection of secrets such as a key ring |
| [Vendor](/data-model/schemas/Vendor.md) | An external organization that is a vendor or service provider. |
| [Vulnerability](/data-model/schemas/Vulnerability.md) | A security vulnerability identified by a Common Vulnerabilities and Exposures (CVE) identifier. A single vulnerability may relate to multiple findings and impact multiple resources. The IMPACTS relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The IMPACTS relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc. |
| [Weakness](/data-model/schemas/Weakness.md) | A security weakness identified by a Common Weakness Enumeration (CWE) identifier. |
| [Workflow](/data-model/schemas/Workflow.md) | A workflow such as an AWS CodePipeline, GitHub repository workflow, or Apache Airflow. |
| [Workload](/data-model/schemas/Workload.md) | A virtual compute instance, it could be an aws-ec2-instance, a docker-container, an aws-lambda-function, an application-process, or a vmware-instance. The exact workload type is described in the \_type property of the Entity. |

### Special entities

There are three special, singleton entities within the JupiterOne Data Model as well:

| Entity | Description |
| --- | --- |
| `Everyone` | The global `UserGroup` the represents "everyone" publicly. |
| `Internet` | The Internet, i.e., a `Network` entity with a CIDR value of `0.0.0.0/0` |
| `Root` | The entity that represents the top-level organization. |

## Relationships

Relationships are the edges between two entity nodes in the graph. The `_class` of the relationship should be, in most cases, a generic descriptive verb, such as `HAS` or `IMPLEMENTS`. Relationships can also carry their own properties.

For example, `CodeRepo -- DEPLOYED TO -> Host` may have version as a property on the `DEPLOYED` relationship. This represents the mapping between a code repo to multiple deployment targets, while one deployment may be of a different version of the code than another. Storing the version as a relationship property allows us to avoid duplicate instances of the code repo entity being created to represent different versions.

Relationships also have the same metadata properties as entities, which are managed by the integration providers.

### Findings Severity Data Normalization

When JupiterOne ingests data from an integration or an API, it uses the property `j1_severity` to normalize the severity rates of findings when severity is present. Normalizing the data simplifies searches and queries that apply to vendors with properties or values that are semantically equivalent but with different names and values. For example, `vendor1_severity` and `vendor2_severity` properties would be normalized to be `j1_severity`, but the original values remain in the database. Not all findings data has a severity rating. In that case, JupiterOne does not provide the `j1_severity` for those findings.

#### Example queries:

`find Finding with [j1_severity] = "high"` This query returns a list of all findings with a normalized severity of “high”.

`find Finding with [j1_severity] != undefined as f RETURN f.[j1_severity], count (f)` This query returns a count of all findings in JupiterOne grouped by j1\_severity.

### Relationship examples

Below is a list of example relationships between abstract entity classes.

##### HAS / CONTAINS

```text
      Account         -- HAS ->             User
      Account         -- HAS ->             UserGroup
      Account         -- HAS ->             AccessRole
      Account         -- HAS ->             Resource
      CodeRepo        -- HAS ->             Vulnerability
      Host            -- HAS ->             Vulnerability
      Organization    -- HAS ->             Site
      Organization    -- HAS ->             Organization (e.g. a business unit)
      Application     -- HAS ->             Vulnerability
      CodeRepo        -- HAS ->             Vulnerability
      Host            -- HAS ->             Vulnerability
      Service         -- HAS ->             Vulnerability
      Site            -- HAS ->             Network
      Site            -- HAS ->             Site
      UserGroup       -- HAS ->             User
      Network         -- CONTAINS ->        Host
      Network         -- CONTAINS ->        Database
      Network         -- CONTAINS ->        Network (e.g. a subnet)
```

##### IS / OWNS

```text
User            -- IS ->              Person
Vulnerability   -- IS ->              Vulnerability (e.g. a Snyk Vuln IS a CVE)
Person          -- OWNS ->            Device
```

##### EXPLOITS / IMPACTS

```text
Vulnerability   -- EXPLOITS ->        Weakness
Vulnerability   -- IMPACTS  ->        CodeRepo | Application
```

##### USES

```text
Host            -- USES ->            Resource (e.g. aws_instance USES aws_ebs_volume)
```

##### CONNECTS / TRIGGERS / EXTENDS

```text
Application     -- CONNECTS ->        Account
Gateway         -- CONNECTS ->        Network
Gateway         -- TRIGGERS ->        Function
HOST            -- EXTENDS  ->        Resource
```

##### IMPLEMENTS / MITIGATES

```text
Procedure       -- IMPLEMENTS ->      Policy
Control         -- IMPLEMENTS ->      Policy
Control         -- MITIGATES  ->      Risk
```

##### MANAGES

```text
Person          -- MANAGES ->         Person
Person          -- MANAGES ->         Organization
Person          -- MANAGES ->         Team
User            -- MANAGES ->         Account
User            -- MANAGES ->         UserGroup
ControlPolicy   -- MANAGES ->         Control
AccessPolicy    -- MANAGES ->         AccessRole
```

##### EVALUATES / MONITORS / PROTECTS

```text
ControlPolicy   -- EVALUATES ->       <any entity>
HostAgent       -- MONITORS  ->       Host
HostAgent       -- PROTECTS  ->       Host
```

##### TRUSTS

```text
AccessRole      -- TRUSTS ->          AccessRole
AccessRole      -- TRUSTS ->          Service
AccessRole      -- TRUSTS ->          Account
```

##### ASSIGNED

```text
User            -- ASSIGNED ->        Application
User            -- ASSIGNED ->        AccessRole
UserGroup       -- ASSIGNED ->        AccessRole
```

##### IDENTIFIED / PERFORMED / COMPLETED

```text
Person          -- PERFORMED  ->      Assessment
Person          -- COMPLETED  ->      Training
Assessment      -- IDENTIFIED ->      Risk
Assessment      -- IDENTIFIED ->      Vulnerability
```

##### PROVIDES

```text
Vendor          -- PROVIDES ->        Service
```

##### CONTRIBUTES TO

```text
User            -- CONTRIBUTES TO ->  CodeRepo
```

##### OPENED

```text
User            -- OPENED   ->        CodeReview (i.e. PR)
```

##### DEPLOYED TO

```text
CodeRepo        -- DEPLOYED TO ->     Account
CodeRepo        -- DEPLOYED TO ->     Host
CodeRepo        -- DEPLOYED TO ->     Container
CodeRepo        -- DEPLOYED TO ->     Function
```

---

Source: /data-model/schemas/AccessKey

# AccessKey

A key used to grant access, such as ssh-key, access-key, api-key/token, mfa-token/device, etc.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `fingerprint` | `string` | The fingerprint that identifies the key |  |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `material` | `string` | The key material |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `usage` | `string` | The key usage - for example: ssh access or data encryption |  |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/AccessPolicy

# AccessPolicy

A policy for access control assigned to a Host, Role, User, UserGroup, or Service.

##### AccessPolicy properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admin` | `boolean` | Indicates if the policy grants administrative privilege. |  |
| `content` | `string` | Content of a policy contains the raw policy rules, if applicable. For example, the JSON text of an AWS IAM Policy. This is stored in raw data. |  |
| `rules` | `array` of `string`s | Rules of this policy. Each rule is written 'as-code' that can be operationalized with a control provider or within JupiterOne's rules engine. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/AccessRole

# AccessRole

An access control role mapped to a Principal (e.g. user, group, or service).

##### AccessRole properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `privilegeNames` | `array` of `string`s | The role's privilege names |  |
| `privilegeServiceIds` | `array` of `string`s | The role's privilege service IDs |  |
| `superAdmin` | `boolean` | Is the role an administrator role? |  |
| `systemRole` | `boolean` | Is this a system role? |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Account

# Account

An organizational account for a service or a set of services (e.g. AWS, Okta, Bitbucket Team, Google G-Suite account, Apple Developer Account). Each Account should be connected to a Service.

##### Account properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`vendor` \*

 | `string` | The canonical full name of the vendor of this account. For example, prefer 'Amazon Web Services' over 'AWS'.  
  
**Examples**: Amazon Web Services, ServiceNow, Okta |  |
| `accessURL` | `string` | The main URL to access this account, e.g. [https://jupiterone.okta.com](https://jupiterone.okta.com) | 

**Format**: `uri`

  
 |
| `mfaEnabled` | `boolean` | Specifies whether multi-factor authentication (MFA) is enabled/required for users of this account. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `vendor`

---

Source: /data-model/schemas/Alert

# Alert

A notice of any unusual or dangerous circumstance that is sent to responsible parties for the purpose of triggering action.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Application

# Application

A software product or application.

##### Application properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `alternateURLs` | `array` of `string`s | The additional URLs related to this application. |  |
| `COTS` | `boolean` | Indicates if this is a Commercial Off-The-Shelf software application. Custom in-house developed application should have this set to false. | **default**: false |
| `devURL` | `string` | The Development URL | 
**Format**: `uri`

  
 |
| `external` | `boolean` | Indicates if this is an externally acquired software application. Custom in-house developed application should have this set to false. | **default**: false |
| `FOSS` | `boolean` | Indicates if this is a Free or Open-Source software application or library. Custom in-house developed application should have this set to false. | **default**: false |
| `license` | `string` | Stores the type of license  
  
**Examples**: BSD, CC-BY-3.0, CC-BY-4.0, GPL-2.0, GPL-3.0, LGPL-2.0, LGPL-2.1, LGPL-3.0, MIT, EULA, Proprietary, UNLICENSED, other |  |
| `licenseURL` | `string` | The URL to the full license | 

**Format**: `uri`

  
 |
| `mobile` | `boolean` | Indicates if this is a mobile app. | **default**: false |
| `productionURL` | `string` | The Production URL | 

**Format**: `uri`

  
 |
| `SaaS` | `boolean` | Indicates if this is a Software-as-a-Service product. | **default**: false |
| `stagingURL` | `string` | The Non-Production / Staging URL | 

**Format**: `uri`

  
 |
| `testURL` | `string` | The Test URL | 

**Format**: `uri`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/ApplicationEndpoint

# ApplicationEndpoint

An application endpoint is a program interface that either initiates or receives a request, such as an API.

##### ApplicationEndpoint properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`address` \*

 | `string` **|** `null` | The endpoint address (e.g. an URI/URL, hostname) |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `address`

---

Source: /data-model/schemas/Assessment

# Assessment

An object to represent an assessment, including both compliance assessment such as a HIPAA Risk Assessment or a technical assessment such as a Penetration Testing. Each assessment should have findings (e.g. Vulnerability or Risk) associated.

##### Assessment properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` | The category of the Assessment.  
  
**Examples**: Risk Assessment, Readiness Assessment, Gap Assessment, Validation Assessment, Compliance Assessment, Self Assessment, Certification, Audit, Technical Review, Operational Review, Penetration Testing, Vulnerability Scan, Other |  |
| 

`internal` \*

 | `boolean` | Indicates if this is an internal or external assessment/audit. Defaults to true. | **default**: true |
| 

`summary` \*

 | `string` | The summary description of the Assessment. |  |
| `assessor` | `string` | Email or name or ID of the assessor |  |
| `assessors` | `array` of `string`s | List of email or name or ID of the assessors |  |
| `completedOn` | `number` | The timestamp (in milliseconds since epoch) when the Assessment was completed. | 

**Format**: `date-time`

  
 |
| `reportURL` | `string` | Link to the assessment report, if available. | 

**Format**: `uri`

  
 |
| `startedOn` | `number` | The timestamp (in milliseconds since epoch) when the Assessment was started. | 

**Format**: `date-time`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`
-   `summary`
-   `internal`

---

Source: /data-model/schemas/Attacker

# Attacker

An attacker or threat actor.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Backup

# Backup

A specific repository or data store containing backup data.

##### Backup properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `encrypted` | `boolean` | Indicates whether the backup data is encrypted. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Certificate

# Certificate

A digital Certificate such as an SSL or S/MIME certificate.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Channel

# Channel

A communication channel, such as a Slack channel or AWS SNS topic.

##### Channel properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `encrypted` | `boolean` | Indicates whether the communication channel is encrypted. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Cluster

# Cluster

A cluster of compute or database resources/workloads.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/CodeCommit

# CodeCommit

A code commit to a repo. The commit id is captured in the \_id property of the Entity.

##### CodeCommit properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`branch` \*

 | `string` | The branch the code was committed to. |  |
| 

`merge` \*

 | `boolean` | Indicates if this commit is a merge, defaults to false. | **default**: false |
| 

`message` \*

 | `string` | The commit message. |  |
| 

`versionBump` \*

 | `boolean` | Indicates if this commit is a versionBump, defaults to false. | **default**: false |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `branch`
-   `message`
-   `merge`
-   `versionBump`

---

Source: /data-model/schemas/CodeDeploy

# CodeDeploy

A code deploy job.

##### CodeDeploy properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `action` | `string` | Deploy action (e.g. plan, apply, destroy, rollback). |  |
| `jobName` | `string` | Build/deploy job name. |  |
| `jobNumber` | `integer` | Build/deploy job number. |  |
| `production` | `boolean` | Indicates if this is a production deploy, defaults to true. | **default**: true |
| `summary` | `string` | Descriptive text of the job. |  |
| `target` | `string` | Name of the target system or environment. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/CodeModule

# CodeModule

A software module. Such as an npm\_module or java\_library.

##### CodeModule properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `public` | `boolean` | Indicates if this is a public module. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/CodeRepo

# CodeRepo

A source code repository. A CodeRepo is also a DataRepository therefore should carry all the required properties of DataRepository.

##### CodeRepo properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `application` | `string` | The application that this repo is part of. |  |
| `project` | `string` | The project that this repo belongs to. |  |
| `public` | `boolean` | Indicates if this is a public repo. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/CodeReview

# CodeReview

A code review record.

##### CodeReview properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`title` \*

 | `string` | The title text of the review. |  |
| `state` | `string` | The state of the review. |  |
| `summary` | `string` | The summary text of the review. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `title`

---

Source: /data-model/schemas/Configuration

# Configuration

A Configuration contains definitions that describe a resource such as a Task, Deployment or Workload. For example, an `aws_ecs_task_definition` is a `Configuration`.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Container

# Container

A standard unit of software that packages up code and all its dependencies and configurations.

##### Container properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `dockerVersion` | `string` | The version of the Docker Engine |  |
| `image` | `string` | The container image that the container is built from |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Control

# Control

A security or IT Control. A control can be implemented by a vendor/service, a person/team, a program/process, an automation code/script/configuration, or a system/host/device. Therefore, this is most likely an additional Class applied to a Service (e.g. Okta SSO), a Device (e.g. a physical firewall), or a HostAgent (e.g. Carbon Black CbDefense Agent). Controls are mapped to security policy procedures and compliance standards/requirements.

##### Control properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `function` | `string` **|**
`array` of `string`s

 | The function of the control. It can be a string or string array. Value of each item should be either all lower case or, in the case of an acronym, all upper case. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/ControlPolicy

# ControlPolicy

An technical or operational policy with rules that govern (or enforce, evaluate, monitor) a security control.

##### ControlPolicy properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `category` | `string` | The category of policy. | **enum**: compliance, config, password, other |
| `content` | `string` | Contents of the raw rules, if applicable. |  |
| `rules` | `array` of `string`s | Rules of policy. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/CryptoKey

# CryptoKey

A key used to perform cryptographic functions, such as an encryption key.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `fingerprint` | `string` | The fingerprint that identifies the key |  |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `material` | `string` | The key material |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `usage` | `string` | The key usage - for example: ssh access or data encryption |  |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Database

# Database

A database cluster/instance.

##### Database properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `encrypted` | `boolean` **|** `null` | If the repository is encrypted |  |
| `encryptionRequired` | `boolean` | If the data needs to be encrypted |  |
| `location` | `string` | URI to access the database. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/DataCollection

# DataCollection

An individual collection of data. The collection may exist in various formats, such as a table (e.g. a MySQL table). The exact data type is described in the \_type property of the Entity.

##### DataCollection properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `encrypted` | `boolean` | If the data in the table is encrypted |  |
| `encryptionRequired` | `boolean` | If the objects in the table need to be encrypted |  |
| `PCI` | `boolean` | Indicates if this data table contains Payment Card Information |  |
| `PHI` | `boolean` | Indicates if this data table contains Protected Health Information |  |
| `PII` | `boolean` | Indicates if this data table contains Personally Identifiable Information |  |
| `public` | `boolean` | Indicates if the data table is open to public access |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`classification` \*

 | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `classification`

---

Source: /data-model/schemas/DataObject

# DataObject

An individual data object, such as an aws-s3-object, sharepoint-document, source-code, or a file (on disk). The exact data type is described in the \_type property of the Entity.

##### DataObject properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `category` | `string` | A user-provided category of the data, such as 'Source Code', 'Report', 'Patent Application', 'Business Plan', 'Customer Record', 'Genetic Data', etc. |  |
| `encrypted` | `boolean` | If the data is encrypted |  |
| `encryptionRequired` | `boolean` | If the data needs to be encrypted |  |
| `format` | `string` | The format of the data, such as 'document', 'raw', 'plaintext', 'binary', etc. |  |
| `location` | `string` | URI to the data, e.g. file path |  |
| `PCI` | `boolean` | Indicates if this data object is or contains Payment Card Information |  |
| `PHI` | `boolean` | Indicates if this data object is or contains Protected Health Information |  |
| `PII` | `boolean` | Indicates if this data object is or contains Personally Identifiable Information |  |
| `public` | `boolean` | Indicates if the data object is open to public access |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`classification` \*

 | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `classification`

---

Source: /data-model/schemas/DataStore

# DataStore

A virtual repository where data is stored, such as aws-s3-bucket, aws-rds-cluster, aws-dynamodb-table, bitbucket-repo, sharepoint-site, docker-registry. The exact type is described in the \_type property of the Entity.

##### DataStore properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`encrypted` \*

 | `boolean` **|** `null` | If the data store is encrypted |  |
| `encryptionAlgorithm` | `string` | Encryption algorithm used to encrypt the data store |  |
| `encryptionKeyRef` | `string` | Reference to the encryption key used to encrypt the data store |  |
| `encryptionRequired` | `boolean` | If the data needs to be encrypted |  |
| `hasBackup` | `boolean` | Indicates if the data store is data backup has been configured/enabled. |  |
| `location` | `string` | URI to the data store, e.g. [https://docker-registry.jupiterone.com](https://docker-registry.jupiterone.com) or [https://jupiterone.sharepoint.com](https://jupiterone.sharepoint.com). Or a description to the physical location. |  |
| `public` | `boolean` | Indicates if the data store is open to public access |  |
| `retentionPeriodDays` | `number` | The number of days for which data is retained |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`classification` \*

 | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `classification`
-   `encrypted`

---

Source: /data-model/schemas/Deployment

# Deployment

A deployment of code, application, infrastructure or service. For example, a Kubernetes deployment. An auto scaling group is also considered a deployment.

##### Deployment properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `currentSize` | `number` | Current size (i.e. number of instances) active with this deployment. |  |
| `desiredSize` | `number` | Desired size (i.e. number of instances) associated with this deployment. |  |
| `maxSize` | `number` | Maximum size (i.e. number of instances) limited by this deployment. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Device

# Device

A physical device or media, such as a server, laptop, workstation, smartphone, tablet, router, firewall, switch, wifi-access-point, usb-drive, etc. The exact data type is described in the \_type property of the Entity.

##### Device properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `null` | The device category  
  
**Examples**: server, endpoint, storage-media, mobile, network, other |  |
| 

`deviceId` \*

 | 

`array` of `string`s

**|** `null` | The unique device identifier, traditionally known as a UDID |  |
| 

`displayName` \*

 | `string` | The display name of the device |  |
| 

`fqdn` \*

 | 

`array` of `string`s

**|** `null` | The fully qualified domain name of the Device |  |
| 

`hostname` \*

 | `string` **|** `null` | The primary/local hostname |  |
| 

`ipv4Addresses` \*

 | 

`array` of `string`s

**|** `null` | The IPv4 Addresses associated with the Device |  |
| 

`ipv6Addresses` \*

 | 

`array` of `string`s

**|** `null` | The IPv6 Addresses associated with the Device |  |
| 

`lastSeenOn` \*

 | `integer` **|** `null` | The timestamp (in milliseconds since epoch) when the device was either last checked in or was scanned. |  |
| 

`macAddresses` \*

 | 

`array` of `string`s

**|** `null` | The MAC Addresses associated with the Device, lowercase colon delimited |  |
| 

`make` \*

 | `string` **|** `null` | Same as hardwareVendor: The manufacturer or vendor of the device, e.g. Apple Inc., Generic |  |
| 

`model` \*

 | `string` **|** `null` | Same as hardwareModel: The device hardware model, e.g. MacBookPro13,3 |  |
| 

`osDetails` \*

 | `string` **|** `null` | Operating System Full Details (e.g. macOS High Sierra version 10.13.6) |  |
| 

`osName` \*

 | `string` **|** `null` | Operating System Name (e.g. macOS, Windows 10) |  |
| 

`osType` \*

 | `string` **|** `null` | Operating System Platform |  |
| 

`osVersion` \*

 | `string` **|** `null` | Operating System Version (e.g. 10.13.6) |  |
| 

`privateIpAddresses` \*

 | 

`array` of `string`s

**|** `null` | The private IP addresses associated with the Device |  |
| 

`publicIpAddresses` \*

 | 

`array` of `string`s

**|** `null` | The public IP addresses associated with the Device |  |
| 

`serial` \*

 | `string` **|** `null` | Same as hardwareSerial: The device serial number |  |
| `assetTag` | `array` of `string`s | The asset tag number/label that matches the identifier in asset tracking system, for company owned physical devices | **uniqueItems**: true, |
| `autoSecurityPatchEnabled` | `boolean` | Indicates if security updates are auto-installed | **default**: false |
| `autoSystemPatchEnabled` | `boolean` | Indicates if operating system updates are auto-installed | **default**: false |
| `BYOD` | `boolean` | Indicates if this is a BYOD device -- an employee-provided device that has access to company systems/resources. | **default**: false |
| `cost` | `number` | The purchase cost of the device. |  |
| `encrypted` | `boolean` | Indicates if the primary device storage is encrypted | **default**: false |
| `firewallEnabled` | `boolean` | Indicates if local/host firewall is enabled | **default**: false |
| `hardwareModel` | `string` | The device hardware model, e.g. MacBookPro13,3 |  |
| `hardwareSerial` | `string` | The device serial number |  |
| `hardwareVendor` | `string` | The manufacturer or vendor of the device, e.g. Apple Inc., Generic |  |
| `hardwareVersion` | `string` | The device hardware version |  |
| `location` | `string` | Site where this device is located. |  |
| `malwareProtected` | `boolean` | Indicates if malware protection is enabled | **default**: false |
| `public` | `boolean` **|** `null` | Indicates if the device is publicly accessible from the internet | **default**: false |
| `remoteAccessEnabled` | `boolean` | Indicates if remote access/login to the device is enabled | **default**: false |
| `screenLockEnabled` | `boolean` | Indicates if screen lock protection is enabled | **default**: false |
| `screenLockTimeout` | `number` | Screen lock timeout in seconds |  |
| `status` | `string` **|** `null` | Status label of this device | **enum**: assigned, archived, decommissioned, defective, deployed, disposed, locked, lost/stolen, pending, ready, unknown, other |
| `userEmails` | `array` of `string`s | The email addresses of the users this device is assigned to. Used if the device is shared by more than one user. Otherwise the 'owner' is the sole user. Leave empty/undefined if the device is unassigned. | **uniqueItems**: true,

**Format**: `email`

  
 |
| `value` | `number` | The estimated business value of the device. The value is typically calculated as the monetary cost of the device + the value of data on the device. |  |
| `version` | `string` | Same as hardwareVersion: The device hardware version |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`
-   `ipv4Addresses`
-   `ipv6Addresses`
-   `macAddresses`
-   `publicIpAddresses`
-   `privateIpAddresses`
-   `hostname`
-   `fqdn`
-   `serial`
-   `deviceId`
-   `lastSeenOn`
-   `make`
-   `model`
-   `osName`
-   `osType`
-   `osDetails`
-   `osVersion`

---

Source: /data-model/schemas/Directory

# Directory

Directory, such as LDAP or Active Directory.

##### Directory properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `directoryServers` | `array` of `string`s | List of directory servers. |  |
| `domainControllers` | `array` of `string`s | List of domain controllers. |  |
| `parent` | `string` | Parent directory, if the entity is a sub-directory. |  |
| `type` | `string` | Directory type.  
  
**Examples**: LDAP, AD |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Disk

# Disk

A disk storage device such as an AWS EBS volume

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`classification` \*

 | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`encrypted` \*

 | `boolean` **|** `null` | If the data store is encrypted |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `encryptionAlgorithm` | `string` | Encryption algorithm used to encrypt the data store |  |
| `encryptionKeyRef` | `string` | Reference to the encryption key used to encrypt the data store |  |
| `encryptionRequired` | `boolean` | If the data needs to be encrypted |  |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `hasBackup` | `boolean` | Indicates if the data store is data backup has been configured/enabled. |  |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `location` | `string` | URI to the data store, e.g. [https://docker-registry.jupiterone.com](https://docker-registry.jupiterone.com) or [https://jupiterone.sharepoint.com](https://jupiterone.sharepoint.com). Or a description to the physical location. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if the data store is open to public access |  |
| `retentionPeriodDays` | `number` | The number of days for which data is retained |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `classification`
-   `encrypted`

---

Source: /data-model/schemas/Document

# Document

A document or data object.

##### Document properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `product` | `string` | The name of the product this document is applicable to. This reference is used when the document is product related, such as a product requirement document (PRD) or software bill-of-materials (SBOM). |  |
| `version` | `string` | The version of this document. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Domain

# Domain

An internet domain.

##### Domain properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainName` \*

 | `string` | Domain name. |  |
| `abuseContactEmail` | `string` | Abuse contact email. |  |
| `adminContactEmail` | `string` | Administrative contact email. |  |
| `autoRenew` | `boolean` | Indicates whether auto-renewal is configured. |  |
| `billingContactEmail` | `string` | Billing contact email. |  |
| `contactEmails` | `array` of `string`s | List of contact emails. |  |
| `locked` | `boolean` | Indicates whether domain transfer is locked/protected. |  |
| `nameservers` | `array` of `string`s | List of nameservers. |  |
| `parent` | `string` | Parent domain, if the entity is a sub-domain. |  |
| `registrantContactEmail` | `string` | Registrant contact email. |  |
| `registrar` | `string` | Domain registrar where this domain is registered. |  |
| `registrarName` | `string` | Domain registrar name. |  |
| `registrarUrl` | `string` | Domain registrar URL. |  |
| `techContactEmail` | `string` | Technical contact email. |  |
| `whoisServer` | `string` | WHOIS server that is responsible for resolving the details of this domain. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `domainName`

---

Source: /data-model/schemas/DomainRecord

# DomainRecord

The DNS Record of a Domain Zone.

##### DomainRecord properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`TTL` \*

 | `number` | Time to Live before resolver cache expires. |  |
| 

`type` \*

 | `string` | DNS Record type. | **enum**: A, AAAA, ALIAS, CAA, CERT, CNAME, DNSKEY, DS, LOC, MX, NX, NS, NAPTR, PTR, SMIMEA, SOA, SPF, SRV, SSHFP, TLSA, TXT, URI |
| `value` | `string` **|** `array` | The record value. Could be referenced as `data`, `content`, `resourceRecords`, `aliasTarget` or another property name depending on the DNS provider. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `type`
-   `TTL`

---

Source: /data-model/schemas/DomainZone

# DomainZone

The DNS Zone of an Internet Domain.

##### DomainZone properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainName` \*

 | `string` | Domain name. |  |
| `parent` | `string` | Parent domain, if the entity is a sub-domain. |  |
| `recordsCount` | `number` | Total number of DNS records in this zone. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `domainName`

---

Source: /data-model/schemas/Entity

# Entity

A node in the graph database that represents an Entity. This reference schema defines common shared properties among most Entities.

##### Entity properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Finding

# Finding

A security finding, which may be a vulnerability or just an informative issue. A single finding may impact one or more resources. The `IMPACTS` relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The `IMPACTS` relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc.

##### Finding properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `array` **|** `null` | The category of the finding.  
  
**Examples**: data, application, host, network, endpoint, malware, event |  |
| 

`numericSeverity` \*

 | `number` **|** `null` | Severity rating based on impact and exploitability.  
  
**Examples**: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 |  |
| 

`open` \*

 | `boolean` **|** `null` | Indicates if this is an open vulnerability. |  |
| 

`severity` \*

 | `string` **|** `null` | Severity rating based on impact and exploitability.  
  
**Examples**: none, informational, low, medium, high, critical |  |
| `assessment` | `string` **|** `null` | The name/id of the assessment that produced this finding. |  |
| `blocksProduction` | `boolean` **|** `null` | Indicates whether this vulnerability finding is a blocking issue. If true, it should block a production deploy. Defaults to false. |  |
| `exploitability` | `number` **|** `null` | The exploitability score/rating. |  |
| `impact` | `number` **|** `null` | The impact description or rating. |  |
| `priority` | `string` **|** `null` | Priority level mapping to Severity rating. Can be a string such as 'critical', 'high', 'medium', 'low', 'info'. Or an integer usually between 0-5. |  |
| `production` | `boolean` **|** `null` | Indicates if this vulnerability is in production. |  |
| `public` | `boolean` **|** `null` | Indicates if this is a publicly disclosed vulnerability. If yes, this is usually a CVE and the 'webLink' should be set to '[https://nvd.nist.gov/vuln/detail/$\\{CVE-Number\\}](https://nvd.nist.gov/vuln/detail/$%5C%7BCVE-Number%5C%7D)' or to a vendor URL. If not, it is most likely a custom application vulnerability. |  |
| `recommendation` | `string` **|** `null` | Recommendation on how to remediate/fix this finding. Use 'remediationActions' field instead. | **deprecated**: true |
| `references` | `array` **|** `null` | The array of links to references. |  |
| `remediationActions` | `string` **|** `null` | Recommended remediation actions or steps to address a finding, vulnerability or weakness. This field supports markdown formatting for rich text content including links, code blocks, and structured lists. Markdown-formatted text describing remediation steps is preferred. |  |
| `remediationSLA` | `integer` **|** `null` | The number of days that the Vulnerability must be remediated within, based on SLA set by the organization's internal vulnerability management program policy. The actually due date is set by 'remediationDueOn' property on the `IMPACTS` relationship between the Vulnerability and its impacted resource entity. |  |
| `score` | `number` **|** `null` | The overall vulnerability score, e.g. CVSSv3. |  |
| `status` | `string` **|** `null` | Status of the vulnerability |  |
| `stepsToReproduce` | `array` **|** `null` | Steps to reproduce this finding. |  |
| `targetDetails` | `array` **|** `null` | Additional details about the targets. Can be a string or an array. |  |
| `targets` | `array` **|** `null` | The target listing of projects, applications, repos or systems this vulnerability impacts. Specifying either the project/repo name or the application URL here will auto-map this Vulnerability to the corresponding Project/CodeRepo/Application entity if a match is found. |  |
| `validated` | `boolean` **|** `null` | Indicates if this Vulnerability finding has been validated by the security team. |  |
| `vector` | `string` **|** `null` | The vulnerability attack vector. (e.g. a CVSSv3 vector looks like this - 'AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N') |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`
-   `severity`
-   `numericSeverity`
-   `open`

---

Source: /data-model/schemas/Firewall

# Firewall

A piece of hardware or software that protects a network/host/application.

##### Firewall properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` of `string`s | The category of the Firewall. Indicates the scope that the Firewall applies to -- i.e. Network, Host, Application. | **Enum**: network, host, application, other |
| `isStateful` | `boolean` | Indicates if the rules in the firewall is stateful. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`

---

Source: /data-model/schemas/Framework

# Framework

An object to represent a standard compliance or technical security framework.

##### Framework properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` | Display name |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| 

`standard` \*

 | `string` | The name of the framework standard.  
  
**Examples**: HIPAA, NIST, CSA STAR, PCI DSS, NIST CSF, FedRAMP, ISO 27001, SOC, OWASP, Other |  |
| 

`version` \*

 | `string` | The version of the framework. For example, OWASP may have version 2010, 2013, 2017. |  |
| `description` | `string` | An extended description of this entity. |  |
| `summary` | `string` | A summary / short description of this entity. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `standard`
-   `version`

---

Source: /data-model/schemas/Function

# Function

A virtual application function. For example, an aws\_lambda\_function, azure\_function, or google\_cloud\_function

##### Function properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `codeHash` | `string` | The hash of code of this function. |  |
| `codeSize` | `string` | The size of code of this function. |  |
| `handler` | `string` | The handler of this function |  |
| `image` | `string` | The image of this function, typically refers to a zip package. |  |
| `memorySize` | `string` | The allocated memory of this function to execute. |  |
| `runtime` | `string` | The runtime of this function. For example: 'nodejs6.10', 'nodejs8.10', or 'python2.7'. |  |
| `trigger` | `string` | What triggers this function to execute. |  |
| `version` | `string` | The version of this function. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Gateway

# Gateway

A gateway/proxy that can be a system/appliance or software service, such as a network router or application gateway.

##### Gateway properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` of `string`s | The category of the Gateway (corresponds to which OSI layer does the Proxy operates at). | **Enum**: network, application, data, other |
| 

`function` \*

 | `array` of `string`s | The function of the Gateway | **Enum**: routing, nat, api-gateway, content-filtering, content-distribution, load-balancing, firewall, ssl-termination, reverse-proxy, remote-access-gateway, application-protection, intrusion-detection, intrusion-prevention, mail-filtering, malware-protection, other |
| 

`public` \*

 | `boolean` | Indicates if the Gateway is open to public access |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`
-   `function`
-   `public`

---

Source: /data-model/schemas/GraphObject

# GraphObject

Standard metadata properties of a graph object, maintained by the system. These are visible to users but may not be directly modified.

##### GraphObject properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`

---

Source: /data-model/schemas/Group

# Group

A defined, generic group of Entities. This could represent a group of Resources, Users, Workloads, DataRepositories, etc.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Host

# Host

A Host represents a computer, virtual machine, or other device that can run software and connect to a network.

##### Host properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `null` | The host category  
  
**Examples**: server, endpoint, storage-media, mobile, network, other |  |
| 

`deviceId` \*

 | 

`array` of `string`s

**|** `null` | The unique device identifier, traditionally known as a UDID |  |
| 

`displayName` \*

 | `string` | The display name of the host |  |
| 

`fqdn` \*

 | 

`array` of `string`s

**|** `null` | The fully qualified domain name of the Device |  |
| 

`hostname` \*

 | `string` **|** `null` | The primary/local hostname |  |
| 

`ipv4Addresses` \*

 | 

`array` of `string`s

**|** `null` | The IPv4 Addresses associated with the Device |  |
| 

`ipv6Addresses` \*

 | 

`array` of `string`s

**|** `null` | The IPv6 Addresses associated with the Device |  |
| 

`lastSeenOn` \*

 | `integer` **|** `null` | The timestamp (in milliseconds since epoch) when the host was either last checked in or was scanned. |  |
| 

`macAddresses` \*

 | 

`array` of `string`s

**|** `null` | The MAC Addresses associated with the Device, lowercase colon delimited |  |
| 

`make` \*

 | `string` **|** `null` | Same as hardwareVendor: The manufacturer or vendor of the host, e.g. Apple Inc., Generic |  |
| 

`model` \*

 | `string` **|** `null` | Same as hardwareModel: The host hardware model, e.g. MacBookPro13,3 |  |
| 

`osDetails` \*

 | `string` **|** `null` | Operating System Full Details (e.g. macOS High Sierra version 10.13.6) |  |
| 

`osName` \*

 | `string` **|** `null` | Operating System Name (e.g. macOS, Windows 10) |  |
| 

`osType` \*

 | `string` **|** `null` | Operating System Platform |  |
| 

`osVersion` \*

 | `string` **|** `null` | Operating System Version (e.g. 10.13.6) |  |
| 

`privateIpAddresses` \*

 | 

`array` of `string`s

**|** `null` | The private IP addresses associated with the Device |  |
| 

`publicIpAddresses` \*

 | 

`array` of `string`s

**|** `null` | The public IP addresses associated with the Device |  |
| 

`serial` \*

 | `string` **|** `null` | Same as hardwareSerial: The host serial number |  |
| `public` | `boolean` **|** `null` | Indicates if the host is publicly accessible from the internet | **default**: false |
| `status` | `string` **|** `null` | Status label of this device |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`
-   `ipv4Addresses`
-   `ipv6Addresses`
-   `macAddresses`
-   `publicIpAddresses`
-   `privateIpAddresses`
-   `hostname`
-   `fqdn`
-   `serial`
-   `deviceId`
-   `lastSeenOn`
-   `make`
-   `model`
-   `osName`
-   `osType`
-   `osDetails`
-   `osVersion`

---

Source: /data-model/schemas/HostAgent

# HostAgent

A software agent or sensor that runs on a host/endpoint.

##### HostAgent properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`function` \*

 | `array` of `string`s | The function of sensor/agent | **Enum**: endpoint-compliance, endpoint-configuration, endpoint-protection, anti-malware, DLP, FIM, host-firewall, HIDS, log-monitor, activity-monitor, vulnerability-detection, container-security, other |
| 

`lastSeenOn` \*

 | `number` **|** `null` | The timestamp (in milliseconds since epoch) when the device either last checked in or was scanned. | 

**Format**: `date-time`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `function`
-   `lastSeenOn`

---

Source: /data-model/schemas/Image

# Image

A system image. For example, an AWS AMI (Amazon Machine Image).

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Incident

# Incident

An operational or security incident. An event that negatively affects the confidentiality, integrity or availability of an organization's assets.

##### Incident properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` | The category of the incident  
  
**Examples**: 1. General Incident, 2. Attack on Internal Facing Assets, 3. Attack on External Facing Assets, 4. Malware, 5. Social Engineering, 6. Data Breach, 7. Physical or Environmental |  |
| 

`reportable` \*

 | `boolean` | Indicates if this is a reportable incident per applicable regulations, such as HIPAA, PCI, or GDPR. | **default**: false |
| 

`severity` \*

 | `string` | Severity rating based on impact. Can be a string such as 'critical', 'major', 'minor', or an integer usually between 1-3. |  |
| `impacts` | `array` of `string`s | The target listing of \[IDs/keys to\] systems and resources this incident impacts. |  |
| `postmortem` | `string` | Summary and/or a link to the documented lesson learned. |  |
| `reporter` | `string` | The person/entity who reported this incident. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`
-   `severity`
-   `reportable`

---

Source: /data-model/schemas/Internet

# Internet

The Internet node in the graph. There should be only one Internet node.

##### Internet properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `CIDR` | `string` | The IPv4 network CIDR block | **const**: 0.0.0.0/0 |
| `CIDRv6` | `string` | The IPv6 network CIDR block | **const**: ::/0 |
| `displayName` | `string` | Display name | **const**: Internet |
| `public` | `boolean` | Indicates if the network is open to public access | **const**: true |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`

---

Source: /data-model/schemas/IpAddress

# IpAddress

An re-assignable IpAddress resource entity. Do not create an entity for an IP Address _configured_ on a Host. Use this only if the IP Address is a reusable resource, such as an Elastic IP Address object in AWS.

##### IpAddress properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`ipAddress` \*

 | `string` | The assigned IP address | 

**Format**: `ip`

  
 |
| `dnsName` | `string` | The assigned DNS name | 

**Format**: `hostname`

  
 |
| `ipVersion` | `integer` | Indicates IP version 4 or 6 | **default**: 4, **enum**: 4, 6 |
| `privateIpAddress` | `string` | The assigned private IP address | 

**Format**: `ip`

  
 |
| `publicIpAddress` | `string` | The assigned public IP address | 

**Format**: `ip`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `ipAddress`

---

Source: /data-model/schemas/IpRange

# IpRange

consecutive set of IP addresses used for network addressing and management.

##### IpRange properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`active` \*

 | `boolean` | Indicates if the IP Range is currently active |  |
| 

`begin` \*

 | `string` | The beginning IP address of the range | 

**Format**: `ip`

  
 |
| 

`end` \*

 | `string` | The ending IP address of the range | 

**Format**: `ip`

  
 |
| 

`public` \*

 | `boolean` | Indicates if the IP Range is public |  |
| `asn` | `string` | Autonomous System Number that identifies a routing policy | 

**Format**: `asn`

  
 |
| `cidr` | `array` of `string`s | An array of CIDRs that determine the IP Range | 

**Format**: `ipCidr`

  
 |
| `country` | `string` | Country where the IP range is registered or assigned |  |
| `source` | `string` | The IP Range source |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `begin`
-   `end`
-   `active`
-   `public`

---

Source: /data-model/schemas/Issue

# Issue

An issue as used by GitHub, Jira, or other project trackers.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Key

# Key

An ssh-key, access-key, api-key/token, pgp-key, etc.

##### Key properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `fingerprint` | `string` | The fingerprint that identifies the key |  |
| `material` | `string` | The key material |  |
| `usage` | `string` | The key usage - for example: ssh access or data encryption |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Logs

# Logs

A specific repository or destination containing application, network, or system logs.

##### Logs properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `type` | `string` | The type of logs  
  
**Examples**: network, system, application, access, other |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Model

# Model

A system of postulates, data, and inferences presented as a mathematical description of an entity or state of affairs. For example, a machine learning model.

##### Model properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `encrypted` | `boolean` | Indicates whether the model is encrypted | **default**: false |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Module

# Module

A software or hardware module. Such as an npm\_module or java\_library.

##### Module properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `public` | `boolean` | Indicates if this is a public module. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Network

# Network

A network, such as an aws-vpc, aws-subnet, cisco-meraki-vlan.

##### Network properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`CIDR` \*

 | `string` **|** `null` | The IPv4 network CIDR block (e.g. 0.0.0.0/0) | **pattern**: ^(\[0-9\]{1,3}.){3}\[0-9\]{1,3}(/(\[0-9\]|\[1-2\]\[0-9\]|3\[0-2\]))?$ |
| 

`internal` \*

 | `boolean` **|** `null` | Indicates if this is an internal/private network. |  |
| 

`public` \*

 | `boolean` **|** `null` | Indicates if the network is publicly accessible. |  |
| `CIDRv6` | `string` | The IPv6 network CIDR block (e.g. ::/0) | 

**Format**: `ipv6`

  
 |
| `environment` | `string` | The environment of network  
  
**Examples**: development, test, staging, production, private, wireless, guest, remote-access, administrative, other |  |
| `wireless` | `boolean` | Indicates if this is a wireless network. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `CIDR`
-   `public`
-   `internal`

---

Source: /data-model/schemas/NetworkEndpoint

# NetworkEndpoint

A network endpoint for connecting to or accessing network resources. For example, NFS mount targets or VPN endpoints.

##### NetworkEndpoint properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `ipAddress` | `string` | The endpoint IP address | 
**Format**: `ip`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/NetworkInterface

# NetworkInterface

An re-assignable software defined network interface resource entity. Do not create an entity for a network interface _configured_ on a Host. Use this only if the network interface is a reusable resource, such as an Elastic Network Interface object in AWS.

##### NetworkInterface properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `dnsName` | `string` | The assigned DNS name | 
**Format**: `hostname`

  
 |
| `ipAddress` | `string` | The assigned primary IP address | 

**Format**: `ip`

  
 |
| `ipVersion` | `integer` | Indicates IP version 4 or 6 | **default**: 4, **enum**: 4, 6 |
| `macAddress` | `string` **|** `null` | The assigned MAC address |  |
| `privateIpAddress` | `string` | The assigned private IP address | 

**Format**: `ip`

  
 |
| `publicIpAddress` | `string` | The assigned public IP address | 

**Format**: `ip`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/NHI

# NHI

A non-human identity (NHI) — any digital identity that is not a person, such as a service account, machine credential, secret, OAuth app, bot, certificate, API key, webhook, or CI/CD identity. NHIs are typically used by software, automation, or workloads to access systems and services.

##### NHI properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiConfidence` | `string` | Confidence that this NHI is AI-related. 'confirmed' = signed evidence; 'high'/'medium'/'low' = heuristic strength. | **enum**: confirmed, high, medium, low |
| `aiPlatform` | `string` | The AI platform or vendor this NHI belongs to (e.g. 'openai', 'anthropic', 'google-vertex'). Open string — new platforms appear constantly. |  |
| `isAi` | `boolean` | Whether this NHI is associated with an AI agent, model, or AI-powered workload. |  |
| `nhiOwnerStatus` | `string` | Ownership state used by governance triage workflows. | **enum**: assigned, unassigned, orphaned |
| `nhiType` | `string` | The category of non-human identity. | **enum**: service\_account, credential, secret, oauth\_app, bot, certificate, api\_key, webhook, ci\_cd\_identity, service\_linked\_role, service\_role, workload\_identity, ci\_cd\_role, cross\_account\_role, sso\_role, federated\_role, iam\_role |
| `owner` | `string` | Identifier of the human or team responsible for this NHI (e.g. email, team handle, employee ID). Free-form string — owner-resolution conventions are integration-specific. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Organization

# Organization

An organization, such as a company (e.g. JupiterOne) or a business unit (e.g. HR). An organization can be internal or external. Note that there is a more specific Vendor class.

##### Organization properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_type` \*

 | `string` | The type of organization (within the context of the primary organization).  
  
**Examples**: company, department, business-unit, subsidiary, government-agency, partner, other |  |
| `emailDomain` | `string` | The domain name for internal organization email addresses. |  |
| `external` | `boolean` | Indicates if this organization is external |  |
| `website` | `string` | The organization's main website URL. | 

**Format**: `uri`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/PasswordPolicy

# PasswordPolicy

A password policy is a specific `Ruleset`. It is separately defined because of its pervasive usage across digital environments and the well known properties (such as length and complexity) unique to a password policy.

##### PasswordPolicy properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `autoUnlockMins` | `integer` | Specifies the time interval (in minutes) a locked account remains locked before it is automatically unlocked (0 indicates no limit) |  |
| `excludeAttributes` | `array` of `string`s | The user profile attributes whose values must be excluded from the password |  |
| `excludeCommonPasswords` | `boolean` | Indicates whether to check passwords against a common/weak password dictionary |  |
| `excludeUsername` | `boolean` | Indicates if the username must be excluded from the password |  |
| `expiryWarningDays` | `integer` | Specifies the number of days prior to password expiration when a user will be warned to reset their password (0 indicates no warning) |  |
| `hardExpiry` | `boolean` | Specifies whether users are prevented from setting a new password after their password has expired |  |
| `historyCount` | `integer` | Specifies the number of previous passwords that users are prevented from reusing (0 indicates none) |  |
| `lockoutAttempts` | `integer` | Specifies the number of times users can attempt to log in to their accounts with an invalid password before their accounts are locked (0 indicates no limit) |  |
| `maxAgeDays` | `integer` | Specifies how long (in days) a password remains valid before it expires (0 indicates no limit - passwords do not expire) |  |
| `minAgeMins` | `integer` | Specifies the minimum time interval (in minutes) between password changes (0 indicates no limit) |  |
| `minLength` | `integer` | Minimum password length |  |
| `preventReset` | `boolean` | Indicates if the user is allowed/prevented to change their own password |  |
| `requireLowercase` | `boolean` | Indicates if a password must contain at least one lowercase character |  |
| `requireMFA` | `boolean` | Specifies whether multi-factor authentication (MFA) is required |  |
| `requireNumbers` | `boolean` | Indicates if a password must contain at least one number |  |
| `requireSymbols` | `boolean` | Indicates if a password must contain at least one symbol |  |
| `requireUppercase` | `boolean` | Indicates if a password must contain at least one uppercase character |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Person

# Person

An entity that represents an actual person, such as an employee of an organization.

##### Person properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`email` \*

 | `array` of `string`s | The email addresses of the person; the first one in the array is the primary email. | 

**Format**: `email`

  
 |
| 

`firstName` \*

 | `string` | The person's official first name in the system (such as HR database) |  |
| 

`lastName` \*

 | `string` | The person's official last name in the system (such as HR database) |  |
| `address` | `string` | The person's physical contact address |  |
| `backgroundCheckedBy` | `string` | The agency or person who conducted the background/reference check |  |
| `backgroundCheckedOn` | `number` | Timestamp of the background and/or reference check | 

**Format**: `date-time`

  
 |
| `emailDomain` | `array` of `string`s | The domain portion of the email addresses associated with the user account. |  |
| `employeeId` | `string` | The person's employee ID/number within an organization |  |
| `employeeType` | `string` | The type of employment  
  
**Examples**: employee, contractor, intern, vendor, advisor, other |  |
| `manager` | `string` | Name of the person's manager |  |
| `managerEmail` | `string` | Email of the person's manager | 

**Format**: `email`

  
 |
| `managerId` | `string` | Employee ID of the person's manager |  |
| `middleName` | `string` | The person's official middle name in the system (such as HR database) |  |
| `phone` | `array` of `string`s | The person's phone numbers; the first one in the array is the primary contact number. |  |
| `title` | `string` | The person's role or title within an organization |  |
| `userIds` | `array` of `string`s | One or more user Ids associated with this person |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `firstName`
-   `lastName`
-   `email`

---

Source: /data-model/schemas/Policy

# Policy

A written policy documentation.

##### Policy properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`content` \*

 | `string` | Text content of the policy. For policies/procedures used by the Policy Builder app, this will contain the template text in markdown format. Stored in raw data. |  |
| 

`summary` \*

 | `string` | Summary or overview the describes the policy. Summary text is intended as guidance to the author and not included in the published version. |  |
| 

`title` \*

 | `string` | Title of the policy |  |
| `adopted` | `boolean` | Indicates if policy or procedure has been adopted. Only adopted policies and procedures are included in the published view of the Policy Builder app. |  |
| `applicable` | `boolean` | Indicates if policy or procedure is applicable based on the organization's current risk and compliance needs. A Policy that is not applicable may become applicable later as the organization's requirements and maturity change. |  |
| `author` | `string` | Author of the record |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `title`
-   `summary`
-   `content`

---

Source: /data-model/schemas/Port

# Port

A number assigned to identify a network communication endpoint.

##### Port properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`open` \*

 | `boolean` | Indicates if the port is open or shut communication. |  |
| 

`port` \*

 | `integer` | Port number | **minimum**: 1, **maximum**: 65536 |
| 

`protocol` \*

 | `string` | Communication protocol last observed being used on this port. | **enum**: TCP, UDP, TCP/UDP, UDP/TCP |
| `banner` | `string` | Provides information about the service running on the port. |  |
| `service` | `string` | Indicates the type or protocol of the service running on the port. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `protocol`
-   `open`
-   `port`

---

Source: /data-model/schemas/PR

# PR

A pull request.

##### PR properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`repository` \*

 | `string` | The name of the CodeRepo this PR belongs to. |  |
| 

`source` \*

 | `string` | The source branch. |  |
| 

`state` \*

 | `string` | The state of the PR.  
  
**Examples**: open, merged, declined, superseded |  |
| 

`target` \*

 | `string` | The target/destination branch. |  |
| 

`title` \*

 | `string` | The title text of the PR. |  |
| `approved` | `boolean` | Indicates if every commit associated with this PR has been approved by a reviewer other than the code author. |  |
| `summary` | `string` | The summary text of the PR. |  |
| `validated` | `boolean` | Indicates if every commit associated with this PR was submitted by a validated author known to the organization. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `title`
-   `state`
-   `source`
-   `target`
-   `repository`

---

Source: /data-model/schemas/Problem

# Problem

A problem identified from the analysis and correlation of assets and findings that is a notable issue worthy of action. It could be (or become) the cause, or potential cause, of one or more incidents or findings.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`category` \*

 | `string` **|** `array` **|** `null` | The category of the finding.  
  
**Examples**: data, application, host, network, endpoint, malware, event |  |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| 

`numericSeverity` \*

 | `number` **|** `null` | Severity rating based on impact and exploitability.  
  
**Examples**: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 |  |
| 

`open` \*

 | `boolean` **|** `null` | Indicates if this is an open vulnerability. |  |
| 

`severity` \*

 | `string` **|** `null` | Severity rating based on impact and exploitability.  
  
**Examples**: none, informational, low, medium, high, critical |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `assessment` | `string` **|** `null` | The name/id of the assessment that produced this finding. |  |
| `blocksProduction` | `boolean` **|** `null` | Indicates whether this vulnerability finding is a blocking issue. If true, it should block a production deploy. Defaults to false. |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `exploitability` | `number` **|** `null` | The exploitability score/rating. |  |
| `impact` | `number` **|** `null` | The impact description or rating. |  |
| `priority` | `string` **|** `null` | Priority level mapping to Severity rating. Can be a string such as 'critical', 'high', 'medium', 'low', 'info'. Or an integer usually between 0-5. |  |
| `production` | `boolean` **|** `null` | Indicates if this vulnerability is in production. |  |
| `public` | `boolean` **|** `null` | Indicates if this is a publicly disclosed vulnerability. If yes, this is usually a CVE and the 'webLink' should be set to '[https://nvd.nist.gov/vuln/detail/$\\{CVE-Number\\}](https://nvd.nist.gov/vuln/detail/$%5C%7BCVE-Number%5C%7D)' or to a vendor URL. If not, it is most likely a custom application vulnerability. |  |
| `recommendation` | `string` **|** `null` | Recommendation on how to remediate/fix this finding. Use 'remediationActions' field instead. | **deprecated**: true |
| `references` | `array` **|** `null` | The array of links to references. |  |
| `remediationActions` | `string` **|** `null` | Recommended remediation actions or steps to address a finding, vulnerability or weakness. This field supports markdown formatting for rich text content including links, code blocks, and structured lists. Markdown-formatted text describing remediation steps is preferred. |  |
| `remediationSLA` | `integer` **|** `null` | The number of days that the Vulnerability must be remediated within, based on SLA set by the organization's internal vulnerability management program policy. The actually due date is set by 'remediationDueOn' property on the `IMPACTS` relationship between the Vulnerability and its impacted resource entity. |  |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `score` | `number` **|** `null` | The overall vulnerability score, e.g. CVSSv3. |  |
| `status` | `string` **|** `null` | Status of the vulnerability |  |
| `stepsToReproduce` | `array` **|** `null` | Steps to reproduce this finding. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `targetDetails` | `array` **|** `null` | Additional details about the targets. Can be a string or an array. |  |
| `targets` | `array` **|** `null` | The target listing of projects, applications, repos or systems this vulnerability impacts. Specifying either the project/repo name or the application URL here will auto-map this Vulnerability to the corresponding Project/CodeRepo/Application entity if a match is found. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` **|** `null` | Indicates if this Vulnerability finding has been validated by the security team. |  |
| `vector` | `string` **|** `null` | The vulnerability attack vector. (e.g. a CVSSv3 vector looks like this - 'AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N') |  |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`
-   `severity`
-   `numericSeverity`
-   `open`

---

Source: /data-model/schemas/Procedure

# Procedure

A written procedure and control documentation. A Procedure typically `IMPLEMENTS` a parent Policy. An actual Control further `IMPLEMENTS` a Procedure.

##### Procedure properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`content` \*

 | `string` | Text content of the policy. For policies/procedures used by the Policy Builder app, this will contain the template text in markdown format. Stored in raw data. |  |
| 

`summary` \*

 | `string` | Summary or overview the describes the procedure. Summary text is intended as guidance to the author and not included in the published version. |  |
| 

`title` \*

 | `string` | Title of the procedure |  |
| `adopted` | `boolean` | Indicates if procedure has been adopted. Only adopted policies and procedures are included in the published view of the Policy Builder app. |  |
| `applicable` | `boolean` | Indicates if procedure is applicable based on the organization's current risk and compliance needs. A Policy that is not applicable may become applicable later as the organization's requirements and maturity change. |  |
| `author` | `string` | Author of the record |  |
| `control` | `string` | The type of control specified by this procedure.  
  
**Examples**: administrative, technical, physical, operational, other |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `title`
-   `summary`
-   `content`

---

Source: /data-model/schemas/Process

# Process

A compute process -- i.e. an instance of a computer program / software application that is being executed by one or many threads. This is NOT a program level operational process (i.e. a Procedure).

##### Process properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `state` | `string` | Indicates the state of the process. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Product

# Product

A product developed by the organization, such as a software product.

##### Product properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appLink` | `array` of `string`s | App links/URLs related to this product. |  |
| `category` | `string` | Category that defines the product (e.g. 'web', 'mobile'). |  |
| `description` | `string` | Description of the product |  |
| `projectKey` | `array` of `string`s | Project key(s) that reference a Jira project, Bitbucket project, or similar related to this product. |  |
| `statusPage` | `array` of `string`s | Link to the status page of this product (for a SaaS product). |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Program

# Program

A program. For example, a bug bounty/vuln disclosure program.

##### Program properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `overview` | `string` | Program overview. |  |
| `type` | `string` | The type of program. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Project

# Project

A software development project. Can be used for other generic projects as well but the defined properties are geared towards software development projects.

##### Project properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `alternateURLs` | `array` of `string`s | The additional URLs related to this application. |  |
| `devURL` | `string` | The Development URL | 
**Format**: `uri`

  
 |
| `key` | `string` | A defined project key. It is ideal for a code project to have a consistent key that matches that of issue tracking project. For example, the key for a Bitbucket project should match the key of its corresponding Jira project. |  |
| `productionURL` | `string` | The Production URL | 

**Format**: `uri`

  
 |
| `stagingURL` | `string` | The Non-Production / Staging URL | 

**Format**: `uri`

  
 |
| `testURL` | `string` | The Test URL | 

**Format**: `uri`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Question

# Question

An object that represents an inquiry, usually around some matter of uncertainty or difficulty.

##### Question properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`queries` \*

 | `array` | A request for information that contributes to answering a question. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `queries`

---

Source: /data-model/schemas/Queue

# Queue

A scheduling queue of computing processes or devices.

##### Queue properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `items` | `array` | The items (processes, devices, jobs, etc.) in the queue |  |
| `priority` | `number` | The priority of the queue |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Record

# Record

A DNS record; or an official record (e.g. Risk); or a written document (e.g. Policy/Procedure); or a reference (e.g. Vulnerability/Weakness). The exact record type is captured in the \_type property of the Entity.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/RecordEntity

# RecordEntity

A node in the graph database that represents a Record Entity, with a set of different defined common properties than standard (resource) entities.

##### RecordEntity properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Repository

# Repository

A repository that contains resources. For example, a Docker container registry repository hosting Docker container images.

##### Repository properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `public` | `boolean` | Indicates if this is a public repo. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Requirement

# Requirement

An individual requirement for security, compliance, regulation or design.

##### Requirement properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`title` \*

 | `string` | The title text of the requirement. |  |
| `state` | `string` | The state of the requirement (e.g. 'implemented'). |  |
| `summary` | `string` | The summary text of the requirement. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `title`

---

Source: /data-model/schemas/Resource

# Resource

A generic assignable resource. A resource is typically non-functional by itself unless used by or attached to a host or workload.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Review

# Review

A review record.

##### Review properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`title` \*

 | `string` | The title text of the review. |  |
| `state` | `string` | The state of the review. |  |
| `summary` | `string` | The summary text of the review. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `title`

---

Source: /data-model/schemas/Risk

# Risk

An object that represents an identified Risk as the result of an Assessment. The collection of Risk objects in JupiterOne make up the Risk Register. A Control may have a `MITIGATES` relationship to a Risk.

##### Risk properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`impact` \*

 | `integer` | Impact rating. '3: high/severe', '2: medium/moderate', '1: low/minor', '0: none/insignificant'.  
  
**Examples**: 0, 1, 2, 3 |  |
| 

`probability` \*

 | `integer` | Probability rating of the risk: '3: high/certain', '2: medium/likely', '1: low/unlikely', '0: none/negligible'.  
  
**Examples**: 0, 1, 2, 3 |  |
| 

`score` \*

 | `integer` | Overall Risk Score = Probability x Impact |  |
| 

`status` \*

 | `string` | Current status of this documented risk. Default status is `open`.  
  
**Examples**: reported, acknowledged, accepted, mitigated, prioritized, transferred, pending, open |  |
| `assessment` | `string` | The name/id of the assessment that produced this risk. |  |
| `category` | `string` | The category (or area) of the risk. For example, 'process maturity' or 'natural disaster'. |  |
| `details` | `string` | Additional details to describe the risk. |  |
| `mitigation` | `string` | Description of the mitigation, either planned or implemented, if applicable. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `probability`
-   `impact`
-   `score`
-   `status`

---

Source: /data-model/schemas/Root

# Root

The root node in the graph. There should be only one Root node per organization account.

##### Root properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `displayName` | `string` | Display name |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`

---

Source: /data-model/schemas/Rule

# Rule

An operational or configuration compliance rule, often part of a Ruleset.

##### Rule properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `category` | `string` | The category of ruleset.  
  
**Examples**: compliance, config, password, other |  |
| `content` | `string` | Contents of the rule, if applicable. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Ruleset

# Ruleset

An operational or configuration compliance ruleset with rules that govern (or enforce, evaluate, monitor) a security control or IT system.

##### Ruleset properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `category` | `string` | The category of ruleset.  
  
**Examples**: compliance, config, password, other |  |
| `content` | `string` | Contents of the raw rules, if applicable. |  |
| `rules` | `array` of `string`s | Rules of ruleset. Each rule is written 'as-code' that can be operationalized with a control provider or within JupiterOne's rules engine. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Scanner

# Scanner

A system vulnerability, application code or network infrastructure scanner.

##### Scanner properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` of `string`s | The category of scanner | **Examples**: system, network, application, other |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`

---

Source: /data-model/schemas/Secret

# Secret

A stored encrypted secret, accessed by permitted users or applications.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Section

# Section

An object to represent a section such as a compliance section.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Service

# Service

A service provided by a vendor.

##### Service properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` of `string`s | The category of service, e.g. software, platform, infrastructure, other | **Examples**: software, platform, infrastructure, physical, network, application, security, other |
| 

`function` \*

 | `array` of `string`s | The functions provided by the service, e.g. access-review, database, load-balancing, other | **Examples**: access-review, api-gateway, auditing, caching, certificate-management, config-auditing, content-distribution, container-orchestration, container-registry, compute, database, data-analytics, data-warehousing, ddos-protection, desktop-virtualization, DLP, DNS, email, encryption, file-system, IAM, indexing, key-management, kubernetes-management, load-balancing, logging, monitoring, networking, notification, password-management, provisioning, queuing, scheduling, serverless, SFTP, SIEM, storage, VAS, WAF, workflow, workload-management, other |
| `endpoints` | `array` of `string`s | Array of service endpoints, e.g. ec2.amazonaws.com |  |
| `fedrampModerate` | `boolean` | Indicates whether this service is compliant with FedRAMP Moderate |  |
| `hipaaEligible` | `boolean` | Indicates whether this service is HIPPA eligible |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`
-   `function`

---

Source: /data-model/schemas/Site

# Site

The physical location of an organization. A Person (i.e. employee) would typically has a relationship to a Site (i.e. located\_at or work\_at). Also used as the abstract reference to AWS Regions.

##### Site properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `category` | `array` of `string`s | Type of site | **Examples**: headquarters, branch, campus, office, aws-region, data-center, lab, other |
| `hours` | `string` | Hours of operation. e.g. M-F 9am-6pm |  |
| `location` | `string` | The address/location of the site. Or an AWS Region (e.g. us-east-2). |  |
| `restricted` | `boolean` | Indicates that access to the site is restricted (a level above secured access). |  |
| `secured` | `boolean` | Indicates the site is secured with physical controls such as key card access and surveillance cameras. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Standard

# Standard

An object to represent a standard such as a compliance or technical standard.

##### Standard properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`name` \*

 | `string` | The name of the standard.  
  
**Examples**: HIPAA, NIST, CSA STAR, PCI DSS, NIST CSF, FedRAMP, ISO 27001, SOC, OWASP, Other |  |
| 

`version` \*

 | `string` | The version of the standard. For example, OWASP may have version 2010, 2013, 2017. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `version`

---

Source: /data-model/schemas/Subscription

# Subscription

A subscription to a service or channel.

##### Subscription properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authenticated` | `boolean` | Indicates whether the subscription is authenticated. |  |
| `pending` | `boolean` | Indicates whether the subscription is pending. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Task

# Task

A computational task. Examples include AWS Batch Job, ECS Task, etc.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Team

# Team

A team consists of multiple member Person entities. For example, the Development team or the Security team.

##### Team properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `email` | `string` | The team email address | 
**Format**: `email`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/ThreatIntel

# ThreatIntel

Threat intelligence captures information collected from vulnerability risk analysis by those with substantive expertise and access to all-source information. Threat intelligence helps a security professional determine the risk of a vulnerability finding to their organization.

##### ThreatIntel properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `references` | `array` of `string`s | The array of links to references. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Training

# Training

A training module, such as a security awareness training or secure development training.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/User

# User

A user account/login to access certain systems and/or services. Examples include okta-user, aws-iam-user, ssh-user, local-user (on a host), etc.

##### User properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`email` \*

 | 

`array` of `string`s

**|** `null` | The primary email address associated with the user account |  |
| 

`firstName` \*

 | `string` **|** `null` | The user's official first name in the system (such as HR database) |  |
| 

`lastName` \*

 | `string` **|** `null` | The user's official last name in the system (such as HR database) |  |
| 

`shortLoginId` \*

 | 

`array` of `string`s

**|** `null` | The shortened login Id. For example, if the username is the full email address ([first.last@company.com](mailto:first.last@company.com)), the shortLoginId would be the part before @ (first.last). |  |
| 

`username` \*

 | 

`array` of `string`s

**|** `null` | Username |  |
| `active` | `boolean` | Prefer property 'isActive' | **deprecated**: true |
| `emailDomain` | 

`array` of `string`s

**|** `null` | The domain portion of the email addresses associated with the user account. |  |
| `employeeId` | `string` | The employee ID associated with the user account |  |
| `isActive` | `boolean` | Specifies whether user account is active or disabled. |  |
| `isAdmin` | `boolean` | Specifies whether the user is an admin user. |  |
| `isGuest` | `boolean` | Indicates whether the user is a guest is the system. A guest user is often a user outside of the organization who has limited or temporary access to the system. |  |
| `isMfaEnabled` | `boolean` | Specifies whether multi-factor authentication (MFA) is enabled for this user. |  |
| `isPerson` | `boolean` | Specifies whether the user is a person or a non-human identity. |  |
| `mfaEnabled` | `boolean` | Prefer property 'isMfaEnabled' | **deprecated**: true |
| `mfaType` | `string` | Specifies what type of multi-factor authentication (MFA) is being used by this user. |  |
| `passwordChangedOn` | `number` | The timestamp (in milliseconds since epoch) of when the user's password was last rotated for this particular account. | 

**Format**: `date-time`

  
 |
| `userIds` | `array` of `string`s | The user IDs associated with the user account | **uniqueItems**: true, |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `firstName`
-   `lastName`
-   `email`
-   `shortLoginId`
-   `username`

---

Source: /data-model/schemas/UserGroup

# UserGroup

A user group, typically associated with some type of access control, such as a group in Okta or in Office365. If a UserGroup has an access policy attached, and all member Users of the UserGroup would inherit the policy.

##### UserGroup properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `email` | `string` | The group email address | 
**Format**: `email`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Vault

# Vault

A collection of secrets such as a key ring

##### Vault properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`name` \*

 | `string` | Name of the vault |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Vendor

# Vendor

An external organization that is a vendor or service provider.

##### Vendor properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `array` | The category of vendor.  
  
**Examples**: business-operations, cloud, facilities, finance, infrastructure, legal, purchasing, security, software, platform-development, platform-social-media, professional-services-staffing, professional-services-recruiting, professional-services-consulting, generic-service-provider, generic-subscription, CSP, ISP, MSP, MSSP, IdP, other |  |
| `admins` | `array` of `string`s | List of admin users to the vendor account, if applicable. If this vendor account is integrated directly to JupiterOne and its data is ingested, the admin users should be already mapped as User entities. |  |
| `alternateContactAddress` | `string` | Alternate/secondary physical/mailing address of the vendor. |  |
| `alternateContactEmail` | `string` | Email of the vendor's alternate/secondary point of contact person. | 

**Format**: `email`

  
 |
| `alternateContactName` | `string` | The vendor's alternate/secondary point of contact person. |  |
| `alternateContactPhone` | `string` | Phone number of the vendor's alternate/secondary point of contact person. |  |
| `alternateContactTitle` | `string` | The title of the vendor's alternate/secondary point of contact. For example, 'CISO'. |  |
| `breachResponseDays` | `integer` | The number of days the vendor agrees to report an identified data breach, per vendor agreement and/or SLA. This is typically 3 to 30 days. Note that GDPR requires breach notification within 3 days / 72 hours. |  |
| `departments` | `array` of `string`s | List of business departments the vendor provides service for (e.g. IT, HR, Finance, Marketing, Development/Engineering, Security). |  |
| `emailDomain` | `string` | The email domain for the vendor (e.g. @jupiterone.io). |  |
| `linkToBAA` | `string` | Link to Business Associate Agreement (BAA) document - for HIPAA only. | 

**Format**: `uri`

  
 |
| `linkToDPA` | `string` | Link to GDPR Data Processing Addendum (DPA) document - for GDPR only. | 

**Format**: `uri`

  
 |
| `linkToISA` | `string` | Link to the external information security assessment (ISA) report. | 

**Format**: `uri`

  
 |
| `linkToMSA` | `string` | Link to Master Service Agreement (MSA) document. | 

**Format**: `uri`

  
 |
| `linkToNDA` | `string` | Link to Non-Disclosure Agreement (NDA) document. | 

**Format**: `uri`

  
 |
| `linkToSLA` | `string` | Link to Service Level Agreement (SLA) document. | 

**Format**: `uri`

  
 |
| `linkToVTR` | `string` | Link to the external vendor technology risk (VTR) report. | 

**Format**: `uri`

  
 |
| `mainContactAddress` | `string` | Main physical/mailing address of the vendor. |  |
| `mainContactEmail` | `string` | Email of the vendor's point of contact person. | 

**Format**: `email`

  
 |
| `mainContactName` | `string` | The vendor's point of contact person. |  |
| `mainContactPhone` | `string` | Phone number of the vendor's point of contact person. |  |
| `mainContactTitle` | `string` | The title of the vendor's main point of contact. For example, 'Manager of Operations'. |  |
| `statusPage` | `string` | Link to the vendor's service status page (e.g. [https://status.aws.amazon.com/](https://status.aws.amazon.com/)). | 

**Format**: `uri`

  
 |
| `validatedOn` | `number` | The timestamp (in milliseconds since epoch) of when this vendor was last validated per the vendor management policy. | 

**Format**: `date-time`

  
 |
| `website` | `string` | The vendor's main website URL. | 

**Format**: `uri`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`

---

Source: /data-model/schemas/Vulnerability

# Vulnerability

A security vulnerability identified by a Common Vulnerabilities and Exposures (CVE) identifier. A single vulnerability may relate to multiple findings and impact multiple resources. The IMPACTS relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The IMPACTS relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc.

##### Vulnerability properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cveId` \*

 | `string` **|** `null` | The Common Vulnerabilities and Exposures (CVE) identifier of the vulnerability as a string, formatted exactly as CVE-YYYY-NNNN (where YYYY is the 4-digit year and NNNN is a sequence of at least 4 digits). This field must contain only the CVE ID with no additional text or details. For example, CVE-2021-44228 is valid, but CVE-2021-44228 (YOKOGAWA) is invalid. |  |
| 

`open` \*

 | `boolean` **|** `null` | Indicates whether the CVE vulnerability is currently open (unresolved) against the entity. This boolean field is true when the vulnerability is active and false when it is resolved or no longer applicable. If the open status is not provided, it defaults to true. | **default**: true |
| `blocking` | `boolean` **|** `null` | Indicates whether this vulnerability finding is a blocking issue. If true, it should block a production deploy. Defaults to false. | **default**: false |
| `category` | `string` **|** `null` | The category of the vulnerability finding  
  
**Examples**: application, system, infrastructure, other |  |
| `exploitability` | `number` **|** `null` | The exploitability score/rating. |  |
| `impact` | `number` **|** `null` | The impact score/rating. |  |
| `impacts` | `array` **|** `null` | The target listing of projects, applications, repos or systems this vulnerability impacts. Specifying either the project/repo name or the application URL here will auto-map this Vulnerability to the corresponding Project/CodeRepo/Application entity if a match is found. |  |
| `priority` | `string` **|** `null` | Priority level mapping to Severity rating. Can be a string such as 'critical', 'high', 'medium', 'low', 'info'. Or an integer usually between 0-5. |  |
| `production` | `boolean` **|** `null` | Indicates if this vulnerability is in production. |  |
| `public` | `boolean` **|** `null` | Indicates if this is a publicly disclosed vulnerability. If yes, this is usually a CVE and the 'webLink' should be set to '[https://nvd.nist.gov/vuln/detail/$\\{CVE-Number\\}](https://nvd.nist.gov/vuln/detail/$%5C%7BCVE-Number%5C%7D)' or to a vendor URL. If not, it is most likely a custom application vulnerability. |  |
| `references` | `array` **|** `null` | The array of links to references. |  |
| `remediationSLA` | `integer` **|** `null` | The number of days that the Vulnerability must be remediated within, based on SLA set by the organization's internal vulnerability management program policy. The actually due date is set by 'remediationDueOn' property on the `IMPACTS` relationship between the Vulnerability and its impacted resource entity. |  |
| `score` | `number` **|** `null` | The overall vulnerability score, e.g. CVSSv3. |  |
| `severity` | `string` **|** `null` | Severity rating based on impact and exploitability. Can be a string such as 'critical', 'high', 'medium', 'low', 'info'. Or an integer usually between 0-5. |  |
| `status` | `string` **|** `null` | Status of the vulnerability |  |
| `validated` | `boolean` **|** `null` | Indicates if this Vulnerability finding has been validated by the security team. |  |
| `vector` | `string` **|** `null` | The vulnerability attack vector. (e.g. a CVSSv3 vector looks like this - 'AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N') |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `open`
-   `cveId`

---

Source: /data-model/schemas/Weakness

# Weakness

A security weakness identified by a Common Weakness Enumeration (CWE) identifier.

##### Weakness properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cweId` \*

 | `string` **|** `null` | The Common Weakness Enumeration (CWE) identifier of the weakness as a string formatted exactly as CWE-NNN, where NNN is one or more digits. This field must contain only the CWE ID with no additional text or context. For example, CWE-117 is valid, but 'cwe-117: FeedbackSubmit.java (Line: 142)' is invalid. |  |
| 

`open` \*

 | `boolean` | Indicates whether the CWE weakness is currently open (unresolved) against the entity. This boolean field is true when the weakness is active and false when it is resolved or no longer applicable. If the open status is not provided, it defaults to true. | **default**: true |
| `category` | `string` | The category of the vulnerability finding  
  
**Examples**: application, system, infrastructure, other |  |
| `exploitability` | `string` | Indicates the likelihood of exploit. |  |
| `references` | `array` of `string`s | The array of links to references. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `open`
-   `cweId`

---

Source: /data-model/schemas/Workflow

# Workflow

A workflow such as an AWS CodePipeline, GitHub repository workflow, or Apache Airflow.

##### Workflow properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`name` \*

 | `string` | Name of the workflow |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Workload

# Workload

A virtual compute instance, it could be an aws-ec2-instance, a docker-container, an aws-lambda-function, an application-process, or a vmware-instance. The exact workload type is described in the \_type property of the Entity.

##### Workload properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `fqdn` | `string` | The fully qualified domain name of attached to the instance, if applicable |  |
| `image` | `string` | The image this workload is derived from, such as an AMI or docker image. At the abstract level, this usually maps to the \_id of a Resource. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /features/admin/access-controls

# Role-Based Access Control (RBAC)

## Table of Contents

-   [Overview](#overview)
-   [Components of RBAC](#components-of-rbac)
    -   [Data Layer RBAC](#data-layer-rbac)
    -   [Resource RBAC](#resource-rbac)
    -   [App Level Permissions](#app-level-permissions)
-   [Managing User Groups](#managing-user-groups)
-   [Troubleshooting](#troubleshooting)

## Overview

JupiterOne provides a comprehensive role-based access control (RBAC) system that allows administrators to manage user access across the platform. The system is designed to provide granular control over:

-   What data users can access
-   What resources they can manage
-   What features they can use

> **NOTE**
> 
> All JupiterOne accounts have access to RBAC features. The system is designed to be flexible enough to support both simple and complex permission requirements.

## Components of RBAC

The RBAC system consists of three main components that work together to provide comprehensive access control:

1.  **Data Layer RBAC** - Controls what data users can access when writing J1QL queries or viewing dashboards
2.  **Resource RBAC** - Manages CRUD permissions for major resource types (Integrations, Rules, Dashboards)
3.  **App Level Permissions** - Controls read/write access to application components

### Data Layer RBAC

Data Layer RBAC allows administrators to restrict what data users can access when writing J1QL queries or viewing dashboards. This is configured through query policies that filter data based on:

-   Entity class
-   Entity type
-   Integration class
-   Integration type
-   Any other properties that are queryable on an entity

> **NOTE**
> 
> Currently, Data Layer RBAC is not enforced within:
> 
> -   The Rule feature (specifically rule alert results)
> -   The Trend Widgets feature (specifically results shown in trend widgets)
> -   The Questions feature
> 
> It is recommended to use Resource RBAC to restrict users from creating trend widgets, alert rules, and questions if they should not have access to sensitive data within JupiterOne.

To configure Data Layer RBAC:

1.  Go to **Settings** (the gear icon) **\>** **User Groups**
2.  Select the user group you want to edit
3.  In the Query Policy section, select and add the query type and values for each filter and click **Add**

![Configure Data Layer RBAC](/assets/images/data-layer-rbac-a62299730ebc149fb42f28041a2b15a2.png)

![Data Layer RBAC Query Policy Configuration](/assets/images/data-layer-rbac-query-policy-4ac5b560ce71557c2e27be56da65d34f.png)

If you want to set up queries based on sets of filters that you want to then link by OR logic, create separate permission sets.

### Resource RBAC

Resource RBAC allows administrators to manage CRUD (Create, Read, Update, Delete) permissions for major resource types within JupiterOne:

-   Alerts
-   Collectors
-   Dashboards
-   Integrations
-   Control Frameworks
-   Controls

> **NOTE**
> 
> Resource RBAC has no impact on Data Layer RBAC for resource management. For example, if a user has Resource RBAC permissions to manage an integration, they will be able to do so regardless of their Data Layer RBAC settings.

#### Resource Groups

Resources can be organized into resource groups for easier permission management. A resource group is a collection of resources that logically belong together to meet a specific use case.

![Resource Groups](/assets/images/resource-groups-eaf47541c968e57c4ae3bb7a67a764b6.png)

> **NOTE**
> 
> -   A resource can only be part of a single resource group
> -   Multiple groups can have access to that resource group
> -   _No Resource Group_ is not a resource group itself. You cannot give a group access to all resources that do not have a resource group. You can, however, create a resource group called 'General', and assign resources to that group.

#### Resource RBAC Permissions

You can manage RBAC permissions at the user group level in the settings app. Below are some common use cases:

##### Resource Group Admin

This group can create, read, update, and delete resources within a single resource group.

![Resource Group Admin](/assets/images/resource-group-admin-ffb4e0bd0efba75682c6afb5a88c1735.png)

##### Resource Group Readonly

This group can read resources within a single resource group, but cannot create or update resources. This user will have read access to all future resources that are created within this resource group.

![Resource Group Readonly](/assets/images/resource-group-readonly-2e2bc790bb19d49a71d072a72bbab497.png)

##### Resource Area Admin

This group can read, update, and delete **all** resources as well as create resources within any resource group. They can also create resources outside of resource groups.

![Resource Area Admin](/assets/images/resource-area-admin-dc3a6f8f05207f8cabe11a0937dac8c6.png)

##### Granular Resource Access

This is a group that has access to only a few specific resources. This group cannot create resources because only a resource area admin can create resources outside of resource groups.

![Granular Resource Access](/assets/images/granular-resource-7e2244d3f8bc8620d986c8ce53d552d2.png)

> **NOTE**
> 
> We recommend staying away from granular resource access unless it is very limited in scope. Managing access this way, without resource groups, can become very cumbersome and runs into some system limitations that are set in place.

### App Level Permissions

App Level Permissions manage read and write access to application components that do not currently support Resource RBAC. Each app has two permission levels:

-   **Read-only** - Allows viewing and using the app's features
-   **Admin** - Allows all actions including administrative functions

![App Level Permissions](/assets/images/app-level-permissions-1f5b0a4fc1d49374b79ae73680fa29b3.png)

> **NOTE**
> 
> Admin permissions will allow all actions included in the Read-only permissions for each app.

#### Global Shared Permissions

Some permissions are not bound to a specific app but are relevant to resources that span different apps:

-   **Graph Data** - Used anywhere entity and relationship data is retrieved on demand or when entities/relationships are mutated directly
-   **Questions** - Saved J1QL queries used in the Home page Questions Library and in app for mapping to compliance requirements

> **NOTE**
> 
> The Graph Data permission does not completely restrict the ability to query graph data. You should limit access to graph data through Data Layer RBAC described above.

#### App List and Required Permissions

The following apps are available, along with shared permissions that may be used by features in each app:

> **NOTE**
> 
> You may see a subset of these apps in your settings based on your account subscription level.

-   **Home Page** (the base/root page - `/home`)
    
    > Shared permissions used by this app: **Read / Write Questions** and **Read Graph Data** for access to Questions Library and running J1QL queries respectively. Optionally **Write Graph Data** for editing entities from query results.
    
-   **Assets** (URL ending with `/assets`)
    
    > Shared permissions used by this app: **Read / Write Graph Data** (app is unusable without Read Graph Data, Write Graph Data used for editing entities).
    
-   **Policies** (URL ending with `/policies`)
    
    > Shared permissions used by this app: **Read Graph Data** for loading the policy elements and raw data, and **Write Graph Data** for saving changes to the policy entities.
    
-   **Compliance** (URL ending with `/compliance`)
    
    > Shared permissions used by this app: **Read Graph Data** for expanding queries used as evidence to view results, **Read / Write Questions** for editing the questions used in this app.
    
-   **Vulnerabilities** (URL ending with `/vulnerabilities`)
    
    > Shared permissions used by this app: **Read Graph Data** (the app shows empty tables without it) and **Write Graph Data** for changing vulnerability lifecycle states. See [Unified Vulnerability Management permissions](/features/vulnerability-management/permissions.md) for the permissions required by each action.
    
-   **Shared: Graph Data**
    
    > Shared permissions used by this app: **Read Graph Data**. App will not function without this permission as it is focused on graph exploration.
    
-   **Shared: Questions**
    
    > Shared permissions used by this app: **Questions**. This gives users access to the question library in JupiterOne.
    

## Managing User Groups

### Creating User Groups

1.  Navigate to the **Settings** menu (the cog icon next to notifications)
2.  Click on **User groups** in the **Admin** section
3.  From the new window select **New group**
4.  Enter the desired **Group name** and **Group description**, and click **Create**
5.  You will be navigated to the Group's **Details** page. From here, you can customize:
    -   Data Layer RBAC policies
    -   Resource RBAC permissions
    -   App Level Permissions
6.  Lastly, to add users to the group, navigate to the Group Members tab and select **Add Member**

![Create and edit user groups within JupiterOne](/assets/images/group-create-edit-f1afdf764efc8ecf48c258309b510e54.png)

### Editing User Groups

1.  Navigate to **Settings > User Groups**
2.  Select the user group from the menu that you wish to edit
3.  Make your desired changes in the Details and/or Group Members sections
4.  Press **Save group**

> **NOTE**
> 
> Changes made to members are saved immediately, only changes made to the user group's details section will need to be manually saved with the Save button. You can also revert accidental changes to a user group by pressing **Reset**.

### Switching User Group Views

Users can be members of multiple groups. You can switch between groups to utilize different permission sets:

1.  Select the profile icon in the side nav
2.  Choose the group listed under **User groups**

![Choosing user permission group in JupiterOne](/assets/images/role-based-changes-13cdfc642119d6a4c91e4d6237db4250.png)

> **NOTE**
> 
> When "All Permissions" is selected, permissions across groups are 'rounded up'. For example, if a user is part of the Administrator group, their edit access from that group would override view permissions in any other group they may be a part of. To swap to the read-only view, they would need to choose a particular group.

## Troubleshooting

### Common Issues

1.  **Users Can't Access Expected Resources**
    
    -   Check if the user is in the correct group
    -   Verify Data Layer RBAC policies are correctly configured
    -   Ensure resource groups are properly assigned
2.  **Resource Group Problems**
    
    -   Confirm resources are assigned to the correct group
    -   Check if resources can only be in one group
    -   Verify group access permissions are properly set

### Getting Help

If you encounter issues with RBAC configuration consult with your JupiterOne account representative

---

Source: /features/admin/admin-settings

# Admin settings

In addition to account settings, JupiterOne workspace admins have additional configuration settings available to them to manage and organize their JupiterOne workspace.

All of the Admin settings can be found in the **Admin** panel in the **Settings** menu (the cog icon) in the top-right of the window.

From within the Admin panel, you can access:

-   Account management
-   Users
-   User groups
-   Security & access
-   Account API tokens
-   Account parameters
-   User API tokens
-   Organizational units
-   Resource groups
-   Audit events
-   Data streaming

### Account Management

The Account Management section provides an overview of your JupiterOne Workspace's account. Here you can find your account usage details, including the breakdown of total entities and billable entities.

![Account Usage graph and billable entity count on JupiterOne](/assets/images/billable-entities-31eb463529f27fc74494c229e8c174a8.png)

You can also access the following information relating to your workspace:

-   Company Logo URL (editable)
-   Display Name (editable)
-   Vanity URL
-   Account ID
-   Owner

### Users

Within the Users section, you can review all current workspace users and manage user access.

#### Invite users

You can invite new users to your JupiterOne workspace by selecting **Invite user**. Provide their email and select the corresponding user group for which you would like them to have access, and click **Send invitation**.

#### Review pending invitations

In addition to inviting new users, you can review outstanding invitations from the Users section. If there are pending invitations, they will be displayed above the User list as illustrated below.

![Pending invites in the JuptierOne Admin User&#39;s section](/assets/images/pending-invites-ca3db719333f76d2be1fd3ec3481664a.png)

Select **Review invitations** within the notification to view the pending invitations. Within the new window, you will find the group member email and invitation send date.

**To revoke an invitation**, click the revoke button next to the invite.

### User groups

From the User Groups tab, you are able to create and manage the user groups within your JupiterOne workspace.

You can find detailed [documentation covering user access and groups here](/features/admin/access-controls.md).

### Security & Access

There are several options for managing your workspace's Access and Security to your JupiterOne workspace.

From within the Security & Access section, you can:

-   **Control Domain Access**: Restrict user workspace access to only allow user emails with particular whitelisted domains.
-   Configure an **IP allowlist**: Restrict the account to a set of source IP addresses, rejecting web app and API traffic from anywhere else. [Read more about the IP allowlist →](/features/admin/ip-allowlist.md)
-   Specify the **Default User Groups**: this determines the user groups inherited by default for all new users that are added to the JupiterOne workspace.
-   Enable **Single Sign On (SSO)** [Read more about enabling SSO →](/features/admin/saml-sso.md)
-   Enable **Require MFA for non-SSO users**: this requires users that are able to log in with email and password to enroll an Authenticator app to access the JupiterOne workspace.
-   Configure an **Inactivity Timeout**: as an added security measure, you can automatically log users out after a period of inactivity. When a user's session is idle for longer than the configured duration, they are signed out of the JupiterOne workspace and must log in again.
-   Set the **User API token expiration**: define an account-wide maximum lifetime for personal User API Tokens. The limit applies only to newly created tokens—users cannot create a token that expires beyond it, and the create-token dialog caps the expiration accordingly. Existing tokens are unaffected and keep their original expiration. Leaving this unset (or set to no limit) allows tokens up to the standard one-year maximum.

### Account API Tokens

You can manage account-wide API Tokens by navigating to **Settings > Admin > Account API Tokens**. From here, you are able to access, create, and remove API Tokens for your JupiterOne workspace.

Additionally, within this window, JupiterOne displays am API Consumption graph that tracks the total number of invocations on a daily basis.

### Account Parameters

Account parameters allow you to configure and store lengthy values as variables for use within queries and rules. Defining parameters enables users in your JupiterOne workspace to utilize those parameters as shorthand reference to a particular value when querying or creating alerts. [Read more about Parameter configuration here →](/features/admin/parameters.md)

### User API Tokens

Much like Account API Tokens, JupiterOne Admin have the ability to review personal User API Tokens for all users within their JupiterOne workspace. From User Tokens in the Admin panel, you can review and remove all personal API Tokens that have been created by users in your JupiterOne workspace.

---

Source: /features/admin/askj1-ai

# Natural Language search

> **INFO**
> 
> This page has moved. JupiterOne AI capabilities, including natural language search, are now documented in the [JupiterOne AI](/features/jupiterone-ai.md) section.
> 
> For natural language search specifically, see [Natural language search](/features/jupiterone-ai/ai-capabilities.md#natural-language-search).

---

Source: /features/admin/data-streaming

# Data Streaming (J1DS)

JupiterOne Data Streaming (J1DS) streams entity and relationship changes from your JupiterOne graph to an Amazon S3 bucket, giving you real-time access to your data changes outside JupiterOne.

## How it Works

J1DS captures the graph database transaction logs, gathers the change events, and writes those events to your configured AWS S3 bucket. These events represent the "after" state of any change made to an Entity or Relationship in the graph. The events can be Create, Update, or Delete events.

## Requirements

-   A JupiterOne account with the J1DS entitlement
-   Administrator access to your JupiterOne account
-   An Amazon S3 bucket in the required AWS region (shown in the Data Streaming settings page)
-   Your 12-digit AWS Account ID
-   The S3 bucket name

## Configuring Your S3 Bucket Policy

Before enabling data streaming, you must add a bucket policy to your S3 bucket that grants JupiterOne write access. Without this policy, the **Test Connection** step will fail.

The **S3 Bucket Policy** panel on the Data Streaming settings page provides a ready-to-use policy with the correct AWS account ID and role already filled in for your environment. Copy the policy from that panel and replace `<BUCKET_NAME>` with the name of your S3 bucket.

> **INFO**
> 
> The role name `jupiterone-data-streaming` is the same for all deployments — do not change it. This policy grants JupiterOne **write-only** access (`s3:PutObject`) to the `jupiterone/*` prefix in your bucket and requires encrypted transport.

## Enabling Data Streaming

1.  Navigate to **Settings > Data Streaming**.
2.  Review the **Setup Instructions** panel on the right — it shows the required AWS region for your S3 bucket.
3.  Copy the bucket policy from the **S3 Bucket Policy** panel and apply it to your S3 bucket.
4.  Check **Enable integration**.
5.  Enter your **S3 Bucket Name**.
6.  Enter your **AWS Account ID** (12 digits).
7.  Check the region confirmation checkbox to confirm your S3 bucket is in the required region.
8.  Click **Test Connection** — the test must succeed before you can save.
9.  Click **Save**.

> **NOTE**
> 
> You must successfully run **Test Connection** before saving for the first time. The Save button is not enabled until the connection test passes.

## What Happens When You Enable Data Streaming

-   JupiterOne begins capturing changes to entities and relationships in your graph.
-   Changes are streamed to your S3 bucket every few minutes (typically every 5–15 minutes). If there are no new changes, no data is written.
-   Only changes from the point of enablement forward are captured — there is no historical backfill.

## Data Partitioning

Data in your S3 bucket uses the following path structure:

```text
jupiterone/graph/cdc/accountId=<JUPITERONE_ACCOUNT_ID>/year=<YEAR>/month=<MONTH>/day=<DAY>/time=<TIME_UTC>.jsonl
```

Each `.jsonl` file is gzip compressed and contains newline-delimited JSON records of change events since the last export. This partitioning scheme works well with standard discovery tools (e.g. AWS Glue crawler) and allows customers with multiple JupiterOne accounts to collect data into a single target bucket.

> **INFO**
> 
> J1DS also writes to `jupiterone/.connection-test`, which is used to test connectivity from the JupiterOne platform to your S3 bucket.

## Data Format

Each record represents the "after" state of a graph object following a change. Example:

```json
{
    "operation": "u",
    "eventType": "entity",
    "properties": {
        "_scope": "eb4f2fac-e9a1-474d-8859-5f0e5ef90b16",
        "_source": "integration-managed",
        "_key": "slack-user:team_T0129XXXXXX:user_U09B1XXXXXX",
        "_accountId": "j1dev",
        "_type": "slack_user",
        "_class": ["User"],
        "_id": "3e6fa6e5-158d-5f03-8839-a964652b57dc",
        "_deleted": false,
        "_version": 1,
        "_createdOn": 1755879780646,
        "_beginOn": 1759510655079,
        "username": "some.user",
        "email": "some.user@example.com",
        "displayName": "Some User",
        "active": true
    },
    "labels": ["Entity", "User", "slack_user"]
}
```

-   `eventType` — `entity` or `relationship`
-   `operation` — `c` (create), `u` (update), or `d` (delete)
-   `properties` — the full set of properties for the object after the change
-   `labels` — the graph labels (classes and type) for the object

## Security

-   When configuring J1DS you must provide the bucket name **and** the AWS account that the bucket belongs to. J1DS uses the `expected bucket owner` mechanism when writing, which mitigates S3 bucket hijacking.
-   The bucket policy grants **write-only** access — J1DS cannot read data from your bucket.
-   All data transfer requires encrypted transport (`aws:SecureTransport`).

## Disabling Data Streaming

1.  Navigate to **Settings > Data Streaming**.
2.  Uncheck **Enable integration**.
3.  Click **Save**.

Streaming stops and no new data is written to your bucket. Existing data in your S3 bucket is not affected or deleted.

## Re-enabling Data Streaming

> **WARNING**
> 
> Re-enabling data streaming starts fresh. Changes that occurred while streaming was disabled are **not** retroactively captured. Only new changes going forward will be streamed.

To re-enable, follow the same steps described in [Enabling Data Streaming](#enabling-data-streaming).

## Known Limitations

1.  Data is written on a best-efforts basis and is designed for "at most once" delivery. The system is tolerant to transient failures but cannot buffer transactions indefinitely.
2.  S3 managed KMS encryption is supported. The `PutObject` calls made by J1DS (including multipart uploads) work with S3 managed KMS encryption keys.

---

Source: /features/admin/data-streaming-athena-queries

# Querying J1DS Data in Amazon Athena

This page walks through deploying an AWS Glue and Athena infrastructure stack on top of your J1DS S3 bucket and running three SQL query patterns against your JupiterOne entity and relationship change history.

For instructions on enabling J1DS and configuring your S3 bucket, see [Data Streaming (J1DS)](/features/admin/data-streaming.md).

## Prerequisites

-   AWS account with permissions to create CloudFormation stacks, Glue databases and tables, Athena workgroups, S3 buckets, and IAM roles
-   AWS CLI v2 installed and configured with credentials for your target account
-   J1DS enabled and streaming to an S3 bucket (see [Data Streaming (J1DS)](/features/admin/data-streaming.md) for setup)
-   The S3 bucket name where J1DS is writing data

## Deploy the Stack

**1\. Download the CloudFormation template:**

[Download the CloudFormation template](/assets/files/j1ds-athena-setup-fcf675926654923f4ab9c25c6dc51a51.yaml)

**2\. Deploy the stack:**

```bash
aws cloudformation deploy \
  --template-file j1ds-athena-setup.yaml \
  --stack-name j1ds-usage-example \
  --parameter-overrides \
    SourceBucketName=YOUR_BUCKET_NAME \
  --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM
```

Replace `YOUR_BUCKET_NAME` with your J1DS S3 bucket name.

**3\. Note the stack outputs** — the deploy command prints the Glue database name (`j1ds-usage-example-cdc`) and Athena WorkGroup name (`j1ds-usage-example`). These values appear in every query.

## Verify the Deployment

Run a COUNT query in the Athena console to confirm data is accessible. Open the [Amazon Athena console](https://console.aws.amazon.com/athena/), select the `j1ds-usage-example` workgroup, and run:

```sql
SELECT COUNT(*) FROM "j1ds-usage-example-cdc".entities
WHERE accountid = 'YOUR_ACCOUNT_ID'
  AND year = 2026 AND month = 3;
```

Replace `YOUR_ACCOUNT_ID` with your JupiterOne account ID and adjust `year`/`month` to the current period.

**Expected:** a non-zero row count. If the result is zero, verify that J1DS is streaming (check your S3 bucket for recent `.jsonl.gz` files) and that the `year`/`month` values match files present in the bucket.

> **INFO**
> 
> The `accountid` partition filter is **required** for all queries. Omitting it causes an Athena error, not an empty result — the table uses an injected partition projection that requires a caller-supplied value.
> 
> This is especially important if you stream multiple JupiterOne accounts (e.g., dev and prod) into the same CDC bucket. Each account's data is stored under a separate `accountId=` partition, so the `accountid` filter ensures your query returns results for a single account.

## CDC Schema Reference

### Record Structure

Every row in the `entities` and `relationships` tables corresponds to one CDC event:

| Field | Column | Type | Values |
| --- | --- | --- | --- |
| operation | `operation` | string | `c` (create), `u` (update), `d` (delete) |
| eventType | `eventtype` | string | `entity` or `relationship` |
| properties | `properties` | string (JSON) | JSON blob — access with `json_extract_scalar()` |
| labels | `labels` | array<string> (entities) / string (relationships) | Entity: `["Entity","User","slack_user"]` / Relationship: `"HAS"` |

### Key Properties Fields

The `properties` column is a raw JSON string. Use `json_extract_scalar()` to access individual fields:

| Field | Access Pattern | Description |
| --- | --- | --- |
| `_id` | `json_extract_scalar(properties, '$._id')` | Stable UUID — the entity or relationship identifier |
| `_type` | `json_extract_scalar(properties, '$._type')` | Provider-specific type, e.g., `slack_user`, `aws_s3_bucket` |
| `_class` | `json_extract_scalar(properties, '$._class')` | Abstract class, e.g., `User`, `DataStore` |
| `_beginOn` | `CAST(json_extract_scalar(properties, '$._beginon') AS BIGINT)` | Epoch milliseconds when this version became current |
| `displayName` | `json_extract_scalar(properties, '$.displayName')` | Human-readable name |

## Query: Entity History

Use this query to audit all state changes to a specific entity over time. It returns every CDC event for a single entity ID, ordered chronologically. Replace `YOUR_ENTITY_ID` with the `_id` value of the entity you want to audit.

```sql
SELECT
    year,
    month,
    day,
    operation,                                              -- c=create, u=update, d=delete
    eventtype,                                              -- always 'entity' in this table
    json_extract_scalar(properties, '$._id')          AS entity_id,
    json_extract_scalar(properties, '$._type')        AS entity_type,
    json_extract_scalar(properties, '$._class')       AS entity_class,
    json_extract_scalar(properties, '$.displayName')  AS display_name,
    properties
FROM "j1ds-usage-example-cdc".entities
WHERE accountid = 'YOUR_ACCOUNT_ID'                        -- REQUIRED: injected partition
  AND year  = 2026                                         -- narrow partition range
  AND month = 3                                            -- to reduce bytes scanned
  AND json_extract_scalar(properties, '$._id') = 'YOUR_ENTITY_ID'  -- replace with your entity _id
ORDER BY year, month, day;
```

### Example Output

| year | month | day | operation | entity\_type | entity\_class | display\_name |
| --- | --- | --- | --- | --- | --- | --- |
| 2026 | 3 | 17 | c | slack\_user | User | Alice Johnson |
| 2026 | 3 | 18 | u | slack\_user | User | Alice Johnson |
| 2026 | 3 | 19 | u | slack\_user | User | Alice J. |

## Query: Latest State Snapshot

Use this query to get the current state of all entities in your account — one row per entity, deduplicated to the most recent version. It uses `MAX_BY` to select the properties blob with the highest `_beginon` timestamp for each entity ID.

```sql
SELECT
    json_extract_scalar(latest_properties, '$._id')         AS entity_id,
    json_extract_scalar(latest_properties, '$._type')       AS entity_type,
    json_extract_scalar(latest_properties, '$._class')      AS entity_class,
    json_extract_scalar(latest_properties, '$.displayName') AS display_name,
    latest_properties                                       AS properties
FROM (
    SELECT
        MAX_BY(properties, CAST(json_extract_scalar(properties, '$._beginon') AS BIGINT)) AS latest_properties
    FROM "j1ds-usage-example-cdc".entities
    WHERE accountid = 'YOUR_ACCOUNT_ID'                    -- REQUIRED: injected partition
      AND year  = 2026                                     -- filter to recent data
      AND month = 3                                        -- to control scan cost
      AND json_extract_scalar(properties, '$._beginon') IS NOT NULL  -- guard against missing _beginon
    GROUP BY json_extract_scalar(properties, '$._id')
)
ORDER BY entity_type, display_name;

-- NOTE: _beginon is epoch milliseconds stored as a JSON number.
-- CAST to BIGINT is required for correct MAX_BY ordering (not lexicographic).
-- operation: c=create, u=update, d=delete
```

### Example Output

| entity\_id | entity\_type | entity\_class | display\_name |
| --- | --- | --- | --- |
| a1b2c3d4-... | aws\_s3\_bucket | DataStore | my-data-bucket |
| d4e5f6a7-... | slack\_user | User | Alice Johnson |

## Query: Change Detection

Use this query to see what changed in your account over a time window, grouped by day, operation type, and entity type. Adjust the `day BETWEEN` range to scope the window you want to examine.

```sql
SELECT
    year,
    month,
    day,
    operation,                                              -- c=create, u=update, d=delete
    json_extract_scalar(properties, '$._type')        AS entity_type,
    COUNT(*)                                           AS change_count
FROM "j1ds-usage-example-cdc".entities
WHERE accountid = 'YOUR_ACCOUNT_ID'                        -- REQUIRED: injected partition
  AND year  = 2026
  AND month = 3
  AND day   BETWEEN 1 AND 7                                -- replace with your window
GROUP BY year, month, day, operation,
         json_extract_scalar(properties, '$._type')
ORDER BY year, month, day, operation;

-- TIP: To compare two windows, wrap each as a subquery and LEFT JOIN on entity_type,
-- or use EXCEPT to find entity types that appeared only in one window.
-- eventtype is always 'entity' in this table (use relationships table for relationship changes).
```

### Example Output

| year | month | day | operation | entity\_type | change\_count |
| --- | --- | --- | --- | --- | --- |
| 2026 | 3 | 1 | c | aws\_iam\_role | 12 |
| 2026 | 3 | 1 | u | slack\_user | 45 |
| 2026 | 3 | 2 | c | aws\_s3\_bucket | 3 |

## Cost and Performance Notes

> **NOTE**
> 
> -   Athena charges **$5 per TB scanned**
> -   All queries include partition filters (`accountid`, `year`, `month`) to minimize scan scope
> -   The WorkGroup enforces a **10 GB per-query cutoff** (~$0.05 maximum per query)
> -   Typical per-query cost for a single account's daily data: **under $0.01**
> -   Adding `day` filters (e.g., `AND day BETWEEN 1 AND 7`) reduces scanned data further

---

Source: /features/admin/ip-allowlist

# IP allowlist

The IP allowlist restricts your JupiterOne account to a set of source IP addresses that you define. Once enabled, requests coming from any other address are rejected.

The allowlist applies to the whole account, not to individual users or groups. It is configured by account admins in **Settings > Admin > Security & Access**.

> **NOTE**
> 
> The allowlist is an access control, not a network boundary. It does not make JupiterOne unreachable from other addresses — it means requests from those addresses are refused.

## What the allowlist blocks

When the allowlist is enabled, JupiterOne checks the source IP of every authenticated request against your entries and rejects anything that does not match. This covers:

-   **Web app usage.** Every action a user takes in the JupiterOne app.
-   **API and SDK traffic.** Anything authenticated with a JupiterOne API token, including the CLI, the SDK, custom scripts, and CI jobs.
-   **Integrations you run yourself.** Any collector or job that authenticates to JupiterOne with an account or user API token from your own infrastructure.

Blocked requests fail with a permission error. They are not treated as authentication failures, so a blocked user is not prompted to log in again.

### What the allowlist does not block

**Signing in.** A user connecting from a non-allowed address can still authenticate, but no action they take afterward will succeed. Expect this to look like a working login followed by an app that cannot load anything.

The allowlist governs requests made against your account with your users' sessions and your API tokens. It is a restriction on where your account can be used from, not a replacement for the rest of your access controls — keep managing token lifetimes, user offboarding, and group permissions as you would without it.

> **NOTE**
> 
> If you are assessing the allowlist as part of a security review and need its exact coverage boundary, contact your JupiterOne account team or support rather than relying on this page.

> **CAUTION**
> 
> JupiterOne staff are subject to your allowlist too. Support engineers cannot access your account from outside your allowed addresses. See [If you get locked out](#if-you-get-locked-out) for what this means for support requests.

## Configure the allowlist

1.  Click **Settings** (the gear icon) and select **Admin**.
2.  Open **Security & Access** and find the **IP allowlist** section.
3.  Enable the allowlist and add your entries. For each entry, provide:
    -   **Address or range** — a single IPv4 or IPv6 address, or a CIDR block of either family. For example `203.0.113.42`, `203.0.113.0/24`, `2001:db8::1`, or `2001:db8::/48`.
    -   **Label** — a short description of what the entry covers, such as `HQ office egress` or `Chicago VPN`. Labels are up to 64 characters.
4.  Save your changes.

An account can hold up to 100 entries, and malformed addresses are rejected as you type them. An enabled allowlist with no entries is not a valid configuration and will not save.

### Verify your own address first

The section displays **the source IP JupiterOne sees for your current request**. This is the value that will actually be compared against your entries, and it is not necessarily the address your machine reports for itself — traffic through a VPN, a corporate proxy, or NAT arrives from the egress address of that hop.

Use the displayed value as your reference when you build the list. If you are unsure what a location's egress range is, get it from whoever manages that network rather than guessing.

### Confirming a save

Some saves ask you to type your account short name before they apply. The confirmation shows your proposed entries next to the source IP JupiterOne sees for you, so you can check your own access before committing. You are asked to confirm when:

-   **You turn the allowlist on.** Enforcement affects everyone in the account, so this is confirmed even when your own address is covered.
-   **Your source IP falls outside the entries you are saving.** The confirmation warns you explicitly that you are about to lose access.

Other saves apply without the extra step: turning the allowlist off, and editing an already-enabled list in a way that still covers your own address.

> **NOTE**
> 
> You cannot save an enabled allowlist while JupiterOne is unable to determine the address you are connecting from. Without that value there is no way to tell whether your entries cover you.

## Avoid locking yourself out

Saving a list that does not include your own address locks out the person best placed to undo it. Before you save:

-   Confirm your entries cover the source IP shown in the section.
-   Add every egress range your users actually come from — each office, each VPN concentrator, each cloud NAT gateway — not just your own.
-   Include the egress addresses of any automation that authenticates with a JupiterOne API token. A CI runner or a self-hosted collector that falls outside the list stops working as soon as enforcement begins.
-   Remember that ranges change. Consumer ISPs, cellular networks, and CGNAT pools reassign addresses; a home address that works today may not tomorrow. Prefer stable egress points.

## Removing an entry or turning the allowlist off

Editing entries and disabling the allowlist are both done from the same section. Turning the allowlist off leaves your entries in place, so you can re-enable the same list later without re-entering it.

## When changes take effect

Allowlist changes apply immediately in most cases, but some can take a few minutes to propagate.

Allow for that when you widen the list or re-enable enforcement: access you have just granted may take a few minutes to work. If you need a change to take effect immediately, contact support.

## If you get locked out

Raise a request through your normal JupiterOne support channel, as an account administrator. Support can **pause** enforcement on your account, which restores access without touching your entries — your addresses and labels are preserved exactly as you saved them.

Two things to know about the recovery path:

-   **While enforcement is paused, your account is not IP-restricted.** Correct your entries and re-enable enforcement promptly rather than leaving the pause in place.
-   **Only you can turn it back on.** Support cannot re-enable enforcement or edit your entries. Once you have access again, fix the list in **Security & Access** and enable the allowlist yourself.

After you re-enable it, allow a few minutes for the change to propagate before concluding that something is wrong.

## Limitations

-   **Not compatible with AWS PrivateLink.** If your account reaches JupiterOne over PrivateLink, do not enable an IP allowlist — PrivateLink already restricts network access, and combining the two will break your connectivity. Contact your JupiterOne representative if you are unsure whether this applies to you.
-   **Up to 100 entries** per account, with labels up to 64 characters.
-   **Account-wide only.** The allowlist cannot be scoped to a user group, a role, or a specific API token.

---

Source: /features/admin/j1-dashboard

# JupiterOne Dashboard

## JupiterOne Dashboard

By default, the JupiterOne workspace home page features an high-level breakdown of several data points relating to your environment. This provided view is the _Dashboard Overview_.

![The JupiterOne Dashboard Overview](/assets/images/dashboard-overview-06d2d239641bac134fbebf0514bfbee0.png)

### Dashboard Overview

-   **What's changed?**: An overview breaking down the changes in your environment for a given time frame (last 7 days is the default). You can adjust the time frame from time of your last login up to 90 days.
-   **What's in my environment?**: An aggregate view of the problems, alerts, and critical assets within your JupiterOne workspace.
-   **What compliance gaps for I have?**: Showcases the running total of compliance gaps within your JupiterOne workspace.

> **NOTE**
> 
> Your initial overview page may or may not feature the sections above depending on your user access. For more information on access and user roles, [see our documentation](/features/admin/access-controls.md).

## JupiterOne Graph

JupiterOne is built as a data-driven graph platform. The JupiterOne graph provides a deep, highly contextualized representation of your assets, their relationships, and metadata. By capturing this data in a graph, JupiterOne enables you to gain a much more accurate picture of your entire environment.

![JupiterOne Graph](/assets/images/graph-overview-e440bbd10aaa47cff39d6e5fe6770819.png)

The graph allows for dialing in to particular assets to explore what and where a blast radius could pose a security threat.

### Accessing the graph

You can access the JupiterOne graph from any query, simply change the view to **Graph** or add `RETURN TREE` to the end of the query.

### Up Next

Now that you've explored the JupiterOne home view and graph, explore [configuring your user settings](/features/admin/user-settings.md), or if you're a workspace admin, [configuring your workspace settings](/features/admin/admin-settings.md).

---

Source: /features/admin/organizational-units

# Organizational Units

Organizational units (OUs) scope your JupiterOne data to the teams that own it. An OU groups the assets, controls, and findings that belong to a single part of your organization so that each team can see its own posture without asking a central team to build a report. OUs are used as a filter in both Compliance (Continuous Control Monitoring) and Vulnerability Management, and are configured once from a single admin interface.

## Namespaces and organizational units

OUs are organized into **namespaces**. A namespace is a _grouping dimension_ — a way of dividing your environment — and the OUs inside it are the individual buckets along that dimension.

JupiterOne provides one built-in namespace and lets you create as many custom namespaces as you need:

-   **Integration (built-in)** — A system-managed namespace where every integration instance in your account is automatically an OU. This namespace is read only: you cannot edit or delete it or its queries. Its OUs follow the integration instance lifecycle — when you add an integration its OU appears, and when you remove an integration its OU is removed.
-   **Custom namespaces** — Namespaces you define yourself, where OU membership is computed from J1QL queries. Use custom namespaces to group your environment by team, business unit, region, environment, tag, or any other dimension that matters to your organization.

A single entity can belong to OUs in more than one namespace at the same time. For example, an EC2 instance can be in the `Production` OU of an _Environment_ namespace and the `Platform` OU of a _Teams_ namespace simultaneously.

## The organizational unit admin interface

Configure namespaces and OUs from a single page. Navigate to **Settings** > **Organizational Units** to open the OU admin page.

The page lists every namespace as an expandable grouping. Expand a namespace to see the OUs it contains in a table with:

-   **OU name** and integration icon — the name of the bucket, with the provider icon shown for integration-derived OUs.
-   **Assets** — how many entities are scoped to this OU.
-   **Metadata** — an **Added** or **Missing** badge indicating whether the OU has an owner configured. OUs without an owner are flagged **Missing** so you can see at a glance what still needs attention.

![Organizational Units admin page showing namespaces, their OUs, asset counts, and metadata status](/assets/images/ou-admin-15b3e93badb7327fd1d425102a8ec330.png)

### Create a custom namespace

1.  On the OU admin page, click **New namespace**.
2.  Enter a **Name** (for example, `Teams`) and an optional **Description**.
3.  Optionally select a **Default workflow** — the default ticketing workflow used to route unassigned-case tickets for OUs in this namespace.
4.  Add one or more **Queries** that define how entities are bucketed into OUs.
5.  Click **Save namespace**.

Each query must `RETURN` exactly two aliased columns:

-   `AS entityId` — the matching entity.
-   `AS ouValue` — the bucket key the entity is grouped by (a region, a tag, a team name). This value becomes the OU's label.

The bucket value must be populated on every matching entity. When you project an optional property such as a tag or a custom field, filter to entities that have it with `WITH`, otherwise the save fails with _"must return at least one of ouValue or ouId"_.

> **WARNING**
> 
> Always project the bucket key `AS ouValue`. A second alias, `AS ouId`, is accepted only for keys that are UUIDs, but OUs created this way have no human-readable label and show as raw identifiers in the filter and admin interface. Use `AS ouValue` for every namespace query.

For example, to group AWS accounts by their `Team` tag:

```j1ql
FIND aws_account WITH tag.Team != undefined AS a
RETURN a._id AS entityId, a.tag.Team AS ouValue
```

A namespace can contain several queries — each one contributes its matched entities to the OUs in that namespace.

> **TIP**
> 
> Start broad. A namespace that buckets every asset by a single tag or owner attribute you already maintain (for example, `tag.Team` or `tag.Environment`) gives every team a self-service view with almost no setup.

### Configure OU routing metadata

Click any OU in the table to open its detail panel and configure routing metadata — who owns the OU and where its work is routed:

-   **Owner email (primary owner)** — The primary person responsible for the OU. This is required for the OU to count as configured, and it receives the OU contact digest.
-   **Additional owner emails** — Secondary owners, entered as a comma-separated list.
-   **Ticket workflow** — The ticketing workflow used to route cases for this OU.

Changes persist immediately and are available through the API.

> **TIP**
> 
> Set a primary owner email on every OU. The owner email clears the **Missing** badge, drives the OU contact digest, and identifies who to route a finding or control failure to when it belongs to that team.

## Filtering by organizational unit

Once your namespaces and OUs exist, you can filter by OU in both Compliance and Vulnerability Management. The OU filter narrows every view to the assets, controls, and findings that belong to the selected team.

### In Compliance (Continuous Control Monitoring)

The Controls Status View and its drill-down can be scoped to one or more OUs.

1.  Open the **Org Units** filter at the top of the Controls Status View.
2.  Select one or more OUs, organized by namespace.
3.  The controls list filters to show only the controls with results related to assets in the selected OUs.
4.  The summary header adapts to show OU-specific compliance metrics, and the drill-down shows which assets within the selected OUs are affected, with individual pass and fail status.

The OU selection persists in the URL, so you can share a link to a specific OU's compliance view with a team member.

![Controls Status View filtered by the Org Units selector to a single organizational unit](/assets/images/ccm-ou-picker-e45b91dc390ff8888d2980938707fcde.png)

> **TIP**
> 
> Give each team lead a self-service compliance view. An IT or Cloud Ops leader can select their OU and immediately see their team's compliance posture without asking the central compliance team for a report.

### In Vulnerability Management

In Vulnerability Management, the OU identifies which team owns an affected asset and drives where remediation work is routed.

-   The **Owner team** column shows the OU that owns the affected asset on the Prioritized view and on remediation plans.
-   Filtering by OU narrows the vulnerability funnel to the findings on assets owned by that team.
-   When you create a remediation plan, the OU determines which team the resulting case is routed to.

Vulnerability Management draws owner teams from a single configurable namespace, set as the **OU namespace** in the Risk configuration panel. It defaults to the built-in **Integration** namespace, so change it to a custom namespace — such as a team or business-unit grouping — when you want cases routed by that dimension instead.

![Vulnerability Management Prioritized view showing the Owner team column populated from organizational units](/assets/images/prioritized-view-9193d2b4da359eb76c77e2728e339872.png)

## Organizational unit metadata on entities

OUs are represented on the graph through internal metadata, which is what makes OU filtering and scoping possible. All internal metadata uses an underscore (`_`) prefix.

Every entity carries an `_ou` property: a pipe-delimited set of `<namespace-slug>:<value>` tokens for every OU the entity belongs to, across all namespaces. For example, an entity might carry `|integration:8f3c…|teams:platform|environment:production|`. The built-in **Integration** namespace populates these tokens automatically; custom namespaces populate them by evaluating their queries.

| Property | Type | Description |
| --- | --- | --- |
| `_ou` | `string` | The set of OUs the entity belongs to, as pipe-delimited `namespace:value` tokens. This is what the OU filter matches on. |
| `_integrationInstanceId` | `string` | Internal UUID of the integration instance the entity was ingested from. Backs the built-in Integration namespace. |
| `_integrationName` | `string` | User-provided friendly name of the integration instance. Surfaced as the OU name in the Integration namespace. |
| `_integrationType` | `string` | Type of the integration, typically the provider name (for example, `aws`, `azure`, `okta`). |

You can filter entities by OU in J1QL using the `_ou` property and the `~=` contains operator. For example, to find every entity in the `platform` OU of the `teams` namespace:

```j1ql
FIND * WITH _ou ~= '|teams:platform|'
```

> **NOTE**
> 
> For the built-in Integration namespace, `_ou` tokens are assigned and maintained by JupiterOne and follow the integration instance an entity was ingested from. For custom namespaces, membership is recomputed from the namespace queries — edit the query to change which entities fall into which OU.

For the full list of internal metadata assigned to entities and relationships, see [Entity and Relationship Metadata](/jupiterOne-data-model/metadata.md).

## Related topics

-   [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md)
-   [Vulnerability Management](/features/vulnerability-management.md)
-   [Entity and Relationship Metadata](/jupiterOne-data-model/metadata.md)

---

Source: /features/admin/parameters

# Using Parameters

Some use cases of JupiterOne required referencing a _literal_ value that is better suited to reference as a _variable_ or a **parameter**. Sometimes common values are better stored and retrieved at runtime instead of saved literally. Some examples include:

-   Long or unwieldy values (such as a long URL)
-   Sensitive values (such as a private key or API token)
-   Common values (such as dates, keys) that you may want to change in many places at one time

A better alternative exists in the form of _parameters_–which can be stored and referenced in rules and queries with a special syntax.

## Examples

In the use case of a very long URL, which may not be easily human-readable and may be referenced in many rules, queries, or questions, use:

### Example: Parameters in J1QL

```j1ql
FIND Application WITH loginUrl = ${ param.longURL }
```

### Example: Parameters in Rules

```json
  "headers": {
    "Authorization": "Bearer {{param.secretApiKey}}"
  }
```

The service hydrates the value of `longUrl` or `secretApiKey` and evaluates it against the remote contents instead of the parameter expression. You can leverage this same pattern for different types of parameter types and comparisons, explained below. As shown above, the syntax between rules and queries differs slightly, but is consistent with variables (in the case of queries) and expressions (in the case of rules).

## Usage: Schema

Currently, the storage of parameters is only accessible from public-facing GraphQL endpoints. In the future, a user interface will be available to account users but, currently, only the API exists.

A parameter is an object stored in the parameter-service, which uses the following schema:

| Property | Type | Description |
| --- | --- | --- |
| `name` | `string` | The parameter **key** or "name" |
| `value` | `string` | `number` | `boolean` | `list` | The parameter **value** to be stored/retrieved |
| `secret` | `boolean` | **Flag** to treat value as sensitive data |
| `lastUpdatedOn` | `date` | **Date** which indicates last update |

#### List Types

Lists are considered to be arrays of `string`, `number`, or `boolean` types.

## Usage: API Operations and Queries

| Queriable fields: |  |
| --- | --- |
| parameter | Individual `QUERY` for one parameter |
| parameterList | Bulk `QUERY` for parameters |

| Mutations: |  |
| --- | --- |
| setParameter | Create/update a remote parameter |
| deleteParameter | Remove a parameter from the remote store |

### GraphQL API

### Query: `parameter`

| _Argument_ | _Type_ | _Required?_ |
| --- | --- | --- |
| name | `string` | Yes |

**_Returns_**: Parameter

**_Example_**:

```gql
query Query($name: String!) {
  parameter(name: $name) {
    name
    value
    secret
    lastUpdatedOn
  }
}
```

### Query: `parameterList`

| _Argument_ | _Type_ | _Required?_ | _Default_ |
| --- | --- | --- | --- |
| limit | `number` | No | 100 |
| cursor | `string` | No (unless paginating) | n/a |

**_Returns_**: Paginated

**_Example_**:

```gql
query Query($limit: Int, $cursor: String) {
  parameterList(limit: $limit, cursor: $cursor) {
    items {
      name
      value
      secret
      lastUpdatedOn
    }
    pageInfo {
      endCursor
      hasNextPage
    }
  }
}
```

### Mutation: `setParameter`

| _Argument_ | _Type_ | _Required?_ | _Default_ |
| --- | --- | --- | --- |
| name | `string` | Yes | n/a |
| value | `string` | `number` | `boolean` | `list` | Yes | n/a |
| secret | `boolean` | No | `false` |

### **_Returns_**

```ts
{
  success: boolean;
}
```

**_Example_**

```gql
mutation Mutation($name: String!, $value: ParameterValue!) {
  setParameter(name: $name, value: $value) {
    success
  }
}
```

**_List Parameters Variables Example_**

```gql
{
  "name": "items",
  "value": ["jupiterone.com", 2] // multi-type arrays are allowed
}
```

**_Non-List Parameters Variables Example_**

```gql
{
  "name": "j1domain",
  "value": "jupiterone.com"
}
```

#### Mutation: `deleteParameter`

| _Argument_ | _Type_ | _Required?_ |
| --- | --- | --- |
| name | `Array<string>` | Yes |

#### **_Returns_**

```ts
{
  success: boolean;
}
```

**_Example_**

```gql
mutation Mutation($name: String!) {
  deleteParameter(name: $name) {
    success
  }
}
```

## Parameter References

You can reference parameters in [rules' configurations](/api/alert-rules.md#rule-definition-reference) or any [query expression](/j1ql.md), although the syntax is slightly different between the two. `param` is a special keyword that, when invoked, fetches values from the parameter-storing service.

> **NOTE**
> 
> In the case of both rules and queries, referencing a nonexistent parameter causes an error and abandon execution.

## Auditing and Security

All changes (including creation and deletion) of parameters is captured by an audit trail providing visibility into the historic usage and access of these values. In addition, all parameters are encrypted-at-rest and in-transit, subject to log redaction, and are subject to either ABAC or IAM-based fine-grained permissions.

## Secret Parameters

Any parameters set with `secret` to be `true` have write-only values and are not readable from the API. Only evaluations of the query can access these parameter values. This usage enables the storage of sensitive parameters such as API keys that JupiterOne users should not be able to see. All read access to these secret parameters contains redacted values, but metadata is able to be read.

> **NOTE**
> 
> By design, you cannot update a parameter that has had `secret` set to true to `secret: false` without also changing the value in the same request.

---

Source: /features/admin/query-builder

# Query Builder

The JupiterOne Query Builder is a tool that provides a visual way to build a query in [J1QL](/j1ql.md) without having to be proficient in the JupiterOne Query Language (J1QL).

![JupiterOne Query Builder](/assets/images/query-builder-309379e0f49bb56ed1e766f2262bb59f.gif)

#### To create a query in Query Builder:

1.  Navigate to the **Home** -> **Query Builder** page.
    
2.  Click on a class from the bubble chart or the left navigation menu. You can use the search bar to search through classes.
    
3.  Click **Add Filter** to filter by a specific property, tag, or metadata. Add an operator and specific value you want to query on, if applicable. You can as many filters as you want.
    
4.  Clicking on the first class will load relationships to other classes that exist in your graph. Click on one of the relationships to add it to your query.
    
5.  Click `List` or `Graph` to choose how you want to return the results. You can toggle between the options by clicking **Run Query** after you make your selection.
    
6.  Click **Open in search** to open the generated query.
    

Using the icons in the box at the top right of the page, you can:

-   Save the query as a question in the questions library
-   Add the query results to [JupiterOne Insights](/features/insights-and-alerts/insights.md)
-   Create an [alert](/features/insights-and-alerts/alerts.md)
-   Generate a link to the query that you can share
-   Copy the query to the clipboard
-   Download the query as csv or json

### Questions

In addition to the Query Builder, JupiterOne also features a preset library full of common questions, or queries that can assist in jump-starting your data exploration in JupiterOne.

![JupiterOne Question Library](/assets/images/question-library-a7e58ba7179e171bb3400fb5b09c3b16.png)

To access the Question Library, navigate to the **Home** -> **Questions library** page.

#### Running a question

To run a question from the Question Library:

1.  Select the desired question from the list.
2.  View the results.

#### Adding a question to the library

In addition to running the prebuilt questions, you can create a question to add to the Question Library by selecting **Create Question**.

Creating a question required the following:

-   Title: the title of the question
-   Description: a brief description of the question
-   Enable trend data collection (opitonal): informs the system to collect trend data and chart the query results over time
-   Set the polling interval: the interval at which the system runs the query (30 minutes, 1 hour, 1 day)
-   Tags: additional metadata used to reference the question
-   Queries: the [J1QL](/j1ql.md) query or queries run within this question

---

Source: /features/admin/resource-allowlist

# Resource Allowlist tool

JupiterOne provides a resource allowlisting tool as a Power Up for all Enterprise customers and all Premium customers who have added the Power Up Pack.

This Power Up enables you to list the applications, internal IP addresses, and external IP addresses that are approved, in use, and trusted by the organization. When an asset is created by the System Mapper, during the analysis of roles and policies in your account, or uploaded via API, the asset is checked against the allowlist. When a match is found, the asset is updated with an additional property for querying purposes.

## Configuration

To configure the resource allowlist:

1.  Click on **Settings** (the gear icon) and click **Power Ups**.
2.  Select **Configure Resource Allowlist**.
3.  Populate each allowlist, following the instructions outlined below.

### Configure the Approved Applications Allowlist

When you create an `Application` asset in J1, the property `approved` is set equal to `true` if the `name` of the application matches a value listed under the allowlist **Approved Applications**.

You should add applications you approve to the list by name, for example:

```text
Google Chrome.app
zoom.us.app
```

After you have configured the allowlist, your application data is automatically enriched, and you can run useful queries such as the following to find non-approved applications installed on any device:

```j1ql
Find Device 
    that installed Application with approved=false
```

### Configure the Internal IP Addresses Allowlist

When you create a `Host` or `Network` asset in J1, the property `internal` is set equal to `true` if the `ipAddress` or `privateIpAddress` of the host or network matches a value listed under the **Internal IP Addresses** allowlist.

You should add internal IP addresses that you own to the list in CIDR notation, for example:

```text
16.5.4.3/32
16.5.4.0/24
```

After you have configured the allowlist, your application data is automatically enriched, and you can run useful queries to find a list of external IP hosts and networks in your account, such as the following:

```j1ql
FIND (Host|Network) 
    with _source!='integration-managed' and internal!=true
```

### Configure the Trusted External IP Addresses Allowlist

When you create a `Host` or `Network` asset in J1, the property `trusted` is set equal to `true` if the `ipAddress` or `privateIpAddress` of the host or network matches a value listed under the **Trusted External IP Addresses** allowlist.

You should add the external IP addresses you trust to the list in CIDR notation, for example:

```text
16.5.4.3/32
16.5.4.0/24
```

After you configure the list, your application data is automatically enriched, and you can run useful queries to see a graph of untrusted sources that have inbound SSH access to your environment, such as the following:

```j1ql
FIND Firewall that ALLOWS as rule (Host|Network)
  with _source!='integration-managed' and trusted!=true
WHERE 
  rule.ingress=true and rule.fromPort <= 22 and rule.toPort >=22
RETURN TREE
```

---

Source: /features/admin/saml-sso

# How to Configure SAML SSO Integration with JupiterOne

Single sign-on is supported using a custom authentication client configured within a J1 account. This feature is available to all Enterprise customers.

## Supported Features

-   **SP-initiated SSO**
    
    Service Provider-Initiated (SP-initiated) SSO means when the service provider (SP) initiates SAML authentication. SP-initiated SSO is triggered when you try to access a resource in J1.
    
-   **JIT (Just In Time) Provisioning**
    
    Users are created and updated instantly using the SAML attributes sent as part of the SAML response coming from the Identity Provider (IdP). The user is created during the initial sign-in to J1 and updated during subsequent sign-ins.
    

> **NOTE**
> 
> IdP-initiated SSO is currently unsupported due to a limitation of Amazon Cognito.

## Configuring SSO

You must be a member of the Administrators group to perform configurations.

1.  In your JupiterOne workspace, navigate to **Settings > Security & Access**.
    
2.  Enable the **Single Sign On (SSO)** toggle.
    
3.  You will be provided the `SSO URL` and `Audience URI` (SP Entity ID) for you to provide your IdP SSO application.
    
4.  Copy the SSO URL and Audience URI and enter them where necessary for your IdP SSO application. In your IdP account, add a new SAML application and name it JupiterOne.
    
    1.  Copy the SSO URL and Audience URI values in the SAML settings.
    2.  Use the same JupiterOne single sign-on URL string value for Recipient URL and Destination URL.
    3.  Leave the **Default Relay State** field empty.
    4.  Select **EmailAddress** for the name ID format.
    5.  Select **Email** _or_ **Username** for the application username.
    6.  See the next section for details on attribute mappings.
5.  Complete the configuration of the SAML application in your IdP account, and copy the identity provider metadata link. For example, in Okta, you can find this link on the **Sign On** tab of the application, under **View Setup Instructions**. ​ ![okta-idp-metadata](/assets/images/okta-idp-metadata-16e65c1eed659ec1fdf2dd505171a596.png)
    
6.  Go back to the JupiterOne single sign-on settings, and paste the identity provider metadata link in the **SAML Metadata File** field. Alternatively, you can enter the SAML Metadata manually if you so choose. Simply select **Type the SAML Metadata file manually** and enter the metadata into the provided text field.
    
7.  **Save** your settings to complete the configuration. Next time you access your JupiterOne account using your organization custom URL (for example, `https://your_company.apps.us.jupiterone.io`), you are redirected to your SAML IdP for authentication.
    

## Attribute Mappings

JupiterOne supports the following SAML attribute mappings:

-   `email`: User email address (required)
-   `family_name`: User last name
-   `given_name`: User first name
-   `name`: User display name
-   `group_names`: Dynamically assigns the user to the specified groups within JupiterOne.

J1 highly recommends that if you are a large organization, you should use the [JupiterOne1 API](/reference.md) to create group names and then use the `group_names` attribute to more easily synchronize all username data with J1 on a regular basis. You can use the `group_names` attribute to equate to a filtered list of groups that match the names of the J1 groups (case-sensitive). For example, create a group name to contain all the users who have administrative privileges in J1.

> **NOTE**
> 
> Users without `group_names` mapping are assigned to the **Users** group within your J1 account, by default.

## Okta Configuration

To configure SSO for Okta, you must have administrator access. In addition, ensure you can access the SSO URL and your Audience URI before proceeding.

1.  From the Okta Applications menu, select **Create App Integration**.
    
2.  Select **SAML 2.0** and click **Next**.
    
3.  Enter a name in the **App Name** field. The name JupiterOne is used in the example below, and click **Next**.
    
4.  In the SAML Settings sections:
    
    -   In the **Single sign on URL** field, enter your `SSO URL`.
    -   In the **Audience URI (SP Entity ID)** field, enter your `Audience URI`.
    -   In the **Name ID format** field, select `EmailAddress`.
    -   In the **Application username** field, select `Email`.
5.  Configure the attribute mappings in the **Attribute Statements** section. Only the email attribute is mandatory.
    
    -   `email` > `user.email`
        
    -   `family_name` > `user.lastName`
        
    -   `given_name` > `user.firstName`
        
    -   `name` > `user.displayName`
        
    -   `group_names` > `appuser.jupiterone_groups` where `jupiterone_groups` is optional naming. ​
        
        You must configure the group attribute in the Profile Editor in the **Directory** menu, and then assign it after completing the configuration.
        
6.  After mapping the attributes, click **Next**.
    
7.  In the Feedback menu, select _I'm an Okta Customer adding an internal app_, and click **Finish**.
    
8.  In the Settings section of the Sign On menu, right-click the **IdP** link and select **Copy Link Address**.
    
9.  Paste the link into the **SAML Metadata Document URL** field.
    
10.  Click **Save** in the top right of the window to save your configuration. A green confirmation message displays in the lower-left corner of the screen.
     

### Okta Group Attribute Configuration

JupiterOne recommends adding a custom group attribute to the JupiterOne profile in your IdP account (such as Okta). You can add the attribute with the Profile Editor for the app. Provide a name for the custom group attribute, such as `jupiterone_groups`.

An example in Okta:

![okta-app-profile-editor](/assets/images/okta-app-profile-editor-71c8fd1384352c2a8511ede931ef3b13.png)

You can then use this custom app attribute to assign group memberships to your users based on their IdP group assignments. The actual value for the attribute is typically configured on the groups assigned to the app.

An example in Okta:

![okta-app-group-assignment](/assets/images/okta-app-group-assignment-885bc4085a864c1829175a80509fda40.png)

## Azure AD Example

An example of an attribute mapping configuration in Azure AD: ![azure-ad-attribute-mappings](/assets/images/sso-azure-user-attr-claims-89df5f2effd8cbead36b7950a7aaf7ab.png)

An example of group assignment in Azure AD:

![azure-ad-app-group-assignment](/assets/images/sso-azure-auto-assign-groups-f01303ada16fcb4d496e708352d973ce.png)

By adding the user.assignedroles -> group\_names mapping to Azure AD, the app roles assigned to the user are mapped to the groups in JupiterOne that have the same name as the group/role.

> **INFO**
> 
> Read [Azure's documentation](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps) for more information on adding app roles and assigning them to users and groups.

In Azure AD, go to [https://portal.azure.com/#blade/Microsoft\_AAD\_IAM/ActiveDirectoryMenuBlade/RegisteredApps](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/RegisteredApps), click JupiterOne, and then click **Manifest**.

Add an entry to appRoles that is similar to:

```json
{
  "allowedMemberTypes": [
    "User"
  ],
  "description": "Administrators",
  "displayName": "Administrators",
  "id": "e6421657-3af5-4488-831f-7989175e3e35",
  "isEnabled": true,
  "lang": null,
  "origin": "Application",
  "value": "Administrators"
}
```

Assigning an app role to a user in Azure AD:

![User assigned Azure AD App role](/assets/images/sso-azure-app-user-and-groups-cd2e6f8d4def03e55963d42dbd3d1947.png)

## Google Workspace Configuration

Before beginning a configuration through Google Workspace, ensure you have access to the SSO URL and your audience URI. Go to the [Google Admin Console](https://admin.google.com/ac/apps/unified?hl=en).

1.  From the **Add App** dropdown menu, select **Add custom SAML app**.
2.  In the App name field, enter JupiterOne.
3.  Click **DOWNLOAD METADATA** to download an XML metadata file to use later.
4.  Paste your `SSO URL` in the ACS URL field.
5.  In the **Entity ID** field, paste your `Audience URI`. In the Name ID format field, select **EMAIL**, and select **Primary email** in the Name ID field.
6.  When mapping directory attributes, ensure you use the following names in the App attributes fields. group\_names is optional.

-   _Primary email_ > `email`
-   _Last name_ > `family_name`
-   _First name_ > `given_name`

6.  Paste the downloaded XML metadata file contents into the SAML Metadata File field.

## Current Limitations

### IdP-initiated sign-on flow is not supported

JupiterOne uses Amazon Cognito service to manage authentication, including SSO. Cognito currently does _not_ support IdP-initiated sign-on. This means you can _not_ click on the app icon in your IdP account (such as JumpCloud, Okta, OneLogin). Instead, you must initiate single sign-on by going to your JupiterOne vanity (custom) URL or your account sign-in URL:

JupiterOne vanity URL:

```text
https://<your_j1_subdomain>.apps.us.jupiterone.io
```

JupiterOne account login URL:

```text
https://login.us.jupiterone.io/account/<your_j1_account_id>
```

These URLs redirect to your configured SSO provider for authentication.

You can find your J1 account ID by running the following query:

```j1ql
Find jupiterone_account as a return a.accountId
```

**Workaround**

If your SSO provider supports configuring a bookmark or secure web authentication (SWA) app, you can work around this limitation by doing the following:

-   Hide the app icon to users for the configured JupiterOne SAML SSO app.
-   Configure a Bookmark/SWA app with your JupiterOne account URL and assign it to the same users and groups that are assigned the JupiterOne SAML app.

## Troubleshooting

Different SSO providers have varying UIs and nomenclature, therefore, ultimately the SAML response and attribute statement should look similar.

### **Common Problems**

**Infinite Redirect Loop**

An infinite redirect loop can occur if the SAML subject is incorrect or missing or if the required SAML attribute `email` (case-sensitive) is not present.

**SAML Subject**

A common problem during SSO configuration is an incorrect SAML subject. Here is an example of a correct subject:

```xml
<saml2:Subject>
    <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">john.smith@example.com</saml2:NameID>
    ...
</saml2:Subject>
```

**SAML Attribute Statement**

Another common problem during SSO configuration is an incorrect SAML attribute statement. An example of a correct attribute statement is:

```xml
<saml2:AttributeStatement>
    <saml2:Attribute Name="email">
        <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">john.smith@example.com</saml2:AttributeValue>
    </saml2:Attribute>
    <saml2:Attribute Name="family_name">
        <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">Smith</saml2:AttributeValue>
    </saml2:Attribute>
    <saml2:Attribute Name="given_name">
        <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">John</saml2:AttributeValue>
    </saml2:Attribute>
    <saml2:Attribute Name="group_names">
        <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">Administrators,Users</saml2:AttributeValue>
    </saml2:Attribute>
</saml2:AttributeStatement>
```

**Viewing the SAML Response**

To view the SAML response, you can use browser plugins to capture the POST to `/saml2/idpresponse`. For example, in the Chrome browser the plugin, you can use [SAML-tracer](https://chrome.google.com/webstore/detail/saml-tracer/mpdajninpobndbfcldcmbpnnbhibjmch?hl=en) to decode and view the SAML response and, therefore, the SAML attribute statement.

The following is an example of what SAML-tracer looks like after logging in by SSO. The `SAML` tab is active to view the XML. Calls that have SAML are also flagged with a yellow `SAML` tag on the right of the HTTP request.

![SAML-tracer](/assets/images/saml-tracer-example-ed92c45cc89590c5daa2c71044d67250.png)

---

Source: /features/admin/scim2

# SCIM 2.0 in JupiterOne

JupiterOne supports SCIM 2.0 (System for Cross-domain Identity Management) following the protocol defined by the IETF. SCIM is an industry-standard protocol designed to simplify user identity management tasks in a multi-domain environment.

With SCIM 2.0 support, you can keep JupiterOne in sync with your identity provider by managing group membership, provisioning, and deprovisioning all through the IdP.

## Key Benefits of SCIM

-   **Automated User Provisioning**: SCIM support allows administrators to automatically provision user accounts within JupiterOne when users are added to the identity provider. This eliminates the need for manual user account creation, reducing the chances of human errors and saving valuable time.
    
-   **User Deprovisioning**: When a user is removed from the identity provider, SCIM ensures that the user's access to JupiterOne and associated resources is promptly revoked, maintaining security and compliance by preventing lingering access.
    
-   **Real-time User Sync**: SCIM enables real-time synchronization of user identity information including group membership, ensuring that changes made in the identity provider are immediately reflected in JupiterOne. This ensures consistency and accuracy in user access control.
    

## Setting Up SCIM with you IdP in JupiterOne

### Prerequisites

1.  Confirm that your IdP supports SCIM 2.0 protocol. JupiterOne does not support SCIM 1.0.
2.  Confirm that your IdP supports SCIM authentication by API Bearer Token. J1 does not support basic auth or OAuth with SCIM.
3.  SAML SSO is required before setting up SCIM. Follow these steps to enable SP-initiated SSO: [How to Configure SAML SSO Integration with JupiterOne](/features/admin/saml-sso.md).

### Common steps

No matter your IdP integration, there are some common steps that you will need to take within JupiterOne.

#### Generating an API Token

As previously stated, JupiterOne supports authentication through an API Bearer Token header. You can generate one through code or through the JupiterOne UI. More information can be found here: [Authentication](/api/authentication.md). We recommend generating an account level api token (as opposed to a user level token) for SCIM.

> Note: the max Time To Live for an API token is 365 days. You will need to figure out your own token rotation strategy that is either manual or using our api.

#### SCIM Endpoint

The endpoint URL for JupiterOne SCIM is: `https://api.us.jupiterone.io/iam/scim/v2`.

#### In the Identity Provider

Once confirming support of SCIM 2.0 by your IdP, follow their SCIM setup instructions. You can see example instructions for integrating with Okta below.

> **NOTE**
> 
> JupiterOne’s support of SCIM allows for Create/Read/Update/Delete actions from the Identity Provider (IdP) to JupiterOne. JuptierOne’s support of SCIM does not permit the reverse action of Create/Read/Update/Delete from JupiterOne to the Identity Provider.

### Example: JupiterOne SCIM support through Okta

Following the [SCIM setup instructions](https://help.okta.com/en-us/Content/Topics/Apps/Apps_App_Integration_Wizard_SCIM.htm) from Okta:

Log in to Okta (IdP) as an administrator and follow these steps:

1.  After setting up your SAML SSO Integration, navigate to that application in Okta.
    
2.  Click on the **Provisioning** tab.
    
3.  Top Level Integration Settings:
    
    -   Click on the **Integration** option in the **Settings** nav on the left.
        
    -   Click **Edit**.
        
    -   Set **SCIM connector base URL** to `https://api.us.jupiterone.io/iam/scim/v2`
        
    -   Set **Unique identifier field for users** to `email`
        
    -   Enable the following **Supported provisioning actions**:
        
        > Note: JupiterOne does not support “Import New Users and Profile Updates”
        
        1.  **Push New Users**
        2.  **Push Profile Updates**
        3.  **Push Groups**
    -   Set **Authentication Mode** to `HTTP Header`
        
        > Note: JupiterOne does not support basic authentication or Oauth with SCIM.
        
    -   Set `Authorization` to an account level API Token as described above.
        
4.  To App Settings:
    
    -   Click on the **To App** option in the **Settings** nav on the left.
    -   Click **Edit**
    -   Enable the following:
        1.  Create Users
        2.  Update User Attributes
        3.  Deactivate Users

---

Source: /features/admin/user-settings

# User settings

JupiterOne provides each user the ability to access, view, and customize various areas of their JupiterOne profile. From within your profile settings, you can access your profile, review permissions, manage notifications, and create personal API Tokens.

![JupiterOne user settings](/assets/images/user-settings-88afce9279b60f07d91ef1339526356f.png)

## Accessing your profile settings

When logged in to the JupiterOne platform, you can access your profile by clicking Settings (the cog icon) in the top right and selecting **Profile**.

There are several actions that can be made while viewing your profile. From here, you can:

-   Change your display name
-   Review account details, such as User ID and email
-   Find your current app permissions

## Notification preferences

While in your profile settings, you can change your notification preferences in the **Notifications** tab. Here you can toggle your preferred notifications by area: Compliance, Policies, J1 Rapid Response, and Alerts.

![JupiterOne user notification preferences](/assets/images/user-notifications-8e2c007e48f1b96a827a126c7671c2b8.png)

In addition to choosing which notifications you'd like to receive, you can specify how you would like to receive the notifications. JupiterOne can send notifications through the app (found under the the bell alert icon), notify via email, and additionally supports sending notifications through Slack.

> **INFO**
> 
> See [our Slack documentation](/integrations/directory/slack.md) for more information regarding configuring our Slack integration to receive notifications.

## Personal API Tokens

You can create and access personal API Tokens within your Account settings. From the API Token tab, you can create, view, and delete any tokens you have created.

**When creating a new token**, be sure to specify a token name and the number of days before the token expires.

> **WARNING**
> 
> Be sure to copy the new API Token value when creating a token as it is the only time the token will be displayed for you to copy the value.

To delete an API Token, select the trash icon on the right of the table. Note that this action cannot be undone.

JupiterOne workspace Admin can view all User API tokens from within the Admin settings panel. You can find more information on the [Admin settings options here](/features/admin/admin-settings.md).

---

Source: /features/admin/whats-new-in-search

# What's new in Search

**Release Date:** June 2026

Several improvements to how you find, explore, and query your data.

### What is New

| Change | Meaning |
| --- | --- |
| Instant results in search anywhere (⌘K) | Search anywhere now uses full-text search to scan your entities and give you instant results. |
| Refreshed search bar | Autocomplete with property value fetching. Reduced menu noise while writing a query. |
| AI returns multiple query candidates | Type a plain-English question and get several query options back instead of one. |
| Inspector available everywhere | Open the inspector from anywhere in the app, not just query results. Every traversal stays in the URL. |
| Inspect relationships | Relationships can be expanded from anywhere, not just the graph canvas. |
| Graph canvas improvements | Fidelity scales with zoom. Hover to spotlight. Significantly faster. |
| AI assistant with context | In supported views, the assistant is aware of what you're looking at. Start a conversation about it without leaving the page. |
| Dark mode | Supported throughout the app. Set it in Preferences. |

---

## Search

**⌘K from anywhere.** A global search palette is now available from every page. Type a CVE, a user, a host, a rule — start typing and go. From a result, open the entity directly in the inspector.

![Search Anywhere palette](/assets/images/search-cmd-k-9beb7f7ce58b436219b4861faa71b25a.png)

**Cleaner search bar.** Default state is your recently run queries — no more menu on focus. Start typing and they dismiss. Press the right arrow to browse recent queries inline, or go to the Query History page to search and re-run.

**Smarter autocomplete.** The editor now surfaces token types and fetches real property values as you type, alongside a reference panel showing class documentation, properties, and relationships.

![Autocomplete with property value fetching](/assets/images/search-autocomplete-2c5a3f4de20285cdc7e8ef7281faed1d.png)

**AI returns more options.** Input that doesn't start with `FIND` defaults to AI mode. You now get several query candidates back instead of one.

![AI query candidates](/assets/images/search-ai-candidates-196fb9a8086c15bc48daf009abc886db.png)

**Results are easier to work with.** Resize and reorder columns by drag. Enter selection mode to pick rows, then bulk-set tags, owners, or open everything in the inspector together.

**Better query authoring.** When writing a query for a rule, question, or control, you now get a full-screen view that lets you iterate and inspect results before saving it to the form.

---

## Query builder

The query builder now lands you with your inventory selection and a heatmap showing the distribution of assets in your environment. As you build, your query renders as a live graph — the actual traversals and relationships in your data. The generated J1QL is less of a focus and lets you focus on your data model and filtering results.

![Query builder heatmap](/assets/images/query-builder-heatmap-9a2e238312613cab4383225955a89dd0.png)

![Query builder live graph](/assets/images/query-builder-graph-5b16596f2fdec318f15b89711472cd9a.png)

---

## Questions library

Questions now have their own dedicated page with your account's questions and the JupiterOne library in separate tabs. Trend analysis is available on question detail pages when enabled.

![Questions library](/assets/images/questions-library-2e783f3315767e32cbb62b9fd595fefd.png)

---

## Inspecting your graph

![Inspector open alongside graph](/assets/images/inspector-8eda0d31c486b196fd8ebe56dc67c150.png)

The inspector is now available from anywhere in the app — not just within a query result. Every entity or relationship you open pushes onto a navigation stack. The full traversal stays in the URL, so you can share exactly where you are or hand it off to a teammate, or open it as a graph to see a birds-eye view of what you just walked.

![Inspector overflow menu — open as graph, copy link](/assets/images/inspector-overflow-0966c18ca72c55eaf7988c5ba5a5d9b3.png)

Relationships are first-class — you can inspect them directly, not just entities. For entities with a dedicated in-app experience (ControlTest, Framework, Vulnerability, Rule), you can route directly to that page from the inspector.

The Overview tab includes a 1-hop neighborhood graph, openable in Search for the full experience.

---

## AI assistant

In supported views, the AI assistant is aware of what you're looking at. With the inspector open, you can start a conversation about the entity you're viewing — the assistant has context of the active entity or query result, and can link you directly to other entities in its responses.

![AI assistant with query results in context](/assets/images/ai-query-results-89cbc8eef4fb0705f2e8b91eec42b778.png)

![AI assistant with entity context](/assets/images/ai-entity-context-533bcd8a5d4bb46823a00124c0255fdd.png)

---

## Graph canvas

![Graph canvas](/assets/images/graph-canvas-36348164db243bc9d451014606cd7e0b.png)

The canvas now scales fidelity with zoom — less noise when you're zoomed out and more detail as you move in.

Hovering a node spotlights it and fades everything else. Clicking selects. For pack nodes, you can search members, peel them off individually, or expand in batches of 10.

Performance is significantly improved — snappier and more responsive than before.

---

## Preferences

A new Preferences page lets you set your timezone, switch between light and dark mode, and choose your number and date format.

![Preferences page](/assets/images/preferences-66ae434be1dac28280466725719ca10d.png)

---

## Removed

-   `${me}` variables in J1QL
-   Critical asset badge
-   "Problem" indicator on entities (`hasProblem`)
-   Bulk entity upload in the UI — use the API for bulk ingestion
-   Editing entity properties from the UI — use the API
-   Deleting entities from the UI — use the API
-   Account logo setting

---

Source: /features/ai-asm/ai-asm-1-0

# AI-ASM 1.0 Release Notes

**Release date: June 2026**

AI Attack Surface Management (AI-ASM) 1.0 gives you a single, governed view of the non-human identities (NHIs) in your environment and the AI usage hiding among them. As teams adopt AI assistants, agents, and platform services, machine identities — service accounts, API keys, OAuth apps, bots, and roles — multiply far faster than the human identities security teams traditionally track, and many of them are AI-powered. AI-ASM discovers those identities through the integrations you already have, automatically flags the AI-related ones, shows what each can reach, ranks them by risk, and governs them against an out-of-the-box framework mapped to AI and security regulations.

## What is new in AI-ASM 1.0

| Feature | What it means for you |
| --- | --- |
| Non-human identity discovery | Every NHI across your cloud, SaaS, and source-control integrations is brought into the graph automatically — no manual inventory |
| Automatic AI identity detection | NHIs associated with AI agents, models, and platforms are flagged, each with a confidence level and the detection method that matched |
| AI-ASM dashboard | A single landing view summarising your AI attack surface — AI identities, frameworks at risk, failing controls, platforms, and NHI types |
| Top risk AI identities | AI identities ranked by what they can reach, so the highest-impact identities surface first |
| Data reachability | See the data stores, repositories, databases, packages, vaults, tables, and disks each identity can reach |
| AI inventory | A filterable inventory of every NHI, with an AI-only view, detection confidence, ownership, and per-identity reach |
| NHI governance framework | An out-of-the-box framework that governs AI and non-human identities against standards including NIST AI RMF, the EU AI Act, NIS2, and DORA |

## Non-human identity discovery

AI-ASM brings the non-human identities in your environment into the JupiterOne graph using the integrations you already have configured. A **non-human identity (NHI)** is any digital identity that is not a person — a service account, machine credential, secret, OAuth app, bot, certificate, API key, webhook, or CI/CD identity.

Because NHIs are first-class graph entities, they participate in queries, controls, and relationships like any other asset. The dashboard summarises the full population at the top of the page, alongside the AI subset:

-   **Total NHIs** — every non-human identity discovered in your environment
-   **AI NHIs** — the subset classified as AI-related
-   **Reaching data** and **Reachable assets** — how many identities can reach data, and how many assets they can reach in total

![AI-ASM dashboard with summary metrics, frameworks at risk, AI platforms, and NHI type breakdown](/assets/images/ai-asm-dashboard-0259d318e50789ff6147f810bdb40b9e.png)

## Automatic AI identity detection

AI-ASM evaluates every discovered NHI against a set of detection heuristics and records the result on the identity, so you can see not just _that_ an identity is AI-related but _why_.

Each AI identity carries:

-   **A confidence level** — `confirmed` when there is signed evidence, or `high`, `medium`, or `low` for heuristic matches
-   **A detection method** — the signal that matched, such as a Slack bot or app name, an API key named for an AI provider, an AI platform service-account or role pattern, or a display-name pattern
-   **A platform** — the AI vendor or platform the identity belongs to, such as Anthropic, OpenAI, AWS Bedrock, or AWS SageMaker
-   **A category** — the kind of AI usage, such as a **Foundation** model provider or an **AI SaaS** application

The **AI platforms** and **NHI types** panels on the dashboard break your AI identities down by platform and by identity category, so you can see at a glance where your AI usage is concentrated.

## Risk-ranked dashboard

The **Top risk AI identities** table ranks your AI identities by what they can reach. Each row shows the identity, its platform, NHI type, and detection confidence and method, followed by a breakdown of reachable assets — **Stores**, **Repos**, **DBs**, **Pkgs**, **Vaults**, **Tables**, and **Disks** — and a **Total** reach count. Identities with the broadest reach surface first, so you can focus on the ones that would cause the most damage if compromised.

![Top risk AI identities ranked by data reachability, showing platform, NHI type, detection, and reach counts](/assets/images/ai-asm-top-risk-identities-904ac698686f41fb84e56c1b87fd4ad3.png)

> **TIP**
> 
> Use the reach breakdown to triage. An AI identity that can reach hundreds of repositories or data stores is a far higher priority than one with no reach, even when both have failing controls.

## AI inventory

The **Inventory** view lists every non-human identity in a single sortable, filterable table. Switch between your full NHI population and just the AI identities with the **AI only** / **Non-AI only** filter, and narrow further by type, platform, category, detection confidence, or organisational unit.

Each identity shows its class and type, platform, NHI type, category, AI detection confidence and method, owner, data reach, status, and the number of failing controls against it. AI identities are marked with an **AI** badge. Use **Export** to download the current view, respecting your active filters.

![AI inventory filtered to AI identities, showing platform, NHI type, category, AI detection, and owner](/assets/images/ai-asm-inventory-744f14303f551d3fdb6e967a3552dccc.png)

Select any identity to open its detail panel, which includes an AI-generated summary of the identity, its **AI context** (platform, detection confidence, and detection method), when it was first and last seen, and its neighbours and relationships in the graph.

![Identity detail panel with an AI-generated summary, AI context, and graph relationships](/assets/images/ai-asm-nhi-detail-69e0cfa6270d7b9415831d8fae6b6a83.png)

## NHI governance framework

AI-ASM 1.0 ships with the **AI Attack Surface Management (AI-ASM) — NHI Governance Framework**, an out-of-the-box framework that applies the [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md) model to your non-human and AI identities. Its controls cover common governance obligations, including:

-   **Every NHI has an assigned owner** — each identity must have a designated human owner accountable for its security posture and lifecycle
-   **Shadow AI identities are flagged** — AI-powered identities provisioned outside approved channels are detected and surfaced
-   **AI-powered NHIs have a documented purpose** — each AI identity must have a documented business justification and approved use case
-   **Access control policies cover NHIs** — non-human identities are included in access control governance alongside human identities

The controls map to recognised standards and regulations — including NIST AI RMF, the EU AI Act, NIS2, and DORA — so governing your AI identities contributes directly to your compliance posture. Because they run on the same engine as the rest of CCM, their results appear in the AI-ASM dashboard, the controls views, and your framework compliance scores.

The dashboard's **Control status** section brings these controls together. Filter by **AI only**, framework, priority, or organisational unit; each control card shows the control description, its priority, the framework it belongs to, how many identities it affects, and the requirements it maps to.

![Control status section showing AI governance controls with priority, framework, and affected identity counts](/assets/images/ai-asm-control-status-e774cccab7480fe0afea2624c20c1cf4.png)

## Getting started

**If you already use JupiterOne integrations:** AI-ASM works with the integrations you have configured — no new setup is required to start discovering identities.

1.  Navigate to **AI-ASM** > **Dashboard** to see your AI attack surface, the frameworks it affects, and your highest-risk identities.
2.  Open **AI-ASM** > **Inventory** and filter to **AI only** to review the AI identities in your environment, their detection confidence, and what they can reach.
3.  Assign owners to unowned identities, and use the **Control status** section to address failing governance controls.

**If you are new to JupiterOne:** Connect the integrations that hold your identities — cloud platforms, SaaS applications, and source control — so JupiterOne can discover your NHIs. The AI-ASM dashboard and inventory populate automatically as identities are ingested.

For full feature documentation, see [AI Attack Surface Management](/features/ai-asm/ai-attack-surface-management.md).

---

Source: /features/ai-asm/ai-attack-surface-management

# AI Attack Surface Management

JupiterOne AI Attack Surface Management (AI-ASM) gives security and governance teams a single view of the non-human identities (NHIs) in their environment, automatically flags the ones that are AI-related, and shows what each identity can reach across your connected systems.

As teams adopt AI assistants, agents, and platform services, the number of machine identities — service accounts, API keys, OAuth apps, bots, and roles — grows far faster than the human identities security teams traditionally track. AI-ASM brings these identities into the JupiterOne graph, classifies which ones are AI-powered, and governs them against the same control framework model used by [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md).

## Overview

AI Attack Surface Management enables your team to:

-   **Discover every non-human identity** across your integrated cloud platforms, SaaS tools, and source control, without manual inventory work
-   **Identify AI identities automatically** using detection heuristics that flag NHIs associated with AI agents, models, and AI-powered workloads
-   **See what each identity can reach** — the data stores, repositories, databases, packages, vaults, tables, and disks an identity has access to
-   **Prioritise by risk** so the identities with the broadest reach and the most failing controls surface first
-   **Govern AI usage** against an out-of-the-box NHI governance framework mapped to standards such as NIST AI RMF, the EU AI Act, NIS2, and DORA
-   **Find shadow AI** — AI-powered identities provisioned outside approved channels

![AI-ASM dashboard showing summary metrics, frameworks at risk, AI platforms, NHI type breakdown, and failing controls](/assets/images/ai-asm-dashboard-0259d318e50789ff6147f810bdb40b9e.png)

## Data model

AI-ASM is built on the **non-human identity (NHI)** — any digital identity that is not a person, such as a service account, machine credential, secret, OAuth app, bot, certificate, API key, webhook, or CI/CD identity. NHIs are discovered through your existing JupiterOne integrations and stored as entities in the graph, so they participate in queries, controls, and relationships like any other asset.

Each NHI carries a set of properties that AI-ASM uses to classify and govern it:

| Property | Description |
| --- | --- |
| `nhiType` | The category of identity — for example `service_account`, `secret`, `oauth_app`, `bot`, `service_role`, `service_linked_role`, or `credential` |
| `isAi` | Whether the identity is associated with an AI agent, model, or AI-powered workload |
| `aiConfidence` | Confidence that the identity is AI-related: `confirmed` (signed evidence), or `high`, `medium`, or `low` (heuristic strength) |
| `aiPlatform` | The AI platform or vendor the identity belongs to — for example Anthropic, OpenAI, AWS Bedrock, or AWS SageMaker |
| `owner` | The human or team accountable for the identity |
| `nhiOwnerStatus` | Ownership state used by governance triage: `assigned`, `unassigned`, or `orphaned` |

Because NHIs are first-class graph entities, you can query them directly in [J1QL](/j1ql.md):

```j1ql
FIND NHI WITH isAi = true AND aiConfidence = ('confirmed' OR 'high')
```

> **NOTE**
> 
> `aiConfidence` is a string value (`confirmed`, `high`, `medium`, or `low`), not a number. Compare it against those literal values rather than a numeric threshold.

## How AI-ASM detects AI identities

AI-ASM evaluates every discovered NHI against a set of detection heuristics and records the result on the identity. Each AI identity shows both a **confidence** level and the **detection method** that matched, so you can see why an identity was classified as AI-related.

Detection methods include matches on naming conventions and metadata, such as:

-   **Bot and app names** — a Slack bot or app whose name maps to a known AI assistant
-   **API key names** — a secret named for an AI provider, such as an OpenAI or Anthropic API key
-   **Service account and role patterns** — cloud roles created for AI platform services, such as AWS SageMaker or AWS Bedrock execution roles
-   **Display name patterns** — identities whose display names indicate an AI integration

Identities are also grouped into a **category** that describes the kind of AI usage — for example a **Foundation** model provider or an **AI SaaS** application.

## The AI-ASM dashboard

The **Dashboard** is the landing view for AI-ASM. It summarises your AI attack surface and highlights where attention is needed.

**Summary metrics** across the top show:

-   **Total NHIs** — every non-human identity discovered in your environment
-   **AI NHIs** — the subset classified as AI-related
-   **Frameworks** — the number of frameworks with at least one failing control on an AI identity
-   **Controls** — the number of failing controls
-   **Reaching data** — the number of AI identities that can reach data
-   **Reachable assets** — the total number of assets those identities can reach

Below the metrics, the dashboard breaks the surface down into focused panels:

-   **Frameworks at risk** — frameworks with at least one failing control on an AI identity, so you can see which compliance obligations your AI usage affects
-   **Failing controls** — failing controls grouped and ordered by priority
-   **AI platforms** — a breakdown of AI identities by platform (for example Anthropic, AWS SageMaker, Foqal Agent, Intercom, OpenAI, AWS Bedrock, and Cursor)
-   **NHI types** — the distribution of identities across NHI categories such as bot, service account, secret, and the various role types

### Top risk AI identities

The dashboard ranks AI identities by risk in the **Top risk AI identities** table. Each row shows the identity, its platform, NHI type, and AI detection confidence and method, followed by a breakdown of what the identity can reach — **Stores**, **Repos**, **DBs**, **Pkgs**, **Vaults**, **Tables**, and **Disks** — and a **Total** reach count. Identities with the broadest reach surface at the top, so you can focus on the identities that would cause the most damage if compromised.

![Top risk AI identities table showing platform, NHI type, AI detection, and data reachability counts](/assets/images/ai-asm-top-risk-identities-904ac698686f41fb84e56c1b87fd4ad3.png)

### Control status

The **Control status** section at the bottom of the dashboard shows the controls that govern your AI identities. Filter by **AI only**, framework, priority, or organisational unit to focus the view. Each control card shows the control name and description, its priority, the framework it belongs to, the number of identities affected, and the number of requirements it maps to.

![Control status section showing AI governance controls with priority, framework, and affected identity counts](/assets/images/ai-asm-control-status-e774cccab7480fe0afea2624c20c1cf4.png)

## The AI inventory

The **Inventory** view lists every non-human identity in your environment in a single sortable, filterable table. Use the **AI only** / **Non-AI only** filter to switch between your full NHI inventory and just the AI identities, and filter further by type, platform, category, detection confidence, or organisational unit.

Each row shows:

| Column | Description |
| --- | --- |
| **Name** | The identity name, with an **AI** badge when the identity is AI-related |
| **Class** and **Type** | The graph class and entity type (for example `aws_iam_role`, `github_repo_secret`, `slack_user`) |
| **Platform** | The AI platform the identity belongs to, where known |
| **NHI type** | The identity category (bot, service account, secret, role types, and so on) |
| **Category** | The kind of AI usage, such as Foundation or AI SaaS |
| **AI detection** | The detection confidence and the method that matched |
| **Owner** | The human or team accountable for the identity |
| **Data reach** | A link into the graph and a count of reachable assets |
| **Status** | The identity's current status |
| **Failing controls** | The number of failing controls for the identity |

Use **Export** to download the current view, respecting your active filters.

![AI inventory filtered to AI identities, showing platform, NHI type, category, AI detection, and owner columns](/assets/images/ai-asm-inventory-744f14303f551d3fdb6e967a3552dccc.png)

### Inspecting an identity

Select any identity to open its detail panel. The panel includes an AI-generated summary of the identity, its **AI context** (platform, detection confidence, and detection method), when it was first and last seen, its neighbours in the graph, and its relationships — so you can understand what an identity is, why it was classified as AI, and what it connects to without leaving the view.

![Identity detail panel showing an AI-generated summary, AI context, and graph relationships](/assets/images/ai-asm-nhi-detail-69e0cfa6270d7b9415831d8fae6b6a83.png)

## Governing AI identities

AI-ASM ships with the **AI Attack Surface Management (AI-ASM) — NHI Governance Framework**, an out-of-the-box framework that applies the [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md) model to your non-human and AI identities. Its controls cover common governance obligations, such as:

-   **Every NHI has an assigned owner** — each identity must have a designated human owner accountable for its security posture and lifecycle
-   **Shadow AI identities are flagged** — AI-powered identities provisioned outside approved channels are detected and surfaced
-   **AI-powered NHIs have a documented purpose** — each AI identity must have a documented business justification and approved use case
-   **Access control policies cover NHIs** — non-human identities must be included in access control governance alongside human identities

These controls map to recognised standards and regulations — including NIST AI RMF, the EU AI Act, NIS2, and DORA — so governing your AI identities contributes directly to your compliance posture. Because the controls run on the same engine as the rest of CCM, their results appear in the AI-ASM dashboard, the controls views, and your framework compliance scores.

## Getting started

1.  Connect the integrations that hold your identities — cloud platforms, SaaS applications, and source control — so JupiterOne can discover your NHIs. AI-ASM uses the integrations you already have configured.
2.  Navigate to **AI-ASM** > **Dashboard** to see your AI attack surface, the frameworks it affects, and your highest-risk identities.
3.  Open **AI-ASM** > **Inventory** and filter to **AI only** to review the AI identities in your environment, their detection confidence, and what they can reach.
4.  Assign owners to unowned identities and review the **Control status** section to address failing governance controls.

## Related topics

-   [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md)
-   [What's new in AI-ASM 1.0](/features/ai-asm/ai-asm-1-0.md)
-   [J1QL query language](/j1ql.md)

---

Source: /features/assets/create-assets-in-j1

# Manual asset creation

Explore how to create and add assets directly within your JupiterOne workspace to bring in new assets to your workspace or enrich existing entries with additional information.

## Add an asset

Out of the box, JupiterOne supports over 90 different asset classifications or defined assets. For a comprehensive list of these defined assets, see the [JupiterOne data model](/data-model/jupiterone-data-model.md). Each of these defined assets features its own relevant properties in addition to the common properties shared across assets.

Navigate to the **Assets** section of your workspace, open the actions menu (the three-dot menu), and select **Add new asset**. From there:

1.  Choose the type of asset you wish to create.
2.  Define the **Type** for the asset. This defines the source of the asset source. For example, an AWS resource may be of type `aws_instance` or `aws_s3_bucket` or `aws_iam_user`.
3.  Provide a **Display Name** for the asset. This determines how it will be displayed within the asset view. The asset’s **Name** value will default to the **Display Name** unless a separate **Name** value is provided.
4.  Optionally, provide a **Summary**, **Description**, and **Classification** for the asset.
5.  Add any relevant **Defined Properties** or desired **Custom Properties**, [more information on asset properties can be found here](/data-model/jupiterone-data-model.md).
6.  Provide any relevant tags through which the asset can be filtered or tracked.
7.  Click **Save** once all desired values have been provided for the asset.

Once created, you’ll be able to view and interface with your newly created asset within your Asset workspace.

## Bulk upload assets

To upload or update assets and relationships in quantity, use JupiterOne's [sync jobs API](/api/sync-jobs/overview.md). You format your data as JSON or YAML and submit it through the API, which supports scoped diffing (updating and deleting entities and relationships within a scope) and creating relationships across scopes.

-   [Sync jobs overview](/api/sync-jobs/overview.md)
-   [Sync jobs API reference](/api/sync-jobs/api-reference.md)
-   [Create relationships between owned and non-owned assets](/features/assets/relationships-across-scopes.md)

---

Source: /features/assets/critical-assets

# Critical assets (Deprecated)

> **WARNING**
> 
> Critical assets have been replaced by [JupiterOne smart classes](/features/assets/smart-classes.md). If you were using Critical assets, your critical asset definition was migrated to a smart class. To recreate it, create a smart class named `CriticalAsset`.

Critical assets are a grouping of the assets that contain your most crucial data and therefore carry the most risk. They are now expressed as the `CriticalAsset` smart class: define the queries that determine which assets are critical, and JupiterOne tags matching entities with `tag.CriticalAsset` and re-evaluates them on a schedule. See [smart classes](/features/assets/smart-classes.md) for how to create one and add its queries.

## Querying critical assets

JupiterOne uses smart classes to apply asset filters with shorthand syntax. The `#CriticalAsset` smart class lets you reference your configured critical asset definitions in a query.

For example, to find critical assets with compliance gaps:

`FIND #CriticalAsset THAT HAS jupiterone_compliance_gap`

Or to find critical assets with findings:

`FIND #CriticalAsset THAT HAS Finding`

### Example definition queries

These queries are useful starting points for the `CriticalAsset` smart class definition:

`FIND (Application | CodeRepo | DataStore | Function | Host | Logs | Secret | Vault) WITH tag.Production = true OR tag.CriticalAsset = true OR classification = "critical"`

`FIND (Device | Host) THAT RELATES TO (DataStore | Database) WITH (tag.Production = true OR tag.CriticalAsset = true OR classification = 'critical' OR tags ~= 'Production' OR Access = 'Public')`

`FIND (Device | Host) that (ALLOWS|CONNECTS) (Internet|Everyone)`

`FIND (Function|Host) THAT PROTECTS Firewall THAT ALLOWS << Internet`

---

Source: /features/assets/custom-data-ingestion

# Custom data ingestion

The first step in working with JupiterOne is to import the data for your cyber assets. If JupiterOne does not have an integration for a product in which your data is located, you can still import it into JupiterOne. You can also enrich current data in your JupiterOne account. There are three steps to importing: gather the data, classify the data, and import the data.

## Gather the Data

The power of JupiterOne is that it stores the data in a graph database. Not only can you store an asset such as a user record with properties such as ID, first name, last name, email address, and manager, but you can also define relationships between assets in the database. For example, when you then look at user records, you see all the user data as well as which AWS profiles they are assigned, which applications they have access to, and other information.

The data you want to add to JupiterOne can come from different sources. You can:

-   Export it as a CSV file from another application to upload to JupiterOne.
-   Get the data from an API that a tool provides.
-   Generate the data by combining data from multiple sources.

The data should include the:

-   Assets you want to import to JupiterOne, such as a user or device.
-   Properties for each asset, such as user first name or device MAC address.

> **INFO**
> 
> To learn more about asset and their properties, refer to our [data model documentation](/data-model/jupiterone-data-model.md).

## Classify the Data

Classifying the data ensures that what you import is useful. Depending on the application from which you are importing, you must first identify which assets you want to import. In addition, you must identify the properties, type, and class of the assets. For example, when JupiterOne imports data from Salesforce, it imports the following assets: Group, PermissionSet, Profile, User, and UserRole.

You must also identify the relationships between the assets from the application. In the Salesforce example, some of the relationships J1 creates include:

-   `salesforce_user` ASSIGNED `salesforce_permission_set`
-   `salesforce_user` ASSIGNED `salesforce_user_role`
-   `salesforce_group` HAS `salesforce_user`

In addition, you may need to identify the relationships between assets in Salesforce and assets in other applications that you have in your JupiterOne account.

The [JupiterOne data model](/data-model/jupiterone-data-model.md) is a reference model that, as an asset-relationship graph, describes the digital resources and complex interconnections among all the resources in a technology organization. It represents a reference model, not a strict or rigid structure.

## Import the Data

There are several different ways to get data into JupiterOne:

-   Add a single asset using [JupiterOne Assets](/features/assets/create-assets-in-j1.md). This method is useful for adding low volumes of data. You can add a new asset and its associated properties one at a time.
-   [Bulk upload assets](/api/sync-jobs/overview.md) using the sync jobs API. You format your data in JSON or YAML and submit it through the API.
-   Use the [JupiterOne CLI](/api/nodejs-client.md) with a script. This tool is for those knowledgeable with the command line and how to create scripts to import data to the JupiterOneNode.js API client wrapper.
-   Use the [JupiterOne API](/reference.md), which is what JupiterOne uses in the integrations. You can access all the data in your account and add or update data using a graphQL endpoint.
-   Use the [JupiterOne SDK](https://github.com/JupiterOne/sdk). The SDK allows you to build a complete integration for JupiterOne. It is the most sophisticated way to import data into JupiterOne. It features the best practices that JupiterOne uses to build integrations with other applications.

JupiterOne also supports creating custom integrations to bring in data from particular sources. Read more about [creating custom integrations in JupiterOne](/integrations/development/overview.md) to curate your data ingestion for particular apps or services.

---

Source: /features/assets/device-unification

# Device Unification

Device Unification is the process by which JupiterOne produces a single representation of a device or host across all integrations.

Unified Devices have a very specific data model and are designed to be used as an entry point for asking more interesting questions about your infrastructure.

JupiterOne ingests data from a variety of sources, and each source may represent the same physical device in a different way. For example, a server may be represented by an integration as a `Host` or `Device`. Device Unification is used to present a single view of Device and Hosts across all integrations. The unification is driven by an accumulation of correlations, and is intended to provide a single node in the JupiterOne graph for each uniquely identified device or host.

This unified entity has the `_class` of `UnifiedDevice`, and the `_type` of `unified_entity`. It will be related to the source `Host` and `Device` entities via an `IS` relationship, used to indicate the entites it is derived from.

To complement this data modeling JupiterOne provides an enhanced "Unified" view which auto-displays when querying for `UnifiedDevice` entities. This view is intended to provide an intuitive view of the hierarchical data represented in the graph.

![FIND UnifiedDevice Showcase](/assets/images/unified-device-showcase-69d28c4bdb686d523fda6a8c3cc9385f.png)

## Searching for Unified Devices

There are lots of ways to search for Unified Devices, the most simple approach is to use the following J1QL query to directly open the `UnifiedDevice` unified view:

```j1ql
FIND UnifiedDevice
```

This unified view is the most intuitive way to view the Unified Device data, and typically meets the needs of most users. As you interact with the filters on the left you will see the data dynamically update, but also the query used to power the view. This can help build queries you may wish to use in dashboards or alerts.

### Visualising Relationships

Visualise the `IS` relationships between the Unified Device and their source Device or Host entities:

```j1ql
FIND UnifiedDevice
  THAT IS (Device|Host)
RETURN TREE
```

### Finding Over-Correlated UnifiedDevices

Find Unified Devices that represent more than one source Device or Host entity:

```j1ql
FIND UnifiedDevice AS t
  THAT IS (Device|Host) AS s
RETURN t.displayName, COUNT(s) AS sources
ORDER BY sources DESC
```

This query will show you the `UnifiedDevice` entities that have the most source entities linked to them. If there is bad / invalid data on source devices it can cause a `UnifiedDevice` to have many source entities linked to it (i.e. over-correlation). This is a good query to find that situation.

### Finding Unified Devices with context

Looking at Unified Devices that are protected by a Host Agents

```j1ql
FIND UnifiedDevice
  THAT IS (Device|Host)
  THAT PROTECTS HostAgent
RETURN TREE
```

Finding Owners of Unified Devices

```j1ql
FIND UnifiedDevice
  THAT IS (Device|Host)
  THAT OWNS User
RETURN TREE
```

![FIND UnifiedDevice with Owners](/assets/images/unified-device-owners-73451f10093054745cb9eab52702e076.png)

## Derived Properties

Unified Devices have 3 additional properties that are derived from the source `Device` and `Host` entities, or their extended relationships in the graph. Each of these properties is available as a filter on the left hand side of the Unified view.

![Unified Device Derived Properties](/assets/images/unified-device-derived-properties-2a0d14e813b2a5ee017eabb36833a514.png)

> **INFO**
> 
> The derived properties rely on the relevant integrations to provide the required information. JupiterOne is continually reviewing integrations to ensure that all relevant properties are ingested where available. If you believe a property should be available for a specific integration please let us know!

### Encrypted

This propery is a rollup of the `encrypted` property from the source `Device` and `Host` entities. On a `Host` or `Device` this property should be a boolean value. On a `UnifiedDevice` entity it will roll up to one of four values:

Encrypted if any of the source `Device` or `Host` entities have the `encrypted` property set to `true`, and there are no conflicting values

Not Encrypted if any of the source `Device` or `Host` entities have the `encrypted` property set to `false`, and there are no conflicting values

Conflicting if some of the source `Device` or `Host` entities have the `encrypted` property set to `true` and some are set to `false`

Unknown if none of the source `Device` or `Host` entities have the `encrypted` property set, i.e. encrypted is `undefined` for all sources

### Managed

The `managed` property is summary of the incoming relationships to the source `Device` and `Host` entities. If the Unified Device has any sources that have an incoming `MANAGES` relationship it will be set to `Managed`. If the Unified Device does not have any such sources the propery will be set to `Not Managed`.

Managed if any of the source `Device` or `Host` entities have an incoming `MANAGES` relationship.

Not Managed if none of the source `Device` or `Host` entities have an incoming `MANAGES` relationship.

The J1QL equivalent for when this property is `Managed`:

```j1ql
FIND UnifiedDevice
  THAT IS (Device|Host)
  THAT MANAGES *
```

To find the specific sources that contribute to a Unified Device's Managed status, you can use the following J1QL query:

```j1ql
FIND UnifiedDevice WITH _id = <The _id of the UnifiedDevice>
  THAT IS (Device|Host)
  THAT MANAGES *
RETURN TREE
```

### Protected

The `protected` property is summary of the incoming relationships to the source `Device` and `Host` entities. If the Unified Device has any sources that have an incoming `PROTECTS` relationship it will be set to `Protected`. If the Unified Device does not have any such sources the propery will be set to `Not Protected`.

Protected if any of the source `Device` or `Host` entities have an incoming `PROTECTS` relationship.

Not Protected if none of the source `Device` or `Host` entities have an incoming `PROTECTS` relationship.

The J1QL equivalent for when this property is `Protected`:

```j1ql
FIND UnifiedDevice
  THAT IS (Device|Host)
  THAT PROTECTS *
```

To find the specific sources that contribute to a Unified Device's Protected status, you can use the following J1QL query:

```j1ql
FIND UnifiedDevice WITH _id = <The _id of the UnifiedDevice>
  THAT IS (Device|Host)
  THAT PROTECTS *
RETURN TREE
```

## How Does it Work?

The device unification process is multi-step, and will not happen immediately. The three main phases of the process are:

1.  **Creation**: The `UnifiedDevice` entity is created from the source `Host` and `Device` entities.
2.  **Correlation**: The `UnifiedDevice` entity is correlated with other `UnifiedDevice` entities.
3.  **Merging**: Highly correlated `UnifiedDevice` entities are merged.

Depending on the size of your graph and the number of integrations you have enabled, this process can take some time to complete.

### Source Data

The unified representation is driven from the data found in `Device` and `Host` entities in your graph. Any integration or custom data that creates such entities will be part of the Unified Device experience.

Unified Device expects to find the following normalized properties on the source `Device` and `Host` entities:

| Property | Type | Description | Notes |
| --- | --- | --- | --- |
| `ipv4Addresses` | `string[]` | The IPv4 addresses of the device, public or private |  |
| `ipv6Addresses` | `string[]` | The IPv6 addresses of the device, public or private | IPv6 Addresses should be in their long format (e.g. `2607:FB90:1000:0000:0000:0000:0000:0001`) |
| `macAddresses` | `string[]` | The MAC addresses of the device | MAC Addresses should be lowercase and colon delineated (e.g. `a4:83:e7:25:3e:f1`). Managed or randomized MAC addresses should be excluded where possible |
| `publicIpAddresses` | `string[]` | The public IP addresses of the device, both IPv4 and IPv6 | IP addresses that do not fall under private or reserved ranges |
| `privateIpAddresses` | `string[]` | The private IP addresses of the device, both IPv4 and IPv6 | IP addresses that fall under private or reserved ranges |
| `hostname` | `string` | The hostname of the device, or the leaf node of the FQDN | Case should be preserved. This is just the hostname, not the FQDN. For example the output of `hostname -s` |
| `fqdn` | `string` | The fully qualified domain name of the device | Case should be preserved. This is the FQDN for the host. For example the output of `hostname -f` |
| `serial` | `string` | The serial number of the device | As close as possible to the BIOS serial number. For example the output of `dmidecode -t system` on Linux, `ioreg -l | grep IOPlatformSerialNumber` on macOS, or `wmic csproduct get uuid` on Windows |
| `deviceId` | `string[]` | Other unique identifiers for the device |  |
| `lastSeenOn` | `date` | The last seen date of the device |  |
| `make` | `string` | The hardware make of the device | The hardware manufacturer for the device, such as `Dell`, `HP`, `Lenovo`, etc. |
| `model` | `string` | The hardware model of the device | The device model, such as `PowerEdge R740`, `EliteBook 840 G3`, `ThinkPad X1 Carbon 7th`, etc. |
| `osName` | `string` | The name of the operating system |  |
| `osType` | `string` | The type of the operating system |  |
| `osDetails` | `string` | The details of the operating system |  |
| `osVersion` | `string` | The version of the operating system |  |
| `status` | `string` | The status of the device |  |

> **INFO**
> 
> Only some of these properties are used for correlation, although where possible integrations and custom data uploads should include as many of these properties as possible.

### Correlation and Unification

There are various weighted properties that are used to determine if two devices are the same. The most important property is the `serial` property, which has a very strong weighting to determine if two devices are the same.

Additional correlation properties include `deviceId`, `macAddresses`, `hostname`, `fqdn`, `privateIpAddresses`, and `publicIpAddresses`.

It is possible to view the correlations either between two UnifiedDevice entities that have not been merged, or between the source Hosts and their UnifiedDevice representations.

---

Source: /features/assets/identity-unification

# Identity Unification

JupiterOne has a unified entity `UnifiedIdentity` class of object, and replace the existing `Person` entities with this new entity.

Note that the entities still carry the `Person` class, so any existing queries against `Person` will continue to work, although some properties are changed (see below).

## What is UnifiedIdentity?

The legacy `User -IS-> Person` mapping logic relies on the legacy system mapper engine, which will no longer be supported from April 2025. The legacy engine relied on per-integration rules that were difficult to maintain and provided good, but not perfect results. The new Unifier (as first released for UnifiedDevice) has proven to be significantly more accurate in it's unification and has additional capabilites regarding latency and self-healing.

In summary we can provide a better user experience and a more reliable adherance to the data model with the new system.

## What are the features?

THe most notable feature is the Unified view for identities. You will be able to access this view by running the query `FIND UnifiedIdentity` which will give you the canonical list of all identies in the system and their source `User` objects.

This view will also give you easy filtering for some new derived properties, specifically `admin`, `active`, and `mfa`; allowing for easy filtering of potentially vulnerable or over-privilidged identities.

## What do you need to do?

Nothing! The deployment of the `UnifiedIdentity` system is automated and as soon as you ingest compatible `User` entities it will start to show the `UnifiedIdentity` records. It is recommended to review the data model for UnifiedIdentity to understand how these entities are derived and how they can be queried.

## What Properties will be available?

The `UnifiedIdentity` entities have the following properties available:

| Property | Format | Notes | Correlation |
| --- | --- | --- | --- |
| `username` | `String[]` | A set of the source `username` values from the source `User` entities. | yes |
| `email` | `String[]` | A set of the source `email` values from the source `User` entities. | yes |
| `shortLoginId` | `String[]` | A set of the source `shortLoginId` values from the source `User` entities. This property is normalized in the integrations and derived from the `email` property, removing the domain element and any plus aliasing. | yes |
| `firstName` | `String[]` | A set of the source `firstName` values from the source `User` entities. | yes |
| `lastName` | `String[]` | A set of the source `lastName` values from the source `User` entities. | yes |
| `emailDomain` | `String[]` | A set of the source `emailDomain` values from the source `User` entities. |  |
| `employeeId` | `String[]` | A set of the source `employeeId` values from the source `User` entities. |  |
| `userIds` | `String[]` | A set of the source `userIds` values from the source `User` entities. |  |
| `active` | `enum {'Active', 'Not Active', 'Unknown', 'Conflicting'}` | A derived property from the source `User` entites `isAdmin` property |  |
| `admin` | `enum {'Admin', 'Not Admin', 'Unknown', 'Partial Admin'}` | A derived property from the source `User` entites `isActive` property |  |
| `mfa` | `enum {'MFA Enabled', 'No MFA', 'Unknown', 'Conflicting'}` | A derived property from the source `User` entites `isMfaEnabled` property |  |
| `guest` | `enum {'Guest', 'Empplyee', 'Unknown', 'Conflicting'}` | A derived property from the source `User` entities `isGuest` property |  |

---

Source: /features/assets/ingesting-assets

# Ingesting assets

Before diving into all the functionality JupiterOne has to offer, we first need to start bringing assets into your JupiterOne workspace. There are several options available for you when ingesting resources into JupiterOne. Most commonly, JupiterOne leverages integrations with tools your organization uses in order to dynamically populate a majority of your assets for you.

## Using JupiterOne's integrations

JupiterOne features over [180 built-in integrations](https://www.jupiterone.com/integrations) with leading industry technologies. By initializing integrations within JupiterOne, you can begin pulling in assets from your organization’s tools and applications. Once configured, integration instances will pull in and automatically update assets from each respective integration to ensure that your asset data is always up-to-date.

[Learn more about configuring JupiterOne integrations →](/integrations.md)

## Custom ingestion

Outside of the common ingestion options, JupiterOne also features the ability to import your own data for use within assets. You may want to utilize this function if JupiterOne does not officially support an integration you wish to source data from within your workflow, or if you’d like to enrich existing data within JupiterOne by providing additional data points.

[Learn more about importing custom data into JupiterOne →](/features/assets/custom-data-ingestion.md)

## Creating Assets within JupiterOne

Within JupiterOne, you have the ability to create and import your own assets directly into your workspace. This allows you to add additional assets beyond what is populated from your integrations and provides flexibility to ingest data points that might play a role in your environment that aren’t automatically ingested to the workspace.

[Learn more about importing custom data into JupiterOne →](/features/assets/create-assets-in-j1.md)

### What's next

With data feeding into JupiterOne, you can review your assets from within the Assets tab. Continue on to the next article to learn more about the various ways in which you can import your data and manage your assets within your JupiterOne workspace.

---

Source: /features/assets/relationships-across-scopes

# Create relationships between owned and non-owned assets

When forming relationships between assets you own and assets you don't (e.g., assets ingested by an integration), you will need to use a `_key` and include a `_source` and `_scope` of the existing entities in the graph. This guide explains the correct way to create relationships between assets you own and those you do not. By following the instructions outlined below, you will be able to successfully create relationships and view the desired data in the graph.

It is important to note that when seeking to pass a source or scope via API, it should be done so as `source` or `scope`–without underscores. When retrieving the metadata property or querying an existing source or scope, it will need to be notated as `_source` or `_scope`–with underscores.

When providing a source or scope via graphQL query (without underscores), JupiterOne adds the underscores when the source or scope is added to the entity properties, as this is our standard pattern for metadata properties.

> **TIP**
> 
> For managing relationships between entities in different scopes at scale, consider using the `CROSS_SCOPE` sync mode. This specialized mode is designed specifically for creating cross-scope relationships and requires the use of `_fromEntityScope` and `_toEntityScope` fields. See the [`CROSS_SCOPE` sync mode documentation](/api/sync-jobs/cross-scope.md) for more details.

## Ownership and subgraphs

The concept of ownership in JupiterOne determines what you see. What is not obvious when viewing the graph is that the graph you see is the aggregation of many subgraphs. There are subgraphs for the AWS integration, the system mapper, and API ingested data among other things.

All of these different subgraphs provide a cohesive set of results. These subgraphs denote ownership. For example, if a certain subgraph owns `entity A`, it means that `entity A` is in that subgraph. Ownership is important because it is how JupiterOne interprets datasets.

A subgraph is created by fusing the `source` and the `scope` of an entity together. For example, `api:your-api-call` could be a subgraph. These subgraphs provide identity to your data in the JupiterOne. When interacting with assets that are owned by various subgraphs, you must be specific in your interactions so the resulting graph is how you expect it to look.

## Getting started

For this guide, we'll be working with the an example available within our JupiterOne Node.js client repo, [here](https://github.com/JupiterOne/jupiterone-client-nodejs/tree/main/examples/sync-api).

Running this example provides you with the necessary ephemeral data owned by an `integration-managed` source. The example creates data controlled by the `integration-managed` and `api` sources, and it also creates a relationship between those two assets.

## Acquiring Assets in the Graph to Form Relationships

After you have compiled the assets that you want to upload to JupiterOne, you still must acquire assets from the JupiterOne graph in order to form the relationships. Therefore, the first step is to acquire our `integration-managed` data.

If you have run the [example scenario above](https://github.com/JupiterOne/jupiterone-client-nodejs/tree/main/examples/sync-api), you should have newly-created [CodeRepos](https://github.com/JupiterOne/jupiterone-client-nodejs/blob/main/examples/sync-api/src/data/code-repos.json) in your graph to query. The example code uploads assets into JupiterOne in an `integration-managed` scope. This upload enables us to work with assets that is outside of your scope (`api`).

To acquire the `integration-managed` data, you can use the following query to retrieve the newly-created `CodeRepos`:

```j1ql
FIND github_repository
    WITH from = 'testing'
```

Here is an example response payload from one of the `CodeRepos`:

```json
{
    "_class": [
        "CodeRepo"
    ],
    "_type": [
        "github_repository"
    ],
    "_key": "MDEwOlJlcG9zaXRvcnkxNjkzMzI3NTQ=",
    "displayName": "ibzibid",
    "_integrationType": "github",
    "_integrationClass": [
        "ITS",
        "SCM",
        "VCS",
        "VersionControl"
    ],
    "_integrationDefinitionId": "1babe084-d58d-4ff0-9d98-e0d9bb8499be",
    "_integrationName": "JupiterOne",
    "_beginOn": "2022-01-19T20:26:17.842Z",
    "_id": "2218b983-139b-4447-9889-f04f48761b15",
    "_integrationInstanceId": "40d8cd20-054e-4b77-82bd-f01af7593170",
    "_rawDataHashes": "eyJkZWZhdWx0IjoiMUlKVFNaT00vM2FwQmtWTWt0alYxcml6ZjZsRGFNa1VTRHBvakxIR2sxVT0ifQ==",
    "_version": 18,
    "_accountId": "j1dev",
    "_deleted": false,
    "_source": "integration-managed",
    "_createdOn": "2020-03-23T19:10:09.298Z"
}
```

## Forming the Relationship

The next step is to form relationships between assets you own and assets you do not. There are two primary options for creating a relationship:

```text
{
    _fromEntityKey: string;
    _toEntityKey: string;
    _fromEntityId: string;
    _toEntityId: string;
}
```

You can form the relationship in the following ways:

-   `CodeRepo` `_key` -> `CodeModule` `_key`
-   `CodeRepo` `_id` -> `CodeModule` `_key`

Keep in mind that you do not have the `CodeModule` `_id` yet, which is important because these two options are _NOT_ equal in how they behave.

Forming a relationship using the `_id` of the `CodeRepo` and the `_key` of the CodeModule works because the `_id` is unique in all of the data in your account. The `_key` value is _NOT_ globally unique, meaning that two assets can have the same `_key`.

When you form a relationship with two `_key` values and you do not specify the `source` and the `scope` of the data that already exists in the graph, JupiterOne does not understand which asset you are referencing and, therefore, does not create the relationship. Because two assets could have the same `_key`, the software needs more information to be able to identify the asset you are referencing.

### Acquiring more information

To acquire more information, use the `source` and `scope` of your JupiterOne data with the `_key`!

```text
{
    _fromEntitySource: string;
    _toEntitySource: string;
    _fromEntityScope: string;
    _toEntityScope: string;
}
```

This:

-   `CodeRepo` `_key` -> `CodeModule` `_key`
-   `CodeRepo` `_id` -> `CodeModule` `_key`

Should actually be:

-   `CodeRepo` `_key`, `_source`, `_scope` -> `CodeModule` `_key`
-   `CodeRepo` `_id` -> `CodeModule` `_key`

In JSON, it looks like this:

```js
{
    _fromEntitySource: entityFrom.entity._source,
    _fromEntityScope: entityFrom.entity._integrationInstanceId,
    _fromEntityKey: entityFrom.entity._key,
    _toEntityKey: entityTo.entity._key,
}
```

## Putting It Together

Now that you know how to form relationships with assets that you do not own, here is what your [bulk upload](/api/sync-jobs/api-reference.md) payload should look like put together:

```json
{
    "entities": [
        {
            "_key": "npm_package:hizurur",
            "_class": "CodeModule",
            "_type": "npm_package",
            "displayName": "hizurur",
            "from": "testing"
        },
        {...}
    ],
    "relationships": [
        {
            "_key": "codeRepo:USES:codeModule",
            "_type": "codeRepo:USES:codeModule",
            "_class": "USES",
            "displayName": "USES v3.4.3",
            "_fromEntitySource": "integration-managed",
            "_fromEntityScope": "integration_id",
            "_fromEntityKey": "codeRepo_key",
            "_toEntityKey": "npm_package:hizurur"
        },
        {...}
    ]
}
```

After you have uploaded the data, use the query posted earlier in the guide in JupiterOne to view your results:

```j1ql
FIND CodeModule
WITH displayName = ('hizurur' OR 'carnud' OR 'vici' OR 'iti' OR 'jifguilo' OR 'kiwoj' OR 'juvhove')
AND from = 'testing'
THAT USES << CodeRepo
```

### Conclusion

By following this guide, you can successfully create relationships between assets you own and those you do not. This will allow you to effectively manage your data and leverage the full capabilities of JupiterOne's graph.

---

Source: /features/assets/sbom

# Software Bill of Materials (SBOM)

## Overview

The SBOM (Software Bill of Materials) integration scans container images from your registry to generate comprehensive software inventories and identify vulnerabilities. It uses [Syft](https://github.com/anchore/syft) for SBOM generation and [Grype](https://github.com/anchore/grype) for vulnerability detection.

Use JupiterOne to understand the risks in your software supply chain, track all components in your container images, and prioritize security issues based on EPSS (Exploit Prediction Scoring System) data.

![JupiterOne SBOM View](/assets/images/sbom-main-c83b15211cc4a12f23139a2229557a69.png)

## Prerequisites

-   Container registry with images to scan
-   Registry credentials (if private)
-   Access to configure JupiterOne integrations
-   JupiterOne collector deployed and running

## Key Features

-   **Container Image Scanning**: Analyzes container images in your registry
-   **Package Discovery**: Identifies all packages and dependencies within images
-   **Vulnerability Detection**: Scans for known CVEs and security vulnerabilities
-   **Dependency Mapping**: Creates relationships between packages and their dependencies
-   **EPSS Scoring**: Includes Exploit Prediction Scoring System data for prioritization

## Data Collection

The current SBOM integration works as a registry scanner, and is run using the JupiterOne Collector. This ensures that the images are processed in your infrastructure and not transmitted to JupiterOne.

## Configuration

### Collector Setup

Before configuring the SBOM integration, you must have a JupiterOne collector deployed:

1.  **Deploy a Collector**: If you haven't already, deploy a [JupiterOne collector](/integrations/development/collector.md) in your environment
2.  **Verify Connectivity**: Ensure the collector can reach your container registry
3.  **Select Collector**: When configuring the integration, select the appropriate collector from the dropdown

### Integration Configuration

When configuring the integration you will need to provide the following information:

1.  **Registry**
    
    -   The URL of your container registry
    -   Example: `docker.io`, `gcr.io/my-project`, `123456789.dkr.ecr.us-east-1.amazonaws.com`
2.  **Registry Username** (optional)
    
    -   Username for private registry authentication
    -   Required if your registry needs authentication
3.  **Registry Password** (optional)
    
    -   Password for private registry authentication
    -   Must be provided together with username
4.  **Images** (`images`)
    
    -   Comma separated list of image names to scan
    -   Format: `image1:tag1, image2:tag2`
    -   If no tag is specified for an image, defaults to `latest`
    -   Example: `myapp:v1.0, database:latest, frontend`

### Verifying Data Collection

To confirm that you have data from the SBOM integration run the following command:

```j1ql
FIND sbom_container_image
```

## How It Works

1.  **Collector Execution**: The JupiterOne collector runs the SBOM integration on your configured schedule
2.  **Image Scanning**: The integration uses Syft to scan each configured image and generate an SBOM in JSON format
3.  **Package Discovery**: Extracts all packages, libraries, and dependencies from the image layers
4.  **Vulnerability Analysis**: Runs Grype against the SBOM to identify known vulnerabilities
5.  **Entity Creation**: Creates JupiterOne entities for:
    -   Container Images (`sbom_container_image`)
    -   Packages (`sbom_software_package`)
    -   Vulnerabilities (`sbom_vulnerability`)
    -   Findings (`sbom_finding`)
6.  **Relationship Mapping**: Establishes relationships between:
    -   Image scanned and the contained packages
    -   Packages and their inter-dependencies
    -   Packages and their vulnerabilities

## The Software Bill of Materials (SBOM) View

In addition to the standard JupiterOne interfaces (i.e. Query, Dashboards, Rules) JupiterOne provides a dedicated view for interacting with the SBOM data in your account. You can access this page by navigating to Assets > SBOM.

This view shows high level metrics for your account, as well as a filterable table of `Image` and `CodeModule` entities. The table also provides summary details of Vulnerabilities found in your images and code modules.

## Data Model

The Data Model for SBOM data is relatively straightforward. The primary SBOM payload and associated Vulnerabilities is modelled as follows:

### Entities Created

#### sbom\_container\_image

-   Represents a scanned container image
-   Properties include: name, tag, registry, digest, OS info
-   \_class: `["Image"]`
-   \_type: `sbom_container_image`

#### sbom\_software\_package

-   Represents a software package/library found in the image
-   Properties include: name, version, type, language, licenses, CPEs, PURL
-   \_class: `["CodeModule"]`
-   \_type: `sbom_software_package`

#### sbom\_vulnerability

-   Represents a known security vulnerability
-   Properties include: CVE ID, severity, CVSS scores, EPSS data, fix information
-   \_class: `["Finding", "Vulnerability"]`
-   \_type: `sbom_vulnerability`

### Entity Relationships

In addition to the core data model the following relationships are also created:

-   A mapped relationship from the `sbom_container_image` to any other `Image` that shares the same digest
-   The `sbom_vulnerability` entity will create a `UnifiedVulnerability` entity that will be enriched

## Useful Queries

### What Images do I have that are not scanned?

This query can help you find images that JupiterOne knows about, but which do not have a related SBOM scanned

```j1ql
FIND Image
  THAT !IS sbom_container_image
```

### What Packages have Vulnerabilities

```j1ql
FIND CodeModule
  THAT HAS >> Vulnerability
```

### What Images have Vulnerabilities

```j1ql
FIND Image
  THAT CONTAINS >> CodeModule
  THAT HAS >> Vulnerability
```

### What Versions of a package am I using

```j1ql
FIND CodeModule WITH name ~= 'imagemagick' AS cm
RETURN cm.version, COUNT(cm)
```

For more details on specific major/minor versions

```j1ql
FIND CodeModule WITH name ~= 'imagemagick' AS cm
RETURN cm.name, regex(cm.version, '(?<major>\d+)\.(?<minor>\d+)\.\d+\.'), COUNT(cm)
```

## Common Use Cases

1.  **Supply Chain Security**: Track all components in your container images
2.  **Vulnerability Management**: Identify and prioritize security issues
3.  **Compliance**: Generate SBOMs for regulatory requirements
4.  **Dependency Analysis**: Understand package relationships and potential risks
5.  **License Compliance**: Track open source licenses in your containers

## Troubleshooting

> **NOTE**
> 
> The integration host machine (i.e. the host running The Collector) must have sufficient disk storage available to download the images, the Grype vuln database, and the SBOM manifests. The exact amount of storage needed will depend on the size, complexity, and number of images to be scanned.

### Collector Issues

-   Verify collector is running and healthy
-   Check collector logs for connectivity errors
-   Ensure collector has network access to registry
-   Confirm collector is selected in integration configuration
-   Confirm sufficient local disk space to hold images and manifest

### Authentication Errors

-   Verify registry URL is correct
-   Ensure username/password are valid
-   Check if registry requires specific authentication methods (NOTE: only username/password authentication is currently supported)

### Image Not Found

-   Verify image name and tag exist in registry
-   Check registry URL format
-   Ensure you have pull permissions

### Scan Failures

-   Check if image architecture is supported
-   Verify Syft/Grype can access the registry
-   Review integration logs for specific error messages

---

Source: /features/assets/smart-classes

# Smart Classes

Smart Classes are a mechanism to annotate assets with additional business and technical context, enabling you to enhance your IT management and security use cases. Some intended use cases for Smart Classes include annotating assets with:

-   Criticality levels and business impact
-   Accessibility information, such as whether they are publicly accessible
-   SLAs, RPO, RTO, and other risk tracking metrics

Once assets have been assigned to a Smart Class, you can update your queries to filter on Smart Classes. This allows you to be more granular with the assets that form part of your posture management program, apply compliance control tests to a subset of all organizational assets, or use Smart Classes to inform your risk-based vulnerability management program.

## Defining Smart Classes

> **NOTE**
> 
> Smart Classes are queryable by the name you provide them, which means you cannot change the name once set.

> **NOTE**
> 
> Smart Classes are evaluated when their configuration changes and then daily thereafter. You can manually click the **Evaluate Now** button under the Smart Class page if you need a one-off evaluation.

![New Smart Class](/assets/images/smart-classes-overview-0cc75d8aa1f7afe8a59c543a076bd936.png)

To access Smart Classes, open the **Smart Classes** item in the navigation bar to go to the dedicated Smart Classes page. Smart classes also appear in the **Smart classes** group of the class list on the **Assets** page, where you can select one to filter your assets down to it.

On the Smart Classes page, click a smart class to view the results of its query. To edit an existing smart class, use the **Edit** button on its row, which opens an edit modal.

To create a new smart class, click **New Smart Class**, give it a name and a detailed description, and click **Create**. The choice of name is important as it defines how you refer to the Smart Class and you won't be able to change it once set.

Next you will need to add the queries that power the Smart Class. Click **New query** and then provide a description as well as the query for the Smart Class. Click **Run Query** and confirm the query is returning the results you expect before clicking **Create**. You can add up to 5 queries per Smart Class, if you need to annotate more data, it is suggested to write broader queries that cover multiple subsets.

Finally, add any other tags to power the use cases you are interested in. Examples of tags that could be useful could be `businessImpact`, `RPO`, `owner`, `SLAs`. Special tags that unlock further JupiterOne functionality are:

-   `businessImpact` - used to prioritise findings as part of our CTEM offering
-   `attackPathTarget` - used to build attack paths as part of our CTEM offering
-   `owner` - used to build relationships to the owner entities

![Smart Class Defition](/assets/images/smart-classes-definition-c272db0d3620902914381eeee2058e49.png)

## Querying Smart Classes

Smart classes should be considered as a subgraph of your entire graph that only contains entities with additional context captured in the smart class. The additional context can be business-related, like asset criticality or owner group, or technical, like whether the assets are EOL or publicly accessible. When building your posture management, vulnerability management, or compliance use cases, you can use the following query patterns to only query for assets that are in your smart class.

### Using Smart Class Instance

The first way to query smart classes is by directly referring to the smart class. Smart classes are queryable by using the hash character before the name of the smart class. Some example queries that follow this pattern include:

-   `FIND #Sev1`
-   `FIND Finding THAT HAS #Sev1`

### Using Smart Classes as a Filter

Beyond directly referencing the smart class as in the above example, it is also possible to use the smart class as a filter. For example, if you are only interested in your DataStores with a certain criticality, you could use the following queries:

-   `FIND #Sev1 DataStore`
-   `FIND AccessRole THAT ALLOWS #Sev1 aws_s3_bucket`

### Using Smart Class Tags

Finally, smart classes can also be referenced by using tags. This is helpful if you want to find entities that belong to multiple smart classes. For example, if you want to find public entities that belong to a certain severity level, you can run the following queries:

-   `FIND DataStore WITH tag.Sev1=true AND tag.Public=true`

---

Source: /features/assets/whats-new-in-assets

# Assets Release Notes

**Release date: July 7, 2026**

JupiterOne has rebuilt Assets on its modern app foundation. Everything you relied on before is still here, and the rebuild brought a few improvements worth calling out.

## What is new

| Change | What it means for you |
| --- | --- |
| Smart Classes in the class list | Your Smart Classes now appear alongside your other classes on the Assets page - no separate place to look |
| Critical assets are a Smart Class | The critical asset toggle is replaced by the `CriticalAsset` Smart Class, so criticality works like any other Smart Class |
| Open a Smart Class to see its results | Clicking a Smart Class opens the results of its query; editing it happens in a modal so you keep your place |
| Filters at the top of entity pages | On entity pages, the filters now sit at the top where they're easy to find |

## Smart Classes live alongside your classes

Your Smart Classes now show up in the same list of classes on the Assets page as the rest of your classes. Instead of treating Smart Classes as a separate area, you browse them right next to your other classes — one list, one place to look.

![The Assets page class list showing Smart Classes listed alongside the standard classes, expanded to show individual Smart Classes like CriticalAsset](/assets/images/smart-classes-in-class-list-fb583201b604cfdb2d0c86e98d983723.png)

## Critical assets are now a Smart Class

The standalone critical asset toggle has been replaced by a `CriticalAsset` Smart Class. Criticality is now expressed the same way as any other Smart Class, so you define and query it with the same tools you already use for the rest of your Smart Classes.

## Open a Smart Class to see its results

Clicking a Smart Class in the list opens the results of its query, so you go straight to the assets it captures. To make changes, click the **Edit** button that appears on the Smart Class row — it opens in a modal over your list, so you can adjust it and close it to land exactly where you left off.

## Filters where you expect them

On entity pages, the filters now sit at the top of the page. Narrowing down your assets starts right where you're looking, so it's quicker to find what you need.

---

Source: /features/assets/working-with-assets

# Working with assets

JupiterOne Assets enables you to see all your digital assets (entities) in one table or graph, allowing you to centralize your data and gain valuable context around your assets. Assets are organized into categories such as people and organization and networks.

![JupiterOne Assets View](/assets/images/assets-main-1e0a53a013948575a7fb017851e89141.png)

There are several ways to filter the large list of entities displayed in Assets:

-   Filter by class and/or type using the left panel
-   Filter by smart class
-   Add granular property filters from the filter bar at the top of the results

> **INFO**
> 
> Find more information around the default asset types in our data model [here](/data-model/jupiterone-data-model.md).

## Filter by smart class

Smart classes appear in the **Smart classes** group in the left panel, alongside your other classes. Select a smart class to filter the results to the assets it captures.

Critical assets are now expressed as the `CriticalAsset` smart class rather than a separate quick filter. If you previously used critical assets, your definition was migrated to a smart class.

> **INFO**
> 
> See our dedicated guide to find [additional information on smart classes](/features/assets/smart-classes.md).

## Quick Filter All Assets

Assets are organized into the categories you see listed in the left panel of the Asset landing page. Click any of those categories to bring the category into focus. These categories are:

-   Applications & Services
-   Compute & Devices
-   Data & Storage
-   Identities & Access
-   Network
-   People & Organization
-   Policy & Documentation
-   Risks & Alerts
-   Other
-   Custom
-   Smart classes

### Asset classes and types

Each category has classes of assets, and each class has types. In the following example, the category is Applications & Services, the class is `Application`, and the selected type is `kandji_app`.

![Quick filter assets example](/assets/images/asset-quick-filter-type-e722c3ab4ba2ff8c92980eb719aa20ec.png)

The `_class` of an asset is an abstract label that defines what the asset is within the concept of security operations similarly to categories, which are groups of like classes.

The `_type` of an asset represents its specific type of entity as defined by its source. For more details, see the JupiterOne Data Model documentation.

### Asset properties

When you select any asset in the results table, its detailed properties open in a side panel (the inspector).

To filter by properties, use the filter bar at the top of the results. Click **Add filter**, choose a property and operator, and set a value. Active filters appear as chips you can remove, and **Clear filters** resets them.

> **INFO**
> 
> You can find additional information around asset properties within our dedicated guide: [working with properties](/features/assets/working-with-properties.md).

---

Source: /features/assets/working-with-properties

# Working with properties

> **WARNING**
> 
> Editing asset properties in the UI has been deprecated. The properties panel is now read-only, so enriching or modifying property values, bulk-editing owner and tags, and resetting values are no longer available in the app. To update or enrich entities, use the [JupiterOne API](#updating-entities-via-the-api).

When JupiterOne ingests your asset data, properties are also ingested and other JupiterOne-specific properties are assigned to the asset. Asset properties enable you to understand more context around a particular asset and search for assets that have a specific property.

![JupiterOneAsset property panel](/assets/images/asset-properties-panel-5163a2a472c89cf17d5b078e3c396e79.png)

## Accessing the graph inspector

The asset detailed properties side panel (the inspector) opens when you click on any of your assets (entities) anywhere in the JupiterOne UI, including in query or search results.

In addition to properties, JupiterOne ingests and/or assigns metadata and tags. JupiterOne also ingests raw data to document exactly what the source sent in its raw form. Reviewing the raw data enables you to verify what JupiterOne ingested in case the source has any additional information.

## Updating entities via the API

Entity properties are no longer editable in the UI. To update or enrich entities — including their properties, tags, and owner — use the JupiterOne API:

-   [Sync jobs API](/api/sync-jobs/overview.md) — upload or update assets and relationships in quantity, formatted as JSON or YAML.
-   [JupiterOne API reference](/reference.md) — read and update data programmatically through the GraphQL endpoint.

> **INFO**
> 
> If the asset data was ingested by an integration, we recommend updating the data at the source rather than in JupiterOne, so the change persists across syncs.

---

Source: /features/ccm/ccm-1-2

# CCM 1.2 Release Notes

**Release date: February 19, 2026**

Continuous Control Monitoring 1.2 transforms CCM from a technical, JSON-import-driven tool into an accessible experience for your entire compliance team. With UI-based authoring, AI-assisted control creation, and enterprise governance workflows, you can now build and manage your control library without developer assistance or J1QL expertise.

## What is new in CCM 1.2

| Feature | What it means for you |
| --- | --- |
| UI-based framework and requirement authoring | Create your compliance structure directly in the UI — no JSON imports required |
| AI-assisted control authoring | JupiterOne AI generates control descriptions, remediation steps, identifiers, and source catalogs from a title |
| AI-assisted control test creation | Describe what you want to test and JupiterOne AI writes the J1QL query for you |
| Control lifecycle management | Govern controls through Draft, Review, Live, and Retired states |
| Control effectiveness indicators | See at a glance whether controls have datapoints, are passing, or need attention |
| Integration awareness | Know which integrations your control tests depend on before you save |
| Control properties and ownership | Assign owners, define remediation steps, and track exception processes per control |
| Entitlement management | Transparent usage metering based on your Live control count |

## Create frameworks and requirements in the UI

Previously, creating a custom compliance framework required importing a JSON file. Now you can build your entire compliance structure directly in the JupiterOne UI.

You can:

-   Create new frameworks with a title and description using the markdown editor
-   Add requirements within a framework, each with an identifier, priority, and description
-   Edit existing frameworks and requirements inline
-   Delete frameworks and requirements with soft-delete protection

This means compliance managers can define and maintain custom frameworks without developer help or file preparation.

![Framework creation UI](/assets/images/framework-creation-ui-042b6bb2b6715e6e357aabc9f1450c15.png)

> **TIP**
> 
> You can still use the **Use Common Framework** option to start from an out-of-the-box CIS benchmark (including AWS, Azure, GCP, Microsoft 365, GitHub, Oracle Cloud Infrastructure, and Kubernetes), then customize it with your own requirements. If you need a framework that is not listed, click **Request a new Framework** to submit a request.

## Author controls with AI assistance

JupiterOne AI dramatically reduces the time it takes to author a new control. Instead of writing every field from scratch, you enter a control title and JupiterOne AI generates the rest.

**How it works:**

1.  Navigate to a requirement and click **Add a control**
2.  Enter a descriptive title (for example, "S3 Bucket Encryption Control")
3.  Click **Draft control with AI** — JupiterOne AI auto-generates:
    -   Control description
    -   Remediation steps
    -   Identifier
    -   Source catalog
4.  Review and edit any field — AI suggestions are not mandatory

JupiterOne AI uses context from the linked requirement to improve suggestion quality. You maintain full control over the final content.

> **NOTE**
> 
> AI-assisted generation is available when creating a new control. When editing an existing control, you update fields manually.

![AI-assisted control authoring](/assets/images/ai-assisted-control-authoring-95382d4e6218653a23c068e30f0b0170.png)

> **TIP**
> 
> JupiterOne AI is trained on CIS Controls v8.0, so it generates consistent, industry-standard language. You can always edit the output to match your organization's terminology.

## Create control tests with AI-generated queries

You no longer need J1QL expertise to create control tests. Describe what you want to validate and JupiterOne AI writes the query for you.

> **NOTE**
> 
> AI-assisted query generation is available when creating a new control test. When editing an existing test, you update the query manually.

**How it works:**

1.  From a control, click **New control test**
2.  Enter a descriptive title (for example, "S3 buckets without encryption enabled")
3.  Select the test type: **Compliant assets** or **Non-compliant assets**
4.  Click **Generate query** — JupiterOne AI generates the J1QL query based on your title and the control context, and automatically runs it so you can review matching entities
5.  Save the test

**Mirror test creation:** After you save a Non-compliant assets test, CCM prompts you to add a corresponding Compliant assets test (and vice versa) with the test type pre-selected. This ensures comprehensive coverage with minimal effort.

![AI-generated control test query](/assets/images/ai-generated-control-test-18266e9f767bc4a5baaebf2f636c563e.png)

> **TIP**
> 
> Always review the query results before saving. The results grid shows you exactly which entities match, so you can verify the query logic is correct. Click **Run J1QL** to re-run the query if you make manual edits.

## Control lifecycle management

CCM 1.2 introduces enterprise-grade governance for your control library. Every control now moves through a defined lifecycle, preventing untested or unapproved controls from affecting your compliance posture.

**Lifecycle states:**

| State | Purpose |
| --- | --- |
| **Draft** | Control is being developed. This is the default state for new controls. |
| **Review** | Control is ready for validation by your team. |
| **Live** | Control is active and affects compliance scoring. |
| **Retired** | Control is no longer active but preserved for audit history. |

**Key behaviors:**

-   Only **Live** controls are evaluated during compliance scoring
-   Every state transition is recorded in an audit trail with optional notes
-   You can filter your control library by lifecycle state (under **More filters** > **State**)
-   Only **Live** controls count toward your entitlement limits

![Control lifecycle management](/assets/images/control-lifecycle-d8f9ea98afd76a6a0d4af4defd77df9e.png)

> **TIP**
> 
> Use the **Review** state as a quality gate. Controls in Review are visible to your team for validation but do not affect your compliance scores or entitlement usage.

## Control effectiveness at a glance

CCM 1.2 adds clear status indicators so you can instantly understand whether your controls are working.

**Control test statuses:**

-   **No Datapoints** — The test query returned no matching entities, preventing false failures when data is unavailable.
-   Control tests that are effective (passing) are not decorated with a special status.

**Control statuses:**

-   **No Control Tests** — The control has no tests configured.
-   **No Datapoints** — All of the control's tests lack datapoints.
-   Controls with at least one passing test that has datapoints show standard pass/fail results.

Status rolls up from the test level to the control level, and from the control level to the requirement level. You can see at every layer of your compliance hierarchy where attention is needed.

![Control effectiveness indicators](/assets/images/control-effectiveness-67e05918940c54c15e0c90ea53977d39.png)

## Integration awareness

CCM 1.2 automatically detects which integrations a control test queries and gives you real-time feedback on eligibility.

**How it works:**

-   When you author a control test, the UI shows which integrations provide data for your query
-   If no matching entities exist for a test (for example, you have no AWS integrations but the test queries `aws_s3_bucket`), the test shows **No Datapoints**
-   Tests with no datapoints are skipped during evaluation — they do not produce false failures

This prevents the common "why is my control failing?" confusion that occurs when a test queries data from an integration you have not configured.

![Integration awareness display](/assets/images/integration-awareness-747872826a2d1d51b7393e186d2226dc.png)

## New control properties

Controls in CCM 1.2 include richer properties that support accountability and operational workflows:

-   **Title** — Clear, descriptive name for the control
-   **Identifier** — Reference code for sorting and filtering (for example, "IAM-001")
-   **Catalog** — Logical grouping for the control (for example, "CIS Controls v8"). Select an existing catalog or create a new one.
-   **Description** — What the control validates and why (AI-assisted on create)
-   **Remediation** — Steps to take when the control is failing (AI-assisted on create)
-   **Exception Process** — How to handle approved exceptions for this control
-   **Owner** — The JupiterOne user responsible for this control

Assigning a **Control Owner** enables accountability and allows you to filter your control library and see who is responsible for a given control.

## Entitlement management

CCM 1.2 provides transparent usage metering so you always know where you stand relative to your entitlement.

-   Usage is based on your **Live** control count
-   Controls in **Draft**, **Review**, or **Retired** states are excluded from your limit

This means you can freely develop and stage controls without worrying about exceeding your entitlement until you move them to Live.

## Getting started

**If you are an existing CCM user:** Your existing controls are automatically set to **Live** status. No migration action is required. You can begin using lifecycle management, AI authoring, and the new UI features immediately.

**If you are new to CCM:** Follow these steps to get started:

1.  Navigate to **Controls** > **Frameworks** and click **Add a framework** to create your first framework (or choose an out-of-the-box CIS benchmark)
2.  Add requirements to your framework
3.  Create controls within your requirements — use JupiterOne AI to accelerate authoring
4.  Add control tests to validate each control — let JupiterOne AI generate the J1QL queries
5.  Move controls through the lifecycle: **Draft** → **Review** → **Live**
6.  Monitor effectiveness from the framework and requirement views

For full feature documentation, see [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md).

---

Source: /features/ccm/ccm-1-3

# CCM 1.3 Release Notes

**Release date: April 2026**

Continuous Control Monitoring 1.3 gives every persona on your compliance team their own view of compliance posture. Framework Owners see board-ready scorecards across all frameworks. Control Owners see the status of their controls at a glance. OU Owners see compliance scoped to their team - without asking the central compliance team for a report. Daily digest emails surface changes proactively so that nothing falls through the cracks.

## What is new in CCM 1.3

| Feature | What it means for you |
| --- | --- |
| Framework compliance scorecards | See compliance health, failing requirements, and coverage across every framework in one view |
| Worst-results sorting | Failing requirements surface first, prioritised by severity, so you focus on what matters |
| Requirement drill-down | Inspect controls, test results, and remediation steps without leaving the framework view |
| Framework compliance export | Generate board-ready PDF and CSV reports filtered to exactly what you need |
| Controls Status View | Unified view of control health with "My Controls" default - see what you own and its status |
| Organisational units | Integration instances automatically become OUs, scoping compliance data to teams |
| Framework and control ownership | Assign Framework Owners alongside Control Owners for clear accountability |
| Daily digest emails | Proactive notifications for Framework Owners, Control Owners, and OU contacts |

## Framework compliance scorecards

You can now see the compliance health of every framework at a glance. The new **Framework Compliance View** provides a scorecard for each framework showing health percentage, failing requirements, and control coverage.

**What you see:**

-   A card-based grid of all your frameworks with name, controls coverage, and passing percentage
-   Filter and search to find specific frameworks quickly
-   Click any framework card to drill into its details

**Framework detail view:**

When you open a framework, a summary header shows key metrics:

-   **AI Generated analysis** - A strategic summary of your framework
-   **Framework health percentage** - overall compliance score
-   **Failing requirements** - total count of requirements not passing
-   **High-priority failing requirements** - critical failures that need immediate attention

Below the header, requirements are listed with their status, priority, and control mappings grouped by section. The detail view includes an **Framework overview** tab (the new compliance view) and a **Manage** option in the top right (the existing CCM 1.2 authoring UI).

![Framework Compliance View showing scorecard grid with health percentages and coverage](/assets/images/ccm-framework-overview-c33547cc9f36f9a0257f3f339427282d.png)

> **TIP**
> 
> Use the Framework Compliance View export to generate a board-ready compliance report. The PDF includes the JupiterOne logo and metadata, and the CSV provides one row per requirement for further analysis. Both formats respect your active filters.

## Critical-results sorting

Requirements within a framework are filtered so that the most critical failures can be shown. You do not need to scroll through passing requirements to find the ones that need attention.

**How it works:**

-   Requirements are filtered by failure count and priority (High, Medium, Low)
-   Status tabs - **All**, **Failing**, **Passing** - let you toggle the view with live counts
-   Each requirement card shows a priority badge, test counts, failure counts, and a description preview
-   Failing requirements display a red **Failing** chip

![Framework detail view with requirements sorted by priority and failure count](/assets/images/ccm-framework-detail-cbc60bcae2af24a3c7c573329e618dff.png)

## Requirement drill-down

Click any requirement's control to open a detail drawer with:

-   **Summmary** - The description of the control that monitors this requirement, details of the last evaluations, owner of impacted assets
-   **Control tests** - The specific control tests for this requirement, what integrations they interact with, their status
-   **Control remediation** - Remediation details for the control
-   **Exception process** - Exception process details for the control

You can click **Open control page** to navigate to the full control detail.

![Requirement drill-down drawer with control summary and test details](/assets/images/ccm-requirements-drilldown-3d7a5a320703ed7c6f425d3c3e5fab7f.png)

> **TIP**
> 
> Combine the filter bar with the drill-down to quickly triage failures. Filter by priority and status, then click into each failing requirement to review its controls and remediation steps.

## Framework compliance export

You can export your framework compliance status as a PDF or CSV at any time.

-   **PDF** - Includes the JupiterOne logo, framework metadata, and compliance status. Suitable for board reporting and executive summaries.
-   **CSV** - One row per requirement with columns for identifier, name, status, priority, control count, test count, failing tests, and last evaluated timestamp. Suitable for further analysis in spreadsheets.

Both formats respect your active filters, so you can export exactly the subset of data you need.

## Controls Status View

The new **Controls Status View** gives Control Owners and Asset Owners a single place to see the health of their controls.

**Default experience:**

-   The view defaults to **My Controls** if you own any controls - showing only the controls assigned to you
-   Each control displays its status (pass, fail, error, or not evaluated), last evaluated timestamp, and linked framework
-   A summary header shows total controls, passing count, failing count, and pass rate
-   Sort, filter, and search to find specific controls quickly

Clicking on a control takes you to that control's summary page. You can then drill down further into the individual control tests.

**Control test drill-down:**

Click any control test to see:

-   Test result history / Live results with status and timestamps
-   Linked assets / results with individual pass/fail status
-   Specific failure reasons and affected assets

**Filter and search:**

-   Filter inline by status, resource group, framework, or active/inactive state
-   Open **More filters** for lifecycle state, effectiveness, attested status, catalog, and org units
-   Filters use AND logic and are reflected in the URL for shareable links
-   A **Clear Filters** action resets all filters at once

**Export:**

Export the current view as a CSV respecting all active filters. Columns include control name, status, last evaluated, framework, and owner.

![Controls Status View with My Controls filter and summary header](/assets/images/ccm-my-controls-1313d895dafd704690b2eff509349e7b.png)

## Organisational units

CCM 1.3 introduces organisational units (OUs) that scope compliance data to teams. In this release, each integration instance automatically becomes an OU - no manual setup is required.

For full documentation of the OU capability - the admin interface, the OU filter in Compliance and Vulnerability Management, and the OU metadata on entities - see [Organizational Units](/features/admin/organizational-units.md).

**How it works:**

-   Every integration instance in your account automatically appears as an OU
-   All graph entities carry an `_ou` property linking them to their integration instance
-   The OU lifecycle is tied to the integration instance lifecycle - when you add or remove an integration, the corresponding OU is created or removed

**OU admin overview:**

Navigate to the OU admin page (Settings > Organizational Units) to see a table of all your OU groupings with:

-   OU name and integration type
-   Entity count
-   Metadata: Primary and Secondary Owners, Jira project, and Slack channel (coming soon)
-   OUs without routing metadata are indicated "missing" so you know what needs configuration

**Routing metadata:**

For each OU, you can configure operational routing metadata:

-   **Owner email** - The primary and secondary people responsible for this OU
-   **Jira project** - For ticket assignment from compliance drill-downs (coming soon)
-   **Slack channel** - For notifications (coming soon)

All fields are optional. Changes persist immediately and are available via the API.

![OU admin overview with integration instances and routing metadata](/assets/images/ou-admin-15b3e93badb7327fd1d425102a8ec330.png)

> **NOTE**
> 
> In this release, OUs are derived from integration instances. Future releases will expand the OU model to support custom organisational structures.

## OU-scoped compliance views

When you select an OU in the Org Units filter (under **More filters**), the Controls Status View and drill-down filter to show only controls with results related to assets in that organisational unit.

**How it works:**

1.  Open **More filters** on the Controls page and select an OU from the **Org units** filter
2.  The controls list filters to show only controls with assets in the selected OU
3.  The summary header adapts to show the OU name and OU-specific compliance metrics
4.  The drill-down shows which assets within the selected OU are affected, with individual pass/fail status

The OU selection persists in the URL, so you can share a link to a specific OU's compliance view with a team member.

![Controls Status View with OU selector filtering to a specific organisational unit](/assets/images/ccm-ou-picker-e45b91dc390ff8888d2980938707fcde.png)

> **TIP**
> 
> Use OU-scoped views to give each team lead a self-service compliance view. An IT or Cloud Ops leader can select their OU and immediately see their team's compliance posture without asking the central compliance team.

## Framework and control ownership

CCM 1.3 adds **Framework Owners** alongside the existing Control Owners from CCM 1.2.

-   Assign an owner to any framework using the user search and select dropdown
-   Framework Owners can filter to see **My Frameworks** for a focused view
-   Ownership enables targeted daily digest emails (see below)

The Framework Owner assignment follows the same pattern as Control Owner assignment - select any JupiterOne user from the dropdown.

## Daily digest emails

CCM 1.3 delivers proactive compliance notifications so you do not need to check the dashboard manually. Each digest summarises actionable status changes and includes deep links back to the relevant view with pre-configured filters.

**Framework Owner digest:**

-   Daily summary of compliance status for all frameworks you own
-   Includes total frameworks owned, passing and failing counts, and compliance scores
-   Per-framework breakdown with status details
-   Only sent when actionable results exist - no noise on quiet days

**Control Owner digest:**

-   Daily summary of status for all controls you own
-   Includes total controls owned, passing and failing counts
-   Per-control breakdown
-   Deep links to the Controls Status View filtered to your controls

**OU contact digest:**

-   Daily summary sent to the email address configured in the OU routing metadata
-   Includes OU name, integration type, entity count, and compliance score
-   Lists failing controls within the OU
-   Contacts responsible for multiple OUs receive one consolidated email with each OU as a separate section

> **NOTE**
> 
> Digest emails are only sent when there are actionable results. If all your controls are passing and nothing has changed, you do not receive an email.

## Getting started

**If you are an existing CCM user:** All new features are available immediately. Your existing control ownership assignments are preserved. To take advantage of the new views:

1.  Navigate to **Compliance** > **Frameworks** to see the new Framework Compliance View
2.  Click any framework to see the compliance scorecard and drill-down
3.  Navigate to **Compliance** > **Controls Status** to see the unified Controls Status View
4.  Assign Framework Owners to enable framework-level digest emails
5.  Configure OU routing metadata (owner email, Jira project, Slack channel) in the OU admin page to enable OU contact digests

**If you are new to CCM:** Start with the [CCM 1.2 setup steps](/features/ccm/ccm-1-2.md#getting-started) to create your frameworks, requirements, and controls. Once your control library is in place, the CCM 1.3 features - scorecards, status views, OU scoping, and digest emails - activate automatically.

For full feature documentation, see [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md).

---

Source: /features/ccm/ccm-1-4

# CCM 1.4 Release Notes

**Release date: June 2026**

Continuous Control Monitoring 1.4 introduces **Control Attestations**. Until now a control's status came solely from its control tests: any failing test made the control fail, and a control with no tests had no status. There was no first-class, audited way to say "this control is satisfied by evidence that lives outside JupiterOne" - a vendor SOC 2 report, a risk acceptance, or a manual process - and have that reflected in your compliance posture.

Attestations close that gap. An authorised user can formally justify a control for a defined period; when no control test already covers it, the control is then reported as **Attested** - a pass, with a caveat - with the full justification retained for audit and automatic re-failure when the attestation expires. An attestation never overrides a _failing_ test, so it can't mask a real gap.

## What is new in CCM 1.4

| Feature | What it means for you |
| --- | --- |
| Control Attestations | Record external or compensating evidence against a control and have it count toward compliance for a bounded time |
| Attested status | A control passing _solely_ by a valid attestation (no contributing test) reports as **Pass**, with an **Attested** note in the Effectiveness column - a pass with a caveat, never a hidden failure |
| Combined control view | Attestations and control tests now live in one **Control tests and attestations** section on the control page |
| Automatic expiry | When an attestation expires the control automatically re-fails, so a lapsed justification can never silently mask a gap |
| Compliance rollups & filters | Valid attested controls count as passing in scorecards, framework counts, and digests; you can filter the controls list by **Attested** |
| Expiry reminder emails | Attestation owners get a weekly email of attestations expiring soon or already expired, and the daily Control and OU digests now count the controls passing by attestation |

## Control Attestations

An **attestation** is a record that justifies a control's compliance using evidence outside of its automated tests. Create one from the control detail page when you have control-edit permission.

**Each attestation captures:**

-   **Subject** - a short title for the justification (e.g. "Vendor SOC 2 Type II report")
-   **Description** - the supporting detail, in markdown
-   **Expiry date** - when the justification lapses and the control re-evaluates
-   **Owner** - the person responsible for renewing it
-   **Document link** - an optional link to supporting evidence

Attestations are effective immediately - there is no approval workflow in this release. A control can carry more than one attestation (for example, one per vendor); the rules for how multiple attestations combine are described in [How attestations affect control status](#how-attestations-affect-control-status) below.

> **NOTE**
> 
> Attestations apply to **live** controls. The justification, edit, and revocation history is retained in the audit trail independently of the control, so revoking or expiring an attestation never erases the record of why it existed.

## Attested status - a pass with a caveat

When a control passes **solely** by a valid attestation - it has no contributing control test - its status is reported as **Pass**, and the **Effectiveness** column shows an **Attested** note. The Attested marker makes clear the pass is backed by evidence rather than a passing test. A control that already passes on its tests stays a plain **Pass**; a control with a _failing_ test still **Fails** - an attestation never masks it.

-   Scorecards, framework compliance counts, and daily digests count valid attested controls as **passing**.
-   The controls list still lets you find them: open **More filters** and filter by **Attested** to see exactly which controls are passing by attestation rather than by test.
-   An expired attestation is **not** a pass - the control fails (see below).

![Controls list showing an Attested control - Pass status with an Attested effective status](/assets/images/attestation-controls-list-b378ce48ec9b1a833fd990693d769621.png)

## Combined "Control tests and attestations" view

The control detail page now presents a single **Control tests and attestations** section. Attestations appear **above** the control tests. Because a failing test always fails the control - an attestation never masks it - the section calls out the two cases worth explaining: a control _passing by attestation_ (a valid attestation with no contributing test), and a control _failing despite an attestation_ (a failing test you still need to fix or archive).

This keeps everything about a control's compliance in one place: you can see the justification and the underlying test results together, and never have an attestation quietly hide a failing test.

![Passing by attestation: a valid attestation carries a control that has no contributing test](/assets/images/attestation-passing-by-attestation-3e9f4077103c7d1c1e4008f8d2e6c0be.png)

![Failing despite an attestation: a failing control test still fails the control](/assets/images/attestation-control-combined-c30a459431b2beac830849a4860f5f4a.png)

## How attestations affect control status

A control's status weighs its control tests and its attestations **together** - an attestation never overrides a failing test. Revoked attestations are removed and never count. The table below shows the resulting status for every combination:

| Control tests | Attestations | Control status |
| --- | --- | --- |
| None contributing | None (or only revoked) | Not evaluated |
| None contributing | At least one valid attestation | **Pass** _(Attested)_ |
| Passing | None or valid | **Pass** |
| Failing | Any (valid or not) | **Fail** |
| Any | Any non-revoked attestation expired | **Fail** |

**The key rules:**

-   A **failing** control test always **Fails** the control - an attestation never masks it. To pass a control whose test is failing, fix the failing test, or archive the test if it no longer applies and let a valid attestation carry the control.
-   **Attested** is reserved for a control that passes _solely_ by a valid attestation, with no contributing test. A control that already passes on a test stays a plain **Pass**.
-   If **any** non-revoked attestation has **expired**, the control **Fails** - even over passing tests. One lapsed justification fails the control, so an expiry is never overlooked.
-   **Revoking** an attestation removes it from the calculation; the control reverts to whatever its tests (or remaining valid attestations) say.

## Automatic expiry handling

Attestation expiry is a time event, so CCM re-evaluates attested controls on a recurring schedule (within 24 hours) in addition to recomputing immediately whenever an attestation is created, edited, or revoked. A control whose only attestation lapses returns to failing automatically - even if it has no control tests that would otherwise trigger a re-evaluation.

To renew an attestation before it lapses, open the control and **Edit** the attestation to extend its expiry date. Each attestation in the **Control tests and attestations** list shows its current state (active, expiring soon, expired, or revoked) so you can spot upcoming expiries.

## Expiry reminder emails

Because a lapsed attestation re-fails its control, CCM reminds the people who can act on it - before and after an attestation lapses - rather than relying on them to check each control.

**Weekly attestation digest.** Each attestation **owner** receives a weekly email summarising the attestations they own that need attention:

-   **Already expired** - attestations whose date has passed, so the control is failing now. These are listed first, as they need the most urgent action.
-   **Expiring soon** - attestations due to expire within the next 30 days, so you can renew them before the control re-fails.

Each entry shows the attestation's subject, its expiry date, and a link to the control where you renew it. The email is sent only to owners who actually have something expiring or expired - if nothing needs attention, no email goes out - and revoked attestations are never included. The email also links to your **Attested** controls so you can review everything currently passing by attestation in one place.

**Attestation coverage in the daily digests.** The existing [daily Control Owner and OU contact digests](/features/ccm/ccm-1-3.md#daily-digest-emails) now also report how many of your controls are **passing by attestation**, so the attested portion of your posture is visible alongside the passing and failing counts.

## Getting started

**If you are an existing CCM user:** Control Attestations are available immediately on your live controls.

1.  Open any live control from **Compliance** > **Controls Status**.
2.  In the **Control tests and attestations** section, choose **Add an attestation**.
3.  Enter the subject, description, expiry date, owner, and an optional document link, then save.
4.  The control's status updates to **Pass** with an **Attested** note; it will automatically re-fail if the attestation expires.
5.  On the controls list, open **More filters** and use the **Attested** filter to review everything currently passing by attestation.

**If you are new to CCM:** Start with the [CCM 1.2 setup steps](/features/ccm/ccm-1-2.md#getting-started) to create your frameworks, requirements, and controls, then layer attestations on top where automated tests cannot tell the whole story.

For full feature documentation, see [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md#control-attestations).

---

Source: /features/ccm/continuous-control-monitoring

# Continuous Control Monitoring

JupiterOne's Continuous Control Monitoring (CCM) provides enterprise teams with automated, graph-powered validation of security control effectiveness across your entire technology ecosystem.

Designed for organizations with existing governance frameworks and dedicated compliance programs, CCM helps Platform Engineering, DevOps, and Security Architecture teams continuously validate that controls defined in your governance systems are working as intended in your actual infrastructure.

## Overview

Continuous Control Monitoring enables your team to:

-   **Automate control validation** using JupiterOne's graph-powered query engine to continuously test control effectiveness
-   **Monitor control status in real-time** across all your integrated cloud platforms, security tools, and IT infrastructure
-   **Map controls to multiple frameworks** including CIS benchmarks for AWS, Azure, GCP, and other standards
-   **Detect configuration drift** automatically as your infrastructure changes
-   **Visualize control health** through dashboards showing compliance status and control test results
-   **Bridge the gap** between governance requirements and actual infrastructure reality

![CCM Overview Dashboard](/assets/images/ccm-overview-dashboard-10c1effb27c582b5be73807eeb3b6625.png)

The CCM Overview Dashboard provides an at-a-glance view of your control monitoring status, showing:

-   **Total Controls**: Complete count of all controls being monitored
-   **Compliant Controls**: Number of controls with all tests passing
-   **Non-Compliant Controls**: Number of controls with one or more tests failing
-   **Compliance trends over time**: Historical view of how control compliance changes
-   **Failing controls by account**: Breakdown of which cloud accounts or integrations have the most issues

**JupiterOne's Unified Control Framework:**

JupiterOne uses [CIS Controls v8.0](https://www.cisecurity.org/controls/v8) as the unified control list for all out-of-the-box content. All mappings between different security standards (SOC 2, CIS standards, NIST etc.) and JupiterOne-managed controls follow the CIS v8.0 mapping framework. This provides a consistent, industry-standard foundation for cross-framework control reuse and ensures that a single control implementation can satisfy requirements across multiple compliance standards.

## Data Model

CCM uses a four-level hierarchy to organize your compliance and security program:

```text
Framework
  └── Requirement
        └── Control
              └── Control Test
```

| Level | What it answers | Owned by | Example |
| --- | --- | --- | --- |
| **Framework** | What standards do we follow? | External standards body or your organization | CIS v8, SOC 2, HIPAA, or an internal security policy |
| **Requirement** | What must we achieve? | The framework | "Maintain an inventory of enterprise assets" |
| **Control** | How do we meet the requirement? | Your organization | "Automated asset discovery via JupiterOne integrations" |
| **Control Test** | Is our control actually working? | Your organization | J1QL query: `FIND aws_iam_user WITH mfaEnabled != true` |

A single control can satisfy multiple requirements across different frameworks, and each control can have multiple control tests for comprehensive validation.

### Framework properties

| Property | Description |
| --- | --- |
| **Title** | Name of the framework |
| **Description** | Overview of the framework's purpose and scope (markdown) |

### Requirement properties

| Property | Description |
| --- | --- |
| **Title** | Name of the requirement |
| **Identifier** | Reference code from the framework (for example, "CC6.1" or "IDAM3.5"). Used for sorting and filtering. |
| **Priority** | Criticality level: Critical, High, Medium, or Low |
| **Description** | What the requirement mandates (markdown) |

### Control properties

| Property | Description |
| --- | --- |
| **Title** | Name of the control |
| **Identifier** | Reference code for the control. Used for sorting and filtering. |
| **Catalog** | Logical grouping for the control (for example, "CIS Controls v8"). You can select an existing catalog or create a new one. |
| **Owner** | The JupiterOne user responsible for the control |
| **State** | Lifecycle state: Draft, Review, Live, or Retired |
| **Description** | What the control does and why it matters (markdown, AI-assisted on create) |
| **Remediation** | Steps to take when the control is failing (markdown, AI-assisted on create) |
| **Exception Process** | How to handle approved exceptions (markdown) |
| **MITRE technique** | The MITRE ATT&CK technique this control relates to (for example, "T1078" or the sub-technique "T1059.001"). Optional. |

### Control test properties

| Property | Description |
| --- | --- |
| **Title** | Name of the test |
| **Type** | Whether results represent **Compliant assets** or **Non-compliant assets** |
| **J1QL** | The query that runs against your JupiterOne asset graph |

## View and Manage Modes

CCM has two modes that separate day-to-day monitoring from authoring workflows:

-   **View mode** — Use this mode to review CCM results. You can browse frameworks, requirements, controls, and control test outcomes. This is the default mode for users who need to monitor compliance posture without making changes.
-   **Manage mode** — Use this mode to author and edit frameworks, requirements, controls, and control tests. Switch to Manage mode when you need to create new content or modify existing definitions.

You can switch between modes using the toggle in the CCM navigation. View mode is read-only, so you cannot accidentally modify your control library while reviewing results.

> **NOTE**
> 
> View mode only displays **Live** controls and their results. Controls in Draft, Review, or Retired states are excluded from View mode counts and compliance metrics. Manage mode displays controls in all lifecycle states. This means framework control counts and compliance summaries will differ between the two modes.

## How CCM Works

CCM's core capability is continuous, automated validation of control effectiveness using JupiterOne's query engine.

### Automated Control Testing

**How Control Tests Work:**

1.  Each control has one or more test definitions
2.  Each test contains a J1QL query that runs against your asset graph
3.  Tests execute automatically on a regular schedule
4.  Control status updates based on whether all tests pass

#### Control Test Types

Each control test is either a **Compliant assets** test or a **Non-compliant assets** test. This determines how CCM interprets the query results.

| Test type | What it returns | How CCM interprets results |
| --- | --- | --- |
| **Compliant assets** | Resources that satisfy the control | Results are expected — the more, the better |
| **Non-compliant assets** | Resources that violate the control | Any results indicate a problem |

**Example Control Test:**

A control for "Centralize Account Management" might have two tests:

-   **Test 1 (Non-compliant assets)**: Query for users WITHOUT SSO authentication — any results indicate a violation
-   **Test 2 (Compliant assets)**: Query for users WITH verified SSO — results confirm the control is working

**Example Test Patterns:**

-   **Non-compliant assets test**: Find resources that violate the control
    
    ```j1ql
    FIND aws_s3_bucket WITH encrypted = false
    ```
    
-   **Compliant assets test**: Verify required resources or configurations exist
    
    ```j1ql
    FIND aws_cloudtrail WITH enabled = true
    ```
    

## Key Features

### Control Inventory and Management

CCM provides centralized monitoring of all your security and IT controls. The Controls list page displays:

![Controls Dashboard](/assets/images/controls-dashboard-d098de4bf768a0a7accb0334b8c016dc.png)

-   **Complete control inventory**: Searchable and filterable list of all controls being monitored
-   **Real-time status**: Current compliance state (Compliant/Non-Compliant/Not Configured) for each control
-   **Last evaluated timestamp**: When each control was last tested
-   **Filtering options**: Filter by status, resource group, framework, or active/inactive state inline; additional filters for lifecycle state, effectiveness, attested status, catalog, and org units are available under **More filters**

Each control can be clicked to view detailed information including:

-   **Control tests**: J1QL queries that validate whether the control is working
-   **Test results**: Actual data showing what passed or failed
-   **Framework mappings**: Which framework requirements this control satisfies

#### Viewing Control Test Results

When you click on a control, you can expand each test to see the J1QL query and actual results:

![Control Test Results](/assets/images/control-test-results-efb75b30501dc09837c59aabbe1751a0.png)

The control detail page shows:

-   **Control status**: Overall status badge (Compliant/Non-Compliant)
-   **Test list**: All tests defined for this control with individual pass/fail status
-   **J1QL queries**: Click to expand any test to see the exact query being run
-   **Query results**: Table view of actual assets that passed or failed the test
-   **Result count**: Total number of resources affected (e.g., "1-41 of 41" accounts)

This detailed view enables you to:

-   **Investigate failures**: See exactly which resources are violating the control
-   **Validate test logic**: Review the J1QL query to ensure it's testing the right thing
-   **Collect evidence**: Export query results for audit or remediation purposes
-   **Understand impact**: Identify which accounts or resources need attention

#### Viewing Control Framework Mappings

Click the **Requirements** tab on any control detail page to see which framework requirements this control satisfies:

![Control Requirements Tab](/assets/images/control-requirements-tab-1f8d0dba0c237378779afb7c111f259b.png)

The Requirements tab shows:

-   **Framework name**: Each framework the control maps to (e.g., "SOC 2 Trust Services Criteria", "CIS AWS Foundations Benchmark")
-   **Framework description**: Brief overview of what the framework covers
-   **Specific requirement**: The exact requirement within that framework (e.g., "CC6.1 | Logical and Physical Access Security")
-   **Edit Requirements button**: Add or remove framework mappings for this control
-   **Remove buttons**: Quickly unmap this control from a specific requirement

This view is useful for:

-   **Understanding control coverage**: See which compliance requirements this control helps satisfy
-   **Managing mappings**: Add this control to additional framework requirements or remove outdated mappings
-   **Cross-framework visibility**: Identify controls that satisfy multiple standards simultaneously
-   **Audit preparation**: Document which technical controls support each compliance requirement

### Framework Management

Track control coverage across multiple security and compliance frameworks simultaneously:

![Frameworks Dashboard](/assets/images/frameworks-dashboard-0c4990112700ccc9d2a948205b6c5f0b.png)

The Frameworks page shows:

-   **All available frameworks**: JupiterOne provides out-of-the-box CIS benchmarks including AWS, Azure, GCP, Microsoft 365, GitHub, Oracle Cloud Infrastructure, and Kubernetes, with additional frameworks available based on customer demand
-   **Total controls per framework**: How many controls are defined for each framework
-   **Passing controls**: How many controls are currently passing out of the total (for example, "6 passing out of 51")
-   **Framework descriptions**: Overview of what each framework covers

> **NOTE**
> 
> If you need a framework that is not listed, click **Request a new Framework** on the framework selection page to submit a request. JupiterOne will prioritize framework additions based on customer demand and configure controls relevant to your specific integrations.

Clicking into any framework provides detailed information about:

-   Framework requirements and their hierarchical structure
-   Which controls map to each requirement
-   Control test status for that specific framework
-   Gaps where requirements lack control coverage

#### Framework Details

Click on any framework from the Frameworks page to view comprehensive details:

![CIS Framework Details](/assets/images/cis-framework-details-a70058cba4d7cb134e8cbb5a4a0c2239.png)

The framework detail page shows:

-   **Framework overview**: Description and purpose of the framework
-   **Compliance metrics**: Total controls, passing controls, and overall compliance percentage
-   **Requirements list**: All requirements within the framework, organized hierarchically
-   **Control mappings**: For each requirement, see which controls provide coverage
-   **Control status**: Current pass/fail status for each mapped control
-   **Gap analysis**: Quickly identify requirements that lack control coverage

#### Matrix View

Frameworks whose requirements are organized into two or more sections also get a **Matrix** tab on the framework detail page. The matrix lays the framework out as a grid — one column per section, one cell per requirement — so you can see where a framework is failing at a glance instead of scanning a list. For a tactic-and-technique framework such as MITRE ATT&CK, this is the familiar technique-matrix view.

Each cell is colored by the health of the requirement's controls, with the exact counts printed in the cell as a second channel alongside the color:

-   **Compliance lens** (default): cells shade from green to red by the share of measured controls that are failing.
-   **Coverage lens**: cells shade by how many of the requirement's controls are actually measured — answering "what do I detect?" rather than "what is failing?".
-   **Not measured**: requirements whose controls have no test results yet render as dashed, uncolored cells in either lens.

Cells also carry markers for states worth spotting at a glance:

-   **Manual attestation**: at least one control passes solely on a valid attestation (see [Control Attestations](#control-attestations))
-   **Draft**: the requirement has controls in the draft lifecycle state
-   **Stale**: a live control has not been evaluated in the last two days

Click any cell to open that requirement in the Requirements tab. Section columns are collapsible from their headers, which also show each section's passing/failing distribution.

## Working with Frameworks

### Understanding Control-to-Requirement Mapping

Controls in CCM can map to requirements across multiple frameworks. This allows you to:

-   Reuse a single control definition across multiple compliance standards
-   See which frameworks a control helps satisfy
-   Understand the breadth of coverage provided by your control library
-   Identify opportunities to consolidate duplicate controls

## Creating and Managing Controls

### Creating a New Control

To create a new control in CCM:

1.  Navigate to a framework requirement in **Manage** mode
2.  Click **Add a control**
3.  Define the control properties:
    -   **Title**: A clear, descriptive name for the control
    -   **Identifier**: A reference code for sorting and filtering (for example, "IAM-001")
    -   **Catalog**: A logical grouping (for example, "CIS Controls v8"). Select an existing catalog or create a new one.
    -   **Description**: What the control validates and why it matters (JupiterOne AI can generate this from the title)
    -   **Remediation**: Steps to take when the control is failing (JupiterOne AI can generate this)
    -   **Exception Process**: How to handle approved exceptions for this control
    -   **MITRE technique**: The MITRE ATT&CK technique this control relates to (for example, "T1078"). Optional.
    -   **Owner**: The JupiterOne user responsible for maintaining and responding to this control
4.  Map the control to framework requirements
5.  Create control tests (J1QL queries) that validate the control

#### AI-Assisted Authoring

When you create a new control, JupiterOne AI can accelerate the process by generating content from your title:

1.  Enter a descriptive title for your control
2.  Click **Draft control with AI** — JupiterOne AI auto-generates the **Description**, **Remediation** steps, **Identifier**, and **Source Catalog**
3.  Review and edit any generated field — AI suggestions are not mandatory

JupiterOne AI uses context from the linked requirement to improve the quality of its suggestions.

> **NOTE**
> 
> AI-assisted generation is available when creating a new control. When editing an existing control, you update fields manually.

![AI-assisted control authoring](/assets/images/ai-assisted-control-authoring-95382d4e6218653a23c068e30f0b0170.png)

### Creating Control Tests

Control tests are the core of CCM's automated validation. Each test:

1.  **Contains a J1QL query** that runs against your JupiterOne asset graph
2.  **Defines expected outcomes** — whether the results returned are **Compliant assets** or **Non-compliant assets**
3.  **Runs automatically** on a regular schedule
4.  **Updates the control status** based on whether expectations are met

#### AI-Assisted Test Creation

You do not need J1QL expertise to create control tests. JupiterOne AI can generate queries from a natural language description:

> **NOTE**
> 
> AI-assisted query generation is available when creating a new control test. When editing an existing test, you update the query manually.

1.  From a control, click **New control test**
2.  Enter a descriptive title for what you want to test
3.  Select the test type: **Compliant assets** or **Non-compliant assets**
4.  Click **Generate query** — JupiterOne AI generates a J1QL query based on your title and the control context, and automatically runs it so you can review matching entities
5.  Save the test

**Mirror test creation:** After you save a test, CCM prompts you to add the corresponding inverse test with the test type pre-selected. For example, if you save a Non-compliant assets test, it prompts you to create a Compliant assets test. This ensures comprehensive coverage with minimal effort.

![AI-generated control test query](/assets/images/ai-generated-control-test-18266e9f767bc4a5baaebf2f636c563e.png)

### Managing Existing Controls

From the Controls list, you can:

-   **Search and filter** controls by status, resource group, framework, or active/inactive state; use **More filters** for lifecycle state, effectiveness, attested status, catalog, and org units
-   **View control details** by clicking on any control
-   **Edit control tests** to refine validation logic
-   **Update framework mappings** to map controls to additional requirements
-   **Review test results** to understand why a control is failing
-   **Assign an owner** to establish accountability for each control

### Control Catalogs

A catalog is a namespace for your controls. It groups controls by their origin or purpose, making it easier to organize and filter a large control library.

**Examples of catalogs:**

-   "CIS Controls v8" — controls based on the CIS benchmark
-   "Internal Security Policy" — controls defined by your organization
-   "AWS Hardening" — controls specific to your AWS environment

When you create or edit a control, the **Catalog** field behaves like a tag selector. You can select an existing catalog or type a new name to create one. A control belongs to exactly one catalog.

Use catalogs to:

-   **Organize by source**: Separate controls that come from different standards or internal teams
-   **Filter your library**: Quickly find all controls within a specific catalog
-   **Manage at scale**: When your control library grows beyond a few dozen controls, catalogs prevent the list from becoming unmanageable

### Control Lifecycle

Every control in CCM moves through a defined lifecycle that provides enterprise-grade governance for your control library.

**Lifecycle states:**

| State | Purpose |
| --- | --- |
| **Draft** | Control is being developed. This is the default state for new controls. |
| **Review** | Control is ready for validation by your team. |
| **Live** | Control is active and affects compliance scoring. |
| **Retired** | Control is no longer active but preserved for audit history. |

**Key behaviors:**

-   Only **Live** controls are evaluated during compliance scoring
-   Every state transition is recorded in an audit trail with optional notes
-   You can filter your control library by lifecycle state (under **More filters** > **State**)
-   Only **Live** controls count toward your entitlement limits
-   Controls in **Draft** or **Review** allow you to develop and validate without affecting your compliance posture

To transition a control, click the lifecycle badge on the control detail page, select the target state, and optionally add a note explaining the reason for the transition.

![Control lifecycle management](/assets/images/control-lifecycle-d8f9ea98afd76a6a0d4af4defd77df9e.png)

### Integration Awareness

CCM automatically detects which integrations a control test queries and provides real-time feedback on eligibility.

-   When you author a control test, the UI shows which integrations provide data for your query
-   If no matching entities exist for a test (for example, you have no AWS integrations but the test queries `aws_s3_bucket`), the test shows **No Datapoints**
-   Tests with no datapoints are skipped during evaluation — they do not produce false failures

This prevents confusion when a test queries data from an integration you have not configured.

![Integration awareness](/assets/images/integration-awareness-747872826a2d1d51b7393e186d2226dc.png)

### Control Effectiveness

CCM provides visual status indicators so you can instantly understand whether your controls are working.

**Control test statuses:**

-   **No Datapoints** — The test query returned no matching entities. This replaces false failures when data is unavailable.
-   Control tests that are effective (passing) are not decorated with a special status.

**Control statuses:**

-   **No Control Tests** — The control has no tests configured.
-   **No Datapoints** — All of the control's tests lack datapoints.
-   Controls with at least one passing test that has datapoints show standard pass/fail results.
-   **Attested** — The control is covered by a valid attestation. It reports as **Pass** with an **Attested** note in the Effectiveness column. See [Control Attestations](#control-attestations).

Status rolls up from the test level to the control level, and from the control level to the requirement level. You can see at every layer of your compliance hierarchy where attention is needed.

![Control effectiveness indicators](/assets/images/control-effectiveness-67e05918940c54c15e0c90ea53977d39.png)

## Control Attestations

Introduced in [CCM 1.4](/features/ccm/ccm-1-4.md), **attestations** let you justify a control's compliance using evidence that lives outside its automated tests - a vendor SOC 2 report, a risk acceptance, or a manual process - for a bounded period of time. A control covered by a valid attestation is reported as **Pass** (with an **Attested** note) instead of failing, and it automatically re-fails when the attestation expires.

Use an attestation when a control is genuinely satisfied but no automated test can prove it - rather than leaving the control failing or faking a test.

### Creating an attestation

From the detail page of a **live** control, in the **Control tests and attestations** section, choose **Add an attestation** (you need control-edit permission). An attestation captures:

| Field | Description |
| --- | --- |
| **Subject** | A short title for the justification (e.g. "Vendor SOC 2 Type II report") |
| **Description** | Supporting detail, in markdown |
| **Expiry date** | When the justification lapses and the control re-evaluates |
| **Owner** | The JupiterOne user responsible for renewing it |
| **Document link** | Optional link to supporting evidence (http/https) |

Attestations take effect immediately - there is no approval workflow. You can edit (renew/reassign) or revoke an attestation at any time. All create, edit, and revoke activity is retained in the audit trail independently of the control, so the record of _why_ a control was attested survives revocation, expiry, or deletion of the control.

![Create an attestation](/assets/images/attestation-create-modal-88aa9096a4a88b6bd70b9590151f5aa5.png)

### The combined Control tests and attestations view

A control's detail page shows a single **Control tests and attestations** section, with attestations listed **above** the control tests. A failing test always fails the control - an attestation never masks it - so the section calls out the two cases that need explaining: a control _passing by attestation_ (a valid attestation with no contributing test), and a control _failing despite an attestation_ (a failing test you still need to fix or archive).

This keeps the justification and the underlying test results visible together: an attestation never silently hides a failing test.

![Passing by attestation: a valid attestation carries a control that has no contributing test](/assets/images/attestation-passing-by-attestation-3e9f4077103c7d1c1e4008f8d2e6c0be.png)

![Failing despite an attestation: a failing control test still fails the control, with the way out called out above the tests](/assets/images/attestation-control-combined-c30a459431b2beac830849a4860f5f4a.png)

### Attested status

A control that passes **solely** by a valid attestation - it has no contributing control test - reports as **Pass**, with an **Attested** marker in the Effectiveness column. (A control that already passes on its tests stays a plain **Pass**; a control with a failing test still **Fails**.) Attested controls:

-   count as **passing** in framework scorecards, requirement rollups, control counts, and the daily digest;
-   can be isolated with the **Attested** filter on the controls list, so you can always see which controls are passing by attestation rather than by test;
-   are never a _hidden_ failure - an expired attestation fails the control.

![Controls list showing an Attested control - Pass status with an Attested effective status](/assets/images/attestation-controls-list-b378ce48ec9b1a833fd990693d769621.png)

### How attestations affect control status

A control's status weighs its control tests and its attestations **together** - an attestation never overrides a failing test. Revoked attestations are removed and never count. The result for every combination is:

| Control tests | Attestations | Control status |
| --- | --- | --- |
| None contributing | None (or only revoked) | Not evaluated |
| None contributing | At least one valid attestation | **Pass** _(Attested)_ |
| Passing | None or valid | **Pass** |
| Failing | Any (valid or not) | **Fail** |
| Any | Any non-revoked attestation expired | **Fail** |

**The rules in plain terms:**

-   A **failing** control test always **Fails** the control - an attestation never masks it. To pass a control whose test is failing, fix the failing test, or archive the test if it no longer applies and let a valid attestation carry the control.
-   **Attested** is reserved for a control that passes _solely_ by a valid attestation, with no contributing test. A control that already passes on a test stays a plain **Pass**.
-   If **any** non-revoked attestation has **expired**, the control **Fails** - even over passing tests. One lapsed justification fails the control, so an expiry is never overlooked. (Example: a control "all vendors have a current SOC 2 report" with one attestation per vendor - if any lapses, the control fails.)
-   **Revoking** an attestation removes it; the control reverts to whatever its tests, or any remaining attestations, indicate.

### Expiry and renewal

Because expiry is a time event rather than a change you make, CCM re-evaluates attested controls on a recurring schedule (within 24 hours), in addition to recomputing immediately whenever an attestation is created, edited, or revoked. A control whose only attestation lapses returns to failing automatically - even a control with no tests, which nothing else would re-evaluate.

To renew an attestation before it lapses, **Edit** it from the control's **Control tests and attestations** section and extend the expiry date. Each attestation shows its current state (active, expiring soon, expired, or revoked), so you can spot the ones that need attention.

### Expiry reminder emails

CCM proactively reminds attestation owners about expiries instead of relying on them to check each control:

-   **Weekly attestation digest** - each attestation owner receives a weekly email listing the attestations they own that have **already expired** (the control is failing now, shown first) and those **expiring within the next 30 days** (renew before the control re-fails). Every entry links to the control where you renew it, and shows the attestation's subject and expiry date. The email is sent only when an owner has something expiring or expired; revoked attestations are excluded. It also links to the **Attested** controls filter so you can review everything currently passing by attestation.
-   **Daily digests** - the Control Owner and OU contact [daily digests](/features/ccm/ccm-1-3.md#daily-digest-emails) now also count the controls that are **passing by attestation**, so attested coverage is visible alongside the passing and failing totals.

To stop receiving reminders for an attestation, renew it (extend the expiry) or revoke it if it no longer applies.

## Getting Started

### Step 1: Create or Import a Framework

1.  Switch to **Manage** mode using the toggle in the CCM navigation
2.  Navigate to **Frameworks** under the **Controls** tab in the nav bar
3.  Click **Add a framework**
4.  Choose one of the following options:
    -   **Use Common Framework**: Select an out-of-the-box CIS benchmark. If you need a framework that is not listed, click **Request a new Framework** to submit a request.
    -   **Create your own Framework**: Enter a title and description to build a custom framework directly
    -   **Upload Your Own Framework** (Beta): Import a PDF file
    -   **Paste Framework JSON**: Manually paste JSON configuration
5.  Select who has access to the framework by choosing a [resource group](/features/admin/access-controls.md#resource-groups). Resource groups control which users and groups can view and manage the framework. If you do not select a resource group, the framework is accessible to all users with CCM permissions.
6.  Add requirements to your framework, each with an identifier, priority, and description

### Step 2: Understand Your Control Library

1.  From the Controls page, review the list of existing controls
2.  Click on a control to see:
    -   What it validates (control description)
    -   How it validates (J1QL queries in control tests)
    -   What frameworks it maps to (Requirements tab)
    -   Current test results
    -   Lifecycle state and effectiveness

### Step 3: Create Your First Control

1.  From within a requirement, click **Add a control**
2.  Enter a title and click **Draft control with AI** — JupiterOne AI generates the description, remediation steps, identifier, and source catalog
3.  Review and edit the AI-generated content as needed
4.  Click **New control test** to add validation logic
5.  Describe what you want to test and click **Generate query** — JupiterOne AI generates and runs the J1QL query
6.  Review the results, then save

### Step 4: Manage the Control Lifecycle

1.  New controls start in **Draft** state
2.  When the control is ready for review, transition it to **Review**
3.  After validation, move the control to **Live** to include it in compliance scoring
4.  Add notes at each transition for your audit trail

### Step 5: Map Controls to Framework Requirements

1.  From a control detail page, click the **Requirements** tab
2.  Click **Edit Requirements** to add framework mappings
3.  Select the framework and specific requirement(s) this control satisfies
4.  Save your mappings

### Step 6: Monitor and Refine

1.  Return to the Overview Dashboard regularly to track control health
2.  Switch to **View** mode to review control status and identify controls that need attention
3.  Investigate non-compliant controls to understand root causes
4.  Refine control test queries based on false positives or misses
5.  Expand your control library to cover additional requirements

## Best Practices

To maximize the value of Continuous Control Monitoring:

### Start with Your Governance Framework

-   Begin with controls that are already defined in your IRM or governance system
-   Map those controls to framework requirements in CCM
-   Use CCM to automate the evidence collection and validation for those controls

### Design Effective Control Tests

-   **Write specific queries**: Focus on precise validation criteria rather than broad checks
-   **Use negative tests**: Often easier to detect violations (what shouldn't exist) than prove compliance
-   **Combine multiple tests**: Use both positive and negative tests for comprehensive coverage
-   **Test your queries first**: Run J1QL queries manually in the Query Builder before adding them as control tests
-   **Handle exceptions**: Consider using tags or properties to exclude known exceptions from test results

### Organize Controls Strategically

-   **Group by technology domain**: Separate controls for AWS, Azure, GCP, SaaS applications
-   **Map to multiple frameworks**: Reuse controls across frameworks where applicable
-   **Use consistent naming**: Follow a naming convention for easier management (e.g., "5.6 (AWS) | Control Name")
-   **Document control intent**: Write clear descriptions explaining what the control validates and why

### Integrate with Your Workflow

-   **Connect to your IRM**: Use JupiterOne's API to feed control status back to ServiceNow, Archer, or other governance platforms
-   **Set up alerts**: Configure alerts for critical control failures that need immediate attention
-   **Schedule reviews**: Regularly review control test results with your security and platform teams
-   **Track trends**: Monitor control compliance over time to identify systemic issues

### Scale Gradually

1.  Start with 10-20 critical controls for your most important framework
2.  Validate that tests are accurate and provide meaningful results
3.  Expand coverage to additional frameworks and control areas
4.  Refine test logic based on false positives or missed violations

---

Source: /features/ccm/custom-framework-json-upload

# Custom Framework JSON Upload

JupiterOne allows you to import custom compliance frameworks by pasting a JSON document directly in the UI. This is useful when you have an internal security policy, a regulatory framework, or any custom standard that is not available out of the box.

This guide documents the full JSON schema, all supported fields, and provides examples to help you build your framework JSON.

## How to Import

1.  Navigate to **Frameworks** under the **Controls** tab in the navigation bar
2.  Click **New Framework** in the top right
3.  Select **Paste Framework JSON**
4.  Paste your JSON document
5.  Click **Continue** to import

## JSON Schema Overview

A framework JSON document has three levels of nesting: the **framework** itself contains **requirements**, each requirement contains **controls**, and each control can optionally contain **control tests**.

```json
{
  "name": "Framework Name",
  "description": "Framework description",
  "requirements": [
    {
      "section": "Section Name",
      "displayName": "Requirement Name",
      "description": "Requirement description",
      "controls": [
        {
          "displayName": "Control Name",
          "controlTests": [
            {
              "name": "Test Name",
              "query": "FIND ... AS x RETURN x",
              "resultsAre": "GOOD"
            }
          ]
        }
      ]
    }
  ]
}
```

## Field Reference

### Framework (Top Level)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | string | Yes | The name of the framework (e.g., "ACME Internal Security Policy v2") |
| `description` | string | Yes | A description of what the framework covers |
| `requirements` | array | Yes | Array of requirement objects |

### Requirement

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `displayName` | string | Yes | The display name shown in the UI (e.g., "1.2 - Ensure MFA is enabled") |
| `description` | string | Yes | Detailed description of the requirement |
| `section` | string | No | Groups requirements into named sections in the UI. All requirements with the same `section` value are displayed together under that section heading. See [Requirement Sections](#requirement-sections) |
| `sequence` | string | No | Sort order identifier (e.g., "1.2", "2.1.3"). Used to order requirements in the UI |
| `title` | string | No | User-facing title. If provided, overrides `displayName` for the stored title. If omitted, `displayName` is used |
| `identifier` | string | No | An external identifier for the requirement (e.g., a regulation section number or internal policy ID) |
| `priority` | string | No | Priority level. One of: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW` |
| `controls` | array | Yes | Array of control objects. Can be an empty array `[]` if controls have not been defined yet |

### Control

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `displayName` | string | Yes | The name of the control |
| `description` | string | No | Description of what the control checks. Should be specific enough to write a test against |
| `sourceId` | string | No | A unique identifier for the control. Controls with the same `sourceId` across multiple requirements are automatically deduplicated and shared |
| `state` | string | No | The lifecycle state of the control. One of: `DRAFT`, `REVIEW`, `LIVE`, `RETIRED`. Defaults to `LIVE` if not provided |
| `catalog` | string | No | The catalog or standard this control belongs to (e.g., "CIS", "NIST") |
| `identifier` | string | No | An external identifier for the control (e.g., "CIS 1.2", "AC-2") |
| `owner` | string | No | Email address of the control owner |
| `remediation` | string | No | Instructions for how to remediate when this control fails. Supports markdown |
| `exceptionProcess` | string | No | Description of the exception process for this control. Supports markdown |
| `mitreTechnique` | string | No | A MITRE ATT&CK technique ID this control relates to (e.g., "T1078" or the sub-technique "T1059.001") |
| `controlTests` | array | No | Array of control test objects. Can be omitted or set to `null` if tests have not been defined yet |

### Control Test

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | string | Yes | A descriptive name for this test query |
| `query` | string | Yes | A J1QL query that returns entities to evaluate |
| `resultsAre` | string | Yes | Either `GOOD` or `BAD` (see below) |

#### Understanding `resultsAre`

-   **`GOOD`** — Results from this query represent **compliant** entities. If the query returns results, that is a positive signal.
-   **`BAD`** — Results from this query represent **non-compliant** entities. If the query returns results, that indicates a failure.

A common pattern is to define two tests per control: one `GOOD` query that finds compliant resources, and one `BAD` query that finds non-compliant resources.

## Control State Lifecycle

Controls follow a lifecycle with the following valid transitions:

```text
DRAFT → REVIEW → LIVE ↔ RETIRED
          ↕
        DRAFT
```

| State | Description |
| --- | --- |
| `DRAFT` | Control is being authored and is not yet active |
| `REVIEW` | Control is under review before going live |
| `LIVE` | Control is active and being evaluated. This is the default for imported controls |
| `RETIRED` | Control is no longer active |

> **NOTE**
> 
> When you import a framework, controls default to the `LIVE` state unless you explicitly set a different `state` value. You can transition control states after import through the UI.

## Control Deduplication

If the same control appears in multiple requirements, JupiterOne automatically deduplicates it. Deduplication works in two ways:

-   **By `sourceId`**: If two controls across different requirements share the same `sourceId`, they are treated as the same control and linked to both requirements.
-   **By `displayName`**: During import, controls with the same `displayName` are also deduplicated. The first occurrence is used if there are any differences.

This means you can reference the same control in multiple requirements without creating duplicates.

## Requirement Sections

Use the `section` field to group related requirements under a common heading in the framework UI. All requirements that share the same `section` value are displayed together under that heading.

This is useful for large frameworks where requirements span multiple domains. For example, a framework covering both identity and data protection can use sections to organize requirements by domain rather than relying on naming conventions or sequence numbering alone.

```json
{
  "name": "Enterprise Security Framework",
  "description": "Grouped by security domain.",
  "requirements": [
    {
      "section": "Identity & Access",
      "displayName": "Enforce MFA for all users",
      "description": "All users with console access must have MFA enabled.",
      "sequence": "1",
      "identifier": "IAM-01",
      "controls": []
    },
    {
      "section": "Identity & Access",
      "displayName": "Rotate access keys within 90 days",
      "description": "Active access keys must be rotated regularly.",
      "sequence": "2",
      "identifier": "IAM-02",
      "controls": []
    },
    {
      "section": "Data Protection",
      "displayName": "Encrypt S3 buckets at rest",
      "description": "All S3 buckets must have default encryption configured.",
      "sequence": "3",
      "identifier": "DP-01",
      "controls": []
    }
  ]
}
```

If `section` is omitted, requirements appear ungrouped in the framework view.

## Examples

### Minimal Framework

A valid framework with just requirements and no controls or tests:

```json
{
  "name": "ACME Security Policy",
  "description": "Internal security controls for ACME Corp.",
  "requirements": [
    {
      "displayName": "1.1 - Enable MFA for all users",
      "description": "All users with console access must have MFA enabled.",
      "controls": []
    },
    {
      "displayName": "1.2 - Rotate access keys",
      "description": "Access keys should be rotated every 90 days.",
      "controls": []
    }
  ]
}
```

You can add controls and tests later through the UI.

### Framework with Controls and Tests

```json
{
  "name": "ACME Cloud Security Standard",
  "description": "Cloud infrastructure security controls for ACME Corp.",
  "requirements": [
    {
      "section": "Identity & Access Management",
      "displayName": "1.1 - Ensure MFA is enabled for all IAM users",
      "description": "All IAM users with console access must have MFA enabled to prevent unauthorized access.",
      "sequence": "1.1",
      "identifier": "IAM-001",
      "priority": "CRITICAL",
      "controls": [
        {
          "displayName": "IAM Users Have MFA Enabled",
          "description": "Verify that all IAM users with console passwords have at least one MFA device assigned.",
          "sourceId": "iam-mfa-check",
          "catalog": "CIS AWS",
          "identifier": "CIS 1.10",
          "owner": "security-team@acme.com",
          "remediation": "Enable MFA for the user via the IAM console:\n1. Go to **IAM > Users**\n2. Select the user\n3. Click **Security credentials**\n4. Click **Assign MFA device**",
          "exceptionProcess": "Submit a request to the Security team with business justification.",
          "mitreTechnique": "T1078",
          "controlTests": [
            {
              "name": "IAM users with MFA enabled",
              "query": "FIND aws_iam_user WITH mfaEnabled = true AS user RETURN user",
              "resultsAre": "GOOD"
            },
            {
              "name": "IAM users without MFA enabled",
              "query": "FIND aws_iam_user WITH mfaEnabled != true AND passwordEnabled = true AS user RETURN user",
              "resultsAre": "BAD"
            }
          ]
        }
      ]
    },
    {
      "section": "Identity & Access Management",
      "displayName": "1.2 - Rotate access keys within 90 days",
      "description": "Access keys should be rotated regularly to limit the impact of compromised credentials.",
      "sequence": "1.2",
      "identifier": "IAM-002",
      "priority": "HIGH",
      "controls": [
        {
          "displayName": "Access Keys Rotated Within 90 Days",
          "description": "Ensure all active access keys have been rotated within the last 90 days.",
          "controlTests": [
            {
              "name": "Access keys rotated within 90 days",
              "query": "FIND aws_iam_access_key WITH active = true AND createdOn > date.now - 90 days AS key RETURN key",
              "resultsAre": "GOOD"
            },
            {
              "name": "Access keys older than 90 days",
              "query": "FIND aws_iam_access_key WITH active = true AND createdOn < date.now - 90 days AS key RETURN key",
              "resultsAre": "BAD"
            }
          ]
        }
      ]
    }
  ]
}
```

### Shared Controls Across Requirements

In this example, the "Encryption at Rest Enabled" control (with `sourceId` `encryption-at-rest`) appears in two requirements. JupiterOne creates the control once and links it to both:

```json
{
  "name": "Data Protection Standard",
  "description": "Controls for protecting data at rest and in transit.",
  "requirements": [
    {
      "displayName": "2.1 - Encrypt S3 buckets",
      "description": "All S3 buckets must have default encryption configured.",
      "sequence": "2.1",
      "controls": [
        {
          "displayName": "Encryption at Rest Enabled",
          "sourceId": "encryption-at-rest",
          "description": "Verify that storage resources have encryption enabled.",
          "controlTests": [
            {
              "name": "Encrypted S3 buckets",
              "query": "FIND aws_s3_bucket WITH encrypted = true AS bucket RETURN bucket",
              "resultsAre": "GOOD"
            }
          ]
        }
      ]
    },
    {
      "displayName": "3.1 - Encrypt EBS volumes",
      "description": "All EBS volumes must be encrypted.",
      "sequence": "3.1",
      "controls": [
        {
          "displayName": "Encryption at Rest Enabled",
          "sourceId": "encryption-at-rest",
          "description": "Verify that storage resources have encryption enabled.",
          "controlTests": [
            {
              "name": "Encrypted EBS volumes",
              "query": "FIND aws_ebs_volume WITH encrypted = true AS vol RETURN vol",
              "resultsAre": "GOOD"
            }
          ]
        }
      ]
    }
  ]
}
```

### Controls with State and Metadata

Use `state` to import controls in different lifecycle stages:

```json
{
  "name": "Phased Rollout Framework",
  "description": "Framework demonstrating controls in different lifecycle states.",
  "requirements": [
    {
      "displayName": "1.1 - Production-ready control",
      "description": "This control is fully validated and active.",
      "controls": [
        {
          "displayName": "Active Control",
          "state": "LIVE",
          "catalog": "Internal",
          "identifier": "SEC-001",
          "owner": "compliance@acme.com",
          "controlTests": [
            {
              "name": "Check for compliant resources",
              "query": "FIND Host WITH encrypted = true AS h RETURN h",
              "resultsAre": "GOOD"
            }
          ]
        }
      ]
    },
    {
      "displayName": "1.2 - Control under development",
      "description": "This control is still being authored.",
      "controls": [
        {
          "displayName": "Draft Control",
          "state": "DRAFT",
          "catalog": "Internal",
          "identifier": "SEC-002"
        }
      ]
    }
  ]
}
```

## Validation

The JSON is validated on upload. The following rules apply:

-   `name` and `description` are required at the top level
-   Every requirement must have `displayName`, `description`, and a `controls` array
-   Every control must have a `displayName`
-   Every control test must have `name`, `query`, and `resultsAre` (either `GOOD` or `BAD`)
-   Extra properties are allowed and will not cause validation errors—they are passed through and stored

### Common Validation Errors

| Error | Cause | Resolution |
| --- | --- | --- |
| "Framework JSON and name are required" | Missing the JSON body or framework name | Ensure both are provided when uploading |
| "Invalid frameworkJson" | The JSON structure does not match the expected schema | Check that all required fields are present and correctly typed |

## Tips for Writing Control Tests

-   **Use the Query Builder first**: Test your J1QL queries in JupiterOne's Query Builder before adding them to your framework JSON to verify they return the expected results.
-   **Pair GOOD and BAD tests**: Define both a positive and negative test for comprehensive coverage. The `GOOD` test shows what is compliant, and the `BAD` test shows what needs attention.
-   **Use specific filters**: Write precise `WITH` clauses to avoid false positives. For example, `FIND aws_iam_user WITH mfaEnabled != true AND passwordEnabled = true` is better than `FIND aws_iam_user WITH mfaEnabled != true` because it excludes programmatic users without console access.
-   **Use the `AS` and `RETURN` pattern**: Queries should follow the `FIND <entity> WITH <filters> AS <alias> RETURN <alias>` pattern for best results.

---

Source: /features/insights-and-alerts/alert-rule-action-config-entity-tag-template-example

# Alert Rule Action Config Example with Entity Tag Values

This page demonstrates how to define an action config template within a JupiterOne alert rule that references entity tag values, such as:

```text
DisplayName: {{item.displayName}} - Tag: {{item['tag.owner_email']}}
```

This is useful when you want to include specific tag values from your entities in alert notifications or actions (e.g., emails, Slack messages, Jira tickets).

> **Note:** In JEXL Syntax, when accessing a property from an object that has a period in its name (like 'tag.name'), you need to use bracket notation instead of dot notation. Dot notation will try to interpret the part after the dot as a nested property.

## Example: Send Email with Entity Tag Value

Below is a sample alert rule configuration that sends an email for all results, including the entity's display name and the value of the `owner_email` tag.

```json
{
  "name": "entities-with-owner-email-tag",
  "description": "Alert on entities and include their owner email tag in the notification.",
  "notifyOnFailure": true,
  "triggerActionsOnNewEntitiesOnly": false,
  "ignorePreviousResults": true,
  "pollingInterval": "ONE_DAY",
  "templates": {
    "emailBody": "DisplayName: {{item.displayName}} - Tag: {{item['tag.owner_email']}}"
  },
  "outputs": [
    "alertLevel"
  ],
  "labels": [],
  "question": {
    "queries": [
      {
        "query": "FIND aws_s3_bucket WITH [tag.owner_email] != undefined",
        "name": "query0",
        "version": "v1",
        "includeDeleted": false
      }
    ]
  },
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "condition": [
          "AND",
          [
            "queries.query0.total",
            ">",
            0
          ]
        ]
      },
      "actions": [
        {
          "type": "SET_PROPERTY",
          "targetProperty": "alertLevel",
          "targetValue": "MEDIUM"
        },
        {
          "type": "SEND_EMAIL",
          "body": "Entities with owner email tag:<br><br>{{ queries.query0.data | mapTemplate('emailBody') | join('<br>') }}",
          "recipients": [
            "security-team@company.com"
          ]
        }
      ]
    }
  ],
  "tags": [],
  "remediationSteps": null
}
```

### Explanation

-   The `templates.emailBody` field defines a template string that references both the entity's display name and the `owner_email` tag value.
-   In the `SEND_EMAIL` action, the body uses `mapTemplate('emailBody')` to apply this template to each result.
-   The J1QL query finds all `aws_s3_bucket` entities that have a `tag.owner_email` defined.
-   The resulting email will list each entity with its display name and the value of its `owner_email` tag.

You can adapt this pattern for other actions (Slack, Jira, etc.) and other tag keys as needed.

---

Source: /features/insights-and-alerts/alert-rule-action-config-examples

# Alert Rule Action Configuration Examples

Quickly enable actions in your rules with these JupiterOne alert rule configuration examples. These are designed to provide guidance for our most commonly used actions to quickly get your workflows into action.

##### Send Email For All Results:

![Email Example](/assets/images/send_email-68f60760f94cf409cd2798515dbbff05.png)

```json
{
  "id": "ca2c8bfb-c850-44de-b80c-eeef6f16ee1f",
  "collectionId": null,
  "name": "s3-buckets-not-allow-public-read-write-access",
  "description": "S3 buckets should not allow public read or write access to the bucket ACL policy.",
  "version": 5,
  "lastEvaluationStartOn": 1729719748559,
  "specVersion": 1,
  "notifyOnFailure": true,
  "triggerActionsOnNewEntitiesOnly": false,
  "ignorePreviousResults": true,
  "pollingInterval": "ONE_WEEK",
  "templates": {
    "emailBody": "({{itemIndex+1}} of {{itemCount}})Display Name: {{item.displayName}}  ARN: {{item._key}} Link:{{item.webLink}} <br><br>"
  },
  "outputs": [
    "alertLevel"
  ],
  "labels": [],
  "question": {
    "queries": [
      {
        "query": "FIND aws_s3_bucket WITH ignorePublicAcls != true AND restrictPublicBuckets != true THAT ALLOWS AS grant Everyone WHERE grant.permission = 'READ_ACP' or grant.permission = 'WRITE_ACP'",
        "name": "query0",
        "version": "v1",
        "includeDeleted": false
      }
    ]
  },
  "questionId": null,
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "condition": [
          "AND",
          [
            "queries.query0.total",
            ">",
            0
          ]
        ]
      },
      "actions": [
        {
          "id": "8a60b644-ccb5-4727-af0e-03573e5b9cd2",
          "type": "SET_PROPERTY",
          "targetValue": "HIGH",
          "targetProperty": "alertLevel"
        },
        {
          "id": "c39abde5-b74a-42c3-be02-a559fa541ec5",
          "type": "SEND_EMAIL",
          "body": "Please review the following results: <br><br>{{ queries.query0.data | mapTemplate('emailBody') | join(' ') }}",
          "recipients": [
            "email_address@jupiterone.com"
          ]
        }
      ]
    }
  ],
  "state": null,
  "tags": [],
  "remediationSteps": null
}
```

##### Jira Ticket For All Results:

![Jira Ticket Example 1](/assets/images/jira_ticket_1-dbf8c2f55807ec143171cde806a76f00.png)

![Jira Ticket Example 2](/assets/images/jira_ticket_2-e20b36c9a9da1247798851ba423885c8.png)

```json
{
  "id": "4dc6e222-f11d-41c6-a495-5059d02cadaa",
  "collectionId": null,
  "name": "eks_publicly_accessible",
  "description": "Checks if Amazon EKS endpoints are publicly accessible.",
  "version": 13,
  "lastEvaluationStartOn": 1730482765679,
  "specVersion": 1,
  "notifyOnFailure": true,
  "triggerActionsOnNewEntitiesOnly": false,
  "ignorePreviousResults": true,
  "pollingInterval": "ONE_WEEK",
  "templates": {
    "jiraTicketBody": "Display Name: {{item.displayName}} ({{item.arn}}) Active Status: {{item.status}}, Tags: {{item.tags}}"
  },
  "outputs": [
    "alertLevel"
  ],
  "labels": [],
  "question": {
    "queries": [
      {
        "query": "FIND aws_eks_cluster WITH vpcEndpointPublicAccess = true",
        "name": "query0",
        "version": "v1",
        "includeDeleted": false
      }
    ]
  },
  "questionId": null,
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "condition": [
          "AND",
          [
            "queries.query0.total",
            ">",
            0
          ]
        ]
      },
      "actions": [
        {
          "id": "1b72deaf-8692-4b9a-aca6-1f4cc370c48d",
          "type": "SET_PROPERTY",
          "targetProperty": "alertLevel",
          "targetValue": "CRITICAL"
        },
        {
          "id": "2c586ecf-4b0a-4245-b556-865156962e7e",
          "type": "CREATE_ALERT"
        },
        {
          "integrationInstanceId": "1993ff4d-18bb-488a-8966-dde76a4c3669",
          "id": "8ac582c8-033f-499f-be4e-ced993004876",
          "type": "CREATE_JIRA_TICKET",
          "entityClass": "Issue",
          "summary": "{{alertRuleDescription}}",
          "issueType": "Task",
          "project": "PROS",
          "additionalFields": {
            "description": {
              "type": "doc",
              "version": 1,
              "content": [
                {
                  "type": "paragraph",
                  "content": [
                    {
                      "type": "text",
                      "text": "{{alertWebLink}}\n\n**Affected Items:**\n\n* {{queries.query0.data|mapTemplate('jiraTicketBody')|join('\n* ')}}"
                    }
                  ]
                }
              ]
            },
            "priority": {
              "name": "High",
              "id": "2"
            }
          }
        }
      ]
    }
  ],
  "state": null,
  "tags": [],
  "remediationSteps": null
}
```

##### Slack Message For All Results:

![Slack Example](/assets/images/send_slack-818a358d57b6a22ecc556c9060196ef4.png)

```json
{
  "id": "5821ab03-e2cd-4d79-9067-13c0c8f07fdc",
  "collectionId": null,
  "name": "aws-iam-access-keys-greater-than-180-days",
  "description": "All active AWS IAM access keys that were created more than 180 days ago",
  "version": 6,
  "lastEvaluationStartOn": 1729814129144,
  "specVersion": 1,
  "notifyOnFailure": true,
  "triggerActionsOnNewEntitiesOnly": false,
  "ignorePreviousResults": true,
  "pollingInterval": "DISABLED",
  "templates": {
    "accessKey": "({{itemIndex+1}}) Key: {{item.displayName}} Created On: {{item._createdOn}}"
  },
  "outputs": [
    "alertLevel"
  ],
  "labels": [],
  "question": {
    "queries": [
      {
        "query": "FIND aws_iam_access_key WITH active = true AND createdOn < date.now - 180 days",
        "name": "query0",
        "version": "v1",
        "includeDeleted": false
      }
    ]
  },
  "questionId": null,
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "condition": [
          "AND",
          [
            "queries.query0.total",
            ">",
            0
          ]
        ]
      },
      "actions": [
        {
          "id": "739bc275-d45d-4157-a2e8-1bcff26ae55b",
          "type": "SET_PROPERTY",
          "targetProperty": "alertLevel",
          "targetValue": "HIGH"
        },
        {
          "integrationInstanceId": "ad8db463-af8e-4f55-aec2-406ac563f331",
          "id": "630864c5-a43d-4571-9cc0-188d64b5a1b4",
          "type": "SEND_SLACK_MESSAGE",
          "channels": [
            "#jupiterone-alerts"
          ],
          "body": "*Affected Items:* \n\n- {{queries.query0.data|mapTemplate('accessKey')|join('\n- ')}}"
        },
        {
          "id": "829b4bfd-5fae-4e41-9427-ffcdc4b92322",
          "type": "CREATE_ALERT"
        }
      ]
    }
  ],
  "state": null,
  "tags": [],
  "remediationSteps": null
}
```

##### For Each Action to Create Jira Tickets:

![For Each Jira Action](/assets/images/for_each-93abbddc2da2f146ff3055e971a248bd.png)

```json
{
  "id": "94a92bf2-5d06-495c-b260-e5c372be3cd7",
  "collectionId": null,
  "name": "AWS S3 Bucket Publicly Accessible Alert",
  "description": null,
  "version": 17,
  "lastEvaluationStartOn": 1730287835953,
  "specVersion": 1,
  "notifyOnFailure": true,
  "triggerActionsOnNewEntitiesOnly": false,
  "ignorePreviousResults": true,
  "pollingInterval": "ONE_DAY",
  "templates": {},
  "outputs": [
    "alertLevel"
  ],
  "labels": [],
  "question": {
    "queries": [
      {
        "query": "FIND aws_s3_bucket WITH ignorePublicAcls != true AND restrictPublicBuckets != true THAT ALLOWS AS grant Everyone WHERE grant.permission = 'READ_ACP' or grant.permission = 'WRITE_ACP'",
        "name": "query0",
        "version": "v1",
        "includeDeleted": false
      }
    ]
  },
  "questionId": null,
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "condition": [
          "AND",
          [
            "queries.query0.total",
            ">",
            0
          ]
        ]
      },
      "actions": [
        {
          "id": "e696b537-9617-4332-8509-de78b8926c56",
          "type": "SET_PROPERTY",
          "targetValue": "INFO",
          "targetProperty": "alertLevel"
        },
        {
          "id": "c1514c00-c6eb-497a-98c4-c9a76cecf7b1",
          "type": "FOR_EACH_ITEM",
          "items": "{{queries.query0.data}}",
          "itemRef": "result",
          "actions": [
            {
              "integrationInstanceId": "1993ff4d-18bb-488a-8966-dde76a4c3669",
              "type": "CREATE_JIRA_TICKET",
              "entityClass": "Issue",
              "summary": "AWS S3 Bucket Publicly Accessible Alert",
              "issueType": "Task",
              "project": "PROS",
              "autoResolve": true,
              "resolvedStatus": "Closed",
              "additionalFields": {
                "description": {
                  "type": "doc",
                  "version": 1,
                  "content": [
                    {
                      "type": "paragraph",
                      "content": [
                        {
                          "type": "text",
                          "text": "[Alert Link]({{alertWebLink}})\n\n**Affected Item:** {{result.entity.displayName}}\n\nARN: {{result.entity._key}}\n\nOwner: {{result.properties.owner}}\n\n[Link to affected item]({{result.properties.webLink}})"
                        }
                      ]
                    }
                  ]
                },
                "priority": {
                  "name": "High",
                  "id": "2"
                }
              }
            }
          ]
        }
      ]
    }
  ],
  "state": null,
  "tags": [],
  "remediationSteps": null
}
```

---

Source: /features/insights-and-alerts/alert-rule-packs

# Alert Rule Packs

Aside from [creating alert rules from scratch](/features/insights-and-alerts/alerts.md#creating-alert-rules), JupiterOne offers the ability to import rule packs that consist of pre-configured alert rules. All packs are aimed in assisting with continued surveillance over changes and areas of interest in your environment.

![JupiterOne importing a rule pack](/assets/images/import-rule-pack-c136937df04b15a7fdae0b47a676dfb8.png)

JupiterOne offers managed rule packs for the following CSPs and use cases:

-   AWS
-   Azure
-   Google Cloud Provider
-   Common Alerts
-   Compliance
-   Critical Assets
-   Device Management
-   Dev Ops
-   Integrations Monitoring
-   Toxic Combinations

JupiterOne also offers managed security content providing these detection examples:

-   AWS Threat
-   Endpoint Security
-   CTEM Attack Paths
-   Gitlab Malicious Version
-   MITRE ATT&CK: AWS Privilege Escalation
-   MITRE ATT&CK: Google Cloud Privilege Escalation
-   MITRE ATT&CK: Execution
-   MITRE ATT&CK: Initial Access
-   MITRE ATT&CK: Lateral Movement

We continue to release more managed security content for our customers to leverage for detections and gaining valueable insights into their attack surface.

> **INFO**
> 
> For more information on rule packs offered by JupiterOne, check out our [GitHub repo](https://github.com/JupiterOne/jupiterone-alert-rules/tree/main/rule-packs).

### Importing JupiterOne Managed Rule Packs

To import any of the rule packs for use with Alerts:

1.  Navigate to **Alerts** and select the **Rules** tab.
2.  Select **Import rules** above the table.
3.  By default, you should be in the **JupiterOne managed packs** tab. Choose the **Resource group** that the imported rules will be created in.
4.  Under **Available packs**, select the pack(s) you would like to use and press **Import rules** to install them.

You can expand any pack with the drop-down arrow to view its individual rules, and select specific rules instead of importing the entire pack.

> **NOTE**
> 
> JupiterOne periodically makes updates to the managed rule packs, and we suggest occasionally re-importing your rule packs in order to ensure you have the latest batch of rules associated with each pack. This can be accomplished via the same flow as mentioned above, as if you were installing the pack for the first time.

Over time, we are also introducing new rule packs to be leveraged within your workspace as well to accommodate additional updates to our platform.

### Custom rule packs

In addition to JupiterOne's built-in rule packs, you are able to upload your own custom rule packs in JSON format.

By following the example files within the [Rule Packs repo](https://github.com/JupiterOne/jupiterone-alert-rules/tree/main/rule-packs), you can similarly create your own files of unique rules that suit your specific use case to get the most out of JupiterOne Alerts.

> **INFO**
> 
> See our [Alert Rules API documentation](/api/alert-rules.md) for additional information for managing alerts via API.

To import a custom JSON rule file:

1.  Navigate to **Alerts** and select the **Rules** tab.
2.  Select **Import rules** above the table.
3.  Choose **Custom rule pack (JSON)**, paste your JSON into the window, and press **Import rules**.

Once imported, your rules will evaluate on the provided polling interval. You can also manually initiate an evaluation on a rule by selecting **Evaluate now** from its row actions. This will cause it to run immediately rather than wait until the polling interval.

---

Source: /features/insights-and-alerts/alerts

# Alerts

JupiterOne Alerts is a powerful tool that enables you to automatically monitor your workspace through the use of _rules_. By configuring rules, you are able to execute and leverage J1QL queries that run on a particular interval to run and look for findings on their designated interval. When these rules run a query and find results, you are notified by an alert, which can be configured to be sent through various channels of your choosing.

![JupiterOne Alerts main view](/assets/images/alerts-view-f0cbeab05e7e58b61df15be8ac106b10.png)

By using Alerts, you can begin to embed JupiterOne into your existing security workflows. For example, if a security finding requires remediation, you could configure that alert to create a corresponding Jira ticket to then be addressed. Depending on severity, it could also send a Slack or email notification to the appropriate team. By creating custom rules, you can curate the alert behavior to your specific needs.

> **INFO**
> 
> In addition to custom alerts, JupiterOne offers pre-configured rule packs that provide rules built around various tools and use cases. [Read more about rule packs](/features/insights-and-alerts/alert-rule-packs.md#importing-jupiterone-managed-rule-packs)

## Creating Alert Rules

To create a single rule for alerts:

1.  Navigate to the Alerts and select the Rules tab.
    
2.  Click **New rule**. This opens the full-page rule editor.
    
3.  Provide the following details for the new custom rule:
    
    -   **Name**: Name for the alert rule.
    -   **Resource group**: The resource group the rule belongs to, which governs who can access it.
    -   **Description**: Brief description of the rule.
    -   **Severity**: The level of severity for the particular alert (Info, Low, Medium, High, Critical)
    -   **Evaluation interval**: The interval for which the system re-evaluates the rule (Disabled, 1 week, 1 day, 12 hours, 8 hours, 4 hours, 1 hour, 30 minutes, 15 minutes). Intervals shorter than your plan allows appear disabled.
    -   **Rule tags**: Key/value labels used to organize and filter your rules.
    -   **Notify on evaluation failure**: Sends a notification when the rule fails to evaluate.
    -   **Query**: The J1QL query used to monitor changes to trigger the alert.
    
    ---
    
    Tip: ORDER BY Best Practice: It is discouraged to use the `ORDER BY` J1QL keyword within the query powering an Alert Rule as it may cause unexpected rule evaluation failures and slower performance.
    
    ---
    
4.  In the **Action trigger conditions** section, choose when the configured actions should run. Three options are available:
    
    -   **All query results, when results have changed**: Actions run with all query results, but only when the results differ from the previous evaluation.
    -   **Newly discovered results, when results have changed**: Actions run only for results that were not present in the previous evaluation. This is the option to use for change detection.
    -   **All query results, every evaluation**: Actions run with all query results on every evaluation, without comparing to previous results.
5.  Select the appropriate **Actions** for the rule to take when action trigger conditions are met. By default it will send a JupiterOne Alert.
    

> **NOTE**
> 
> Some configuration options may vary depending on your workspace plan with JupiterOne.

> **NOTE**
> 
> Rules that have failed to successfully run in over 30 days and have not received any updates will automatically be disabled and moved to the "System Disabled" state.

> **TIP**
> 
> Want to detect when data in your graph has changed? See our guide on [Detecting Data Changes with Alert Rules](/features/insights-and-alerts/detecting-data-changes.md) to learn how to create alerts that trigger when entities are updated or modified in your environment.

### Additional configuration

JupiterOne offers additional actions and flexibility around building alerts into workflows outside of JupiterOne. You can configure more complex actions such as sending an Alert notification to a designated Slack channel, or creating a Jira ticket based on an alert.

#### Actions

When creating a rule, you can specify any of the following actions to be made when the alert is triggered:

-   **Tag Entities**: This action runs on every rule evaluation, even when "Newly discovered results" is selected. You can choose between two operations:
    
    -   **Set Tag**: Tags all entities returned by the query with the specified tag value
    -   **Unset Tag**: Removes the specified tag from all entities that were previously tagged by this rule. If another rule also tags that property, the property takes that rule's value instead of being cleared; otherwise it reverts to the value it had before any rule tagged it, or is removed if it had none.
    
    **Note**: When multiple rules tag the same property on the same entity, **the rule that most recently changed the value wins**. Re-applying a value a rule already set does not reclaim the property — only changing the asserted value takes it over.
    
    This is resolved per property: one rule can own `tag.owner` while another owns `tag.environment` on the same entity. When two rules contest one property, they settle on whichever changed it last rather than alternating.
    
    If the winning rule stops tagging the property, the value falls back to the rule that set it before, and to the source integration's value when no rule tags it. (Previously the first rule to tag a property held it and later rules were ignored, so a stale rule could block a live one.)
    
-   **Email**: You provide the email addresses to alert and what you want in the email message.
    
-   **Slack**: You must first configure the Slack integration for JupiterOne by following [these instructions](/integrations/directory/slack.md). Ensure that you specify the channel in the format #channel.
    
    -   Troubleshooting note: If you are having trouble with Slack messages not sending, ensure that the JupiterOne Slack integration has been set up with the correct permissions. The JupiterOne Slack integration must have the `chat:write` and `chat:write.public` permissions to send messages to Slack. Additionally, you will want to ensure that the Slack integration has been authorized.
-   **JIRA**: You must first configure the JIRA integration for JupiterOne by following [these instructions](/integrations/directory/jira.md). When you create a rule that triggers the creation of a Jira ticket, you provide the following:
    
    -   **Summary**: title of the Jira ticket
    -   **Description**: JupiterOne automatically lists the affected entities and the associated query, but you can edit this field to contain other information.
    -   **Project**: ID of the Jira project to which you want to assign the ticket.
    -   **Issue Type**: type of issue you want the Jira ticket to be, such as task or bug.
    -   **Entity Class**: (mandatory field) the class of the new ticket entity that you want to assign to the ticket, such as vulnerability or policy. Integrations Instance: select the Jira instance from the dropdown menu.
    -   **Additional Fields**: you can add any other of the Jira ticket fields if you want to return that information.
    -   **Update content on changes**: When enabled, each time the action runs JupiterOne updates the Jira ticket it already created for this rule (for example, refreshing the list of affected entities) instead of opening another ticket.
    -   **Auto-Resolve**: Automatically closes Jira tickets when there are no more results that match the alert rule. For example, whenever the rule goes from zero results to >0 results, JupiterOne will open a new Jira ticket. Whenever the query returns an empty result set, the previously opened ticket will be marked as Resolved via the Jira integration. You must provide a Resolved Status for the Jira ticket to be automatically closed. Note: this will not close any Jira tickets upon alert dismissal. [Read more about the JupiterOne alert rule schema](/api/alert-rules.md#rule-definition-reference)
    
    **Note**: By default — when neither **Update content on changes** nor **Auto-Resolve** is enabled — the JIRA action creates a **new** Jira ticket every time it runs (that is, on each evaluation where the rule matches results). Enable **Update content on changes** to keep a single ticket for the rule and refresh it in place; this is the reliable way to avoid duplicates. **Auto-Resolve** on its own is not a substitute: without **Update content on changes**, if the ticket's summary or additional field values change between evaluations — for example a templated date, entity name, or result count — the previously opened ticket is resolved and a replacement is opened on that run.
    
-   **ServiceNow**: Select the integration instance from the dropdown menu and enter the content for the request body. The message body is sent to the `/api/now/table` incident endpoint. Go to the REST API Explorer page in your ServiceNow deployment to learn about additional fields. The request automatically assigns the number property to be `j1:{rule-instance-id}`.
    

This reference link shows the default/common fields on Incident records via the Table API which can be defined within the Request Body contained in the JupiterOne Alert Rule Action: [https://www.servicenow.com/docs/bundle/yokohama-api-reference/page/integrate/inbound-rest/concept/c\_TableAPI.html#d248908e3139](https://www.servicenow.com/docs/bundle/yokohama-api-reference/page/integrate/inbound-rest/concept/c_TableAPI.html#d248908e3139)

-   **SNS**: The AWS account you want to send to must be configured as an AWS Integration, and the J1 IAM role for the AWS account you want to publish to must have the `SNS:Publish` permission.
    
-   **SQS**: The AWS account you want to send to must be configured as an AWS Integration, and the J1 IAM role for the AWS account you want to publish to must have the `SQS:SendMessage` permission.
    
-   **Send to S3**: Uploads alert data as a JSON file to an S3 bucket. The AWS account you want to send to must be configured as an AWS Integration, and the J1 IAM role for the AWS account must have the `S3:PutObject` permission for the target bucket. You can control the contents of the JSON file that gets uploaded. For example:
    
    ```json
    {
      "description": "{{alertWebLink}}\n\n**Affected Items:**\n\n* {{queries.query0.data|mapProperty('displayName')|join('\n* ')}}"
    }
    ```
    
    This allows you to customize what information is included in the uploaded file, using template variables to include alert details, query results, and formatted entity data.
    
-   **Webhook**: Sends a message to the specified webhook URL.
    
-   **Tines trigger**: Pushes data from a JupiterOne query to a Tines action workflow.
    
-   **Send to Google BigQuery**: Streams alert data to a Google BigQuery table.
    
-   **For each**: Runs a set of nested actions once per entity returned by the query results.
    

#### Templates

You can also use templates when adding rules. The template goes inside any property under the operations property for a rule. Templates can contain JavaScript-like syntax that have input variables automatically inserted for usage. See the [alert rule schema](/api/alert-rules.md#rule-definition-reference) for more information about the templates property.

### Managing alerts

The **Alerting** tab on the Rules page lists every rule that is currently firing. Selecting a rule opens its detail page, where you can review the query, its results over time, and the full evaluation history.

![JupiterOne Alert activity view](/assets/images/alerts-activity-49cacf560392451c5f14b1fa10330592.png)

From a rule's row actions, you can also edit the rule associated with the alert and dismiss the alert. Dismissing an alert will stop it from showing until the next evaluation produces results.

### Understanding the Findings column

The **Findings** column in the Rules table shows the number of results behind a rule's **currently active alert** — not a running total for the rule. The count comes from the active alert's most recent evaluation, so it is only populated while a rule is in the **Alerting** state.

A rule shows an em dash (—) in the Findings column when it has no active alert. This is expected in several cases:

-   **The rule has no JupiterOne Alert action.** Findings live on an alert, and an alert is only created by a JupiterOne Alert action. A rule that only tags entities, creates a Jira ticket, or sends a webhook (with no alert action) will never show a findings count, even when it is doing work on every evaluation.
-   **The rule's trigger conditions weren't met**, so no alert was created (for example, the query returned no results, or results haven't changed since the last evaluation).
-   **The alert was dismissed or resolved.** Once an alert leaves the active state, its rule returns to an em dash.

In other words, the Findings column mirrors the **Alerting** tab: only rules that are actively firing display a count.

## Rule row actions

Each row in the Rules table has an **Enabled** toggle and a set of action icons that appear when you hover over the row. The available actions depend on your role-based access control (RBAC) permissions; you'll see a tooltip explaining any action you don't have permission to use.

![JupiterOne Alert Rules Table Actions](/assets/images/alert-rules-table-actions-68550acc14fd63a011d452bf2f8b5fbf.png)

### Available actions

-   **Copy link**: Copies a direct link to the rule. Available to users with **read** access.
-   **Edit**: Opens the rule editor. Available to users with **update** access.
-   **Evaluate now**: Manually triggers a full rule evaluation, running all queries and actions outside the scheduled polling interval. Available to users with **update** access.
-   **Dismiss alert**: Dismisses the active alert for a firing rule. Shown only on the **Alerting** tab. Available to users with **update** access.
-   **Delete**: Permanently removes the rule from your workspace. This action cannot be undone. Available to users with **delete** access.

The **Enabled** toggle is a column on the table (not one of the hover action icons). It enables or disables the rule and requires **update** access. When a rule has failed to evaluate for an extended period, the system disables it automatically and its **Evaluation** column shows **System disabled**.

> **NOTE**
> 
> Evaluation history is no longer a row action. To review past runs, open the rule and use the **Evaluation history** tab (see below).

## Rule Evaluation History

You can also view the history of rule evaluations whether they've created an alert or not. When you click into a rule from the Rules page, the rule's configuration appears in a collapsible panel at the top, with **Evaluation history** and **Relationships** tabs below it. The **Evaluation history** tab shows you the following information:

![JupiterOne Alert activity view](/assets/images/rule-evaluation-history-26a34fd89e01a69aa4d22bb9bb1c2d0e.png)

-   The results of the query(ies) associated with the rule configuration, as well as the evaluation duration.
    -   If there were new entities found compared to the rule's last successful evaluation, you can toggle to view only the new entities. Note that if the query has changed between evaluation runs, the results may all be considered new.
-   Whether the condition to proceed to running actions was met.
    -   The default condition on a rule is met when the number of the first query's results is greater than 0.
-   The actions that were taken, if any, and the status of those actions.

> **INFO**
> 
> From a query's results in the **Evaluation history** tab you can also [exempt individual entities](/features/insights-and-alerts/rule-exemptions.md), excluding them from the rule's pass/fail calculation and from the actions it takes.

-   If there were action failures, there are logs to help troubleshoot the issue.

---

Source: /features/insights-and-alerts/detecting-data-changes

# Detecting Data Changes with Alert Rules

You can trigger alerts in JupiterOne when data in your graph has changed! While many alerts focus on the number of results changing, JupiterOne allows you to detect when entities in your environment have been recently updated or created by leveraging timestamp-based queries.

## How It Works

The key to detecting changes in your graph is to:

1.  **Write a J1QL query** that looks for entities with recent timestamp updates using time-based filters
2.  **Configure the alert rule** to trigger when these entities appear in the query results

By using `DATE.now - [time unit]` in your queries, you can identify entities whose `lastUpdatedOn` (or `_createdOn`) timestamp falls within a recent time window. When you set the alert rule's trigger condition to activate "when entities that did not exist during the previous rule evaluation appear in the question results", JupiterOne will fire an alert each time an entity's timestamp update makes it "newly" match your query.

**Important**: This approach detects _that_ something has changed in your environment, but does not tell you exactly what properties were modified. For specific change details, you'll need to check your source system logs.

## Important Limitations

Before implementing data change detection, understand these key limitations:

-   **Entity dependency**: You need entities that come with timestamp properties like `lastUpdatedOn`. JupiterOne does not track this information in our metadata - it relies on the source system (like AWS) to provide these timestamps.
    
-   **Timestamp-based detection only**: This method can only target timestamp properties (like `lastUpdatedOn` or `_createdOn`). You cannot identify when specific individual properties have changed.
    
-   **No property-level change details**: The alert will tell you _that_ an entity has changed, but not _what_ changed. To determine which specific properties were updated, you need to check the source system's logs (such as AWS CloudTrail).
    
-   **Source system limitations**: Not all integrations or entity types provide reliable timestamp properties. Check your specific integration documentation to confirm timestamp availability.
    

This is best used for broad change detection across your environment rather than granular property monitoring. For detailed change tracking, combine JupiterOne alerts with your source system's native change logs.

## Example Queries

**Detecting recently modified CloudTrail resources:**

```j1ql
FIND aws_cloudtrail_resource WITH lastUpdatedOn > DATE.now - 1 hour
```

**Detecting new users created in the last 14 days:**

```j1ql
FIND jupiterone_user WITH _createdOn > DATE.now - 14 day
```

**Detecting recently updated data stores:**

```j1ql
FIND DataStore WITH lastUpdatedOn > DATE.now - 6 hours
```

## Configuration Tips

-   **Use appropriate time windows**: Choose time intervals that align with your alert evaluation frequency. For example, if your rule runs every hour, use a time window slightly larger than 1 hour to avoid missing updates.
    
-   **Leverage entity properties**: Most JupiterOne entities have `_createdOn` and `lastUpdatedOn` properties that track when the entity was first ingested and last modified.
    
-   **Combine with other filters**: You can combine time-based filters with other conditions to create more targeted alerts:
    

```j1ql
FIND DataStore WITH classification='critical' AND lastUpdatedOn > DATE.now - 2 hours
```

This approach provides a way to get notifications when changes occur in your environment, enabling you to stay informed about activity across your infrastructure and applications.

## Getting Started

To create a change detection alert for your environment:

1.  Navigate to **Alerts** and select the **Rules** tab
2.  Click **New rule**
3.  Configure your rule with a time-based J1QL query as shown in the examples above
4.  Set the trigger condition to **Newly discovered results, when results have changed** so actions run only for entities that appear in results for the first time
5.  Configure your desired actions (email, Slack, Jira ticket creation, etc.)
6.  Set an appropriate polling interval that aligns with your time window

Remember: This will alert you that _something_ has changed, but you'll need to investigate further to determine exactly what changed.

For more information on creating alert rules, see the main [Alerts documentation](/features/insights-and-alerts/alerts.md).

---

Source: /features/insights-and-alerts/insights

# Insights

JupiterOne's Insights dashboards enable you to visualize your data in a variety of meaningful ways. JupiterOne offers both a comprehensive set of managed dashboards that provide immediate value. With the ability to customize and curate your own dashboards and widgets, you are able to parse your data and visualize it as you see fit.

All dashboards are powered by [JupiterOne's query language, J1QL](/j1ql.md). By leveraging queries, you can visualize the query results in a variety of ways–allowing you to make powerful representations of your data quickly.

## Accessing Insights

By navigating to the **Insights** section of your JupiterOne workspace, you will find a list of JupiterOne's managed dashboards. These dashboards come pre-configured to provide a baseline of useful visualizations that can be built upon. Note that the list of managed boards is filtered down to show you only those boards that relate to your account's configured integrations (See Managed Dashboard Prerequisites below).

![JupiterOne Insights overview](/assets/images/insights-landing-93056d4c463cb907f2ddf25569a1340a.png)

### Managed Dashboard Prerequisites

By default, JupiterOne filters the list of managed dashboards that you can see to the ones that relate to your account's configured integrations. If you have the AWS integration enabled, then you will see all of the dashboards that relate to AWS and cloud computing.

If you'd like to see all managed dashboards, even the ones that do not relate to your integrations, you can change the filter at the top of the dashboards list page.

![JupiterOne Insights prerequisite filter](/assets/images/insights-prereq-filter-e6a377081895892e8329d0b846f0f0a8.png)

#### Satisfying Prerequisites

Almost every managed dashboard has a set of integrations or integration types that an account should have in order for them to gain insights from a particular dashboard.

You can see that this account meets all of the requirements for the Data Protection dashboard. It needed to have either an AWS, Google Cloud, or Azure integration set up, and it has all three.

![JupiterOne Insights prerequisites met](/assets/images/insights-prereq-met-ccb183e8543653b39017712179a2955a.png)

In comparison, you can see that this account does not meet the requirements for the Toxic Combinations dashboard. It needs to have the following integrations in order for this dashboard to provide useful information to the user, one of three cloud integrations and an endpoint agent or vulnerability scanner integration.

![JupiterOne Insights prerequisites met](/assets/images/insights-prereq-not-met-9e313113aeeaaa62f0432ed59ead0203.png)

### Creating dashboards

When creating Insights dashboards, there are two main options: Creating a **Team dashboard** or creating a **Personal dashboard**. Team dashboards are accessible to all members of your workspace, while a Personal dashboard is only visible to you. Team dashboards can further be limited to a specific resource group.

#### To create a new dashboard:

At the top right of the dashboards list page, click **Create dashboard** and choose whether you want to add a personal or team board. You can also select a resource group to limit access via RBAC permissions.

#### Widget options:

When creating a dashboard, there are several options for widgets to choose from. This allows you to utilize the most impactful visual representation for your data. Below are the following supported dashboard widgets:

-   **Number**: A metric chart visualization that shows one large stat value. You are able to configure color coded thresholds that will help you tell a story of good vs bad results.
-   **Pie Chart**: The pie chart displays values from one or more queries, as they relate to each other, in the form of slices of a pie. The arc length, area and central angle of a slice are all proportional to the slices value, as it relates to the sum of all values.
-   **Line Chart**: The line chart is created by plotting a series of several points and connecting them with a straight line.
-   **Bar Chart**: The bar chart visualization allows you to view categorical data to analyze your queries with a specified x and y axis. You are able to run multiple queries and visualize the bar chart in stacked format.
-   **Matrix Chart**: The matrix chart is used for analyzing and displaying the relationship between data sets. The matrix diagram shows the relationship between two, three, or four groups of information.
-   **Table**: The tables chart present data in as close to raw form as possible. Tables are meant to be read, so they are ideal when you have data that cannot easily be presented visually, or when the data requires more specific attention.
-   **Graph**: The graph chart displays a tree graph of query results. This chart is best used to visualize specific relationships between entities.
-   **Status**: The status chart displays a visual summary of correlating queries. This chart is best used to show positive or negative results based on if relationships are present in query results.

#### Trend Widgets:

Insights, in addition to its point in time widget options, provides several options to visualize trends through widgeting. These widget types can be found in the widget selection process under `Trend Widgets`. The trend widgets collect the query result on a daily interval. As J1 collects the data for your query over time you are able to track and visualize the data trend between a (1W | 1M | 3M | 1Y) interval.

-   **Number**: The metric chart visualization shows one large stat value. In the trend version of this chart you are able to track the value through a spark line to see if the result is getting larger or smaller over time.
-   **Pie Chart**: The pie chart displays values from one or more queries, as they relate to each other, in the form of slices of a pie. The arc length, area and central angle of a slice are all proportional to the slices value, as it relates to the sum of all values. This type of chart is best used when you want a quick comparison of a small set of values in an aesthetically pleasing form. In the trend version of this chart you are able to track the value change of each slice value as well as the total value through a a spark line to see if the data set is getting larger or smaller over time.
-   **Line Chart**: The line chart is created by plotting a series of several points and connecting them with a straight line.
-   **Bar Chart**: The bar chart visualization allows you to view categorical data to analyze your queries with a specified x and y axis. You are able to run multiple queries and visualize the bar chart in stacked format. This chart is best suited for categorizing your results. In the trend version of the chart you are able to visualize the value change of each categorical result through a %Change indicator and a reference category bar of the result value from the previous time period selected.
-   Area Chart is coming soon! Today the best way to bring an Area Chart Trend to Insights is through a Question.

_Currently, widget previews are enabled for trend charts, but they show the non-trend version of the chart._

_Query variables are not supported in Trend Widgets at this time_

#### Adding charts widgets to an existing dashboard

Aside from creating completely new dashboards within Insights, you are also able to add charts to an existing dashboard.

> **NOTE**
> 
> Not all dashboards can have additional widgets added to them. Depending on your [user permissions](/features/admin/access-controls.md), you may or may not be able to add widgets to existing team dashboards. JupiterOne managed dashboards do not support additional widgets. You can duplicate or clone a managed dashboard to edit it.

#### Adding Markdown blocks

You can also add markdown-based widget blocks within a dashboard. This can be useful in bringing in external information, such as text, images, or links to additional resources. Anything supported by markdown can be embedded within this widget and added within a dashboard.

**To add a markdown widget**, select **Add markdown** option from a dashboard's additional options menu. It will open a markdown editor for you to input your content.

![JupiterOne Insights dashboard with a markdown widget featuring an image of a cute kitten](/assets/images/md-widget-e21d2262f325058c92c8debeafc788e7.png)

---

Source: /features/insights-and-alerts/managing-insights-dashboards

# Dashboard Management

From within the Insights section, there are several options for managing your dashboard views and organizing dashboards effectively.

### Rearranging dashboard widgets

When viewing a dashboard you can rearrange the widgets both by adjusting their size and their positioning:

-   **To move a widget**: Click and drag at the top center of the widget's border and drag it to the desired location.
-   **To resize a widget**: Click on the lower right corner and drag the widget corner to expand or shrink the widget as desired.

### Bookmarking and Favorites

Each user can favorite their own dashboards. To favorite a dashboard, click the star button in the dashboard table row or the star button in the top of the dashboard's header.

Your favorited dashboards rise to the top of the dashboards list, so the ones you use most are always easy to find. Favorites are per user — the dashboards you favorite affect only your own list and don't change what other users see.

### Deleting and duplicating dashboards

Dashboards can be duplicated for personal or team spaces. This allows the ability to further customize an existing dashboard while leaving the original dashboard intact.

**To duplicate a dashboard**, select the **three dots icon** in the dashboard header and select **Duplicate** from the drop-down. Choose whether you wish to duplicate the dashboard as a **Personal** or **Team** dashboard.

You can also delete dashboards and remove them from your workspace by selecting Delete under the three dot icon menu.

> You can only delete personal and team dashboards and will be _unable_ to delete the J1 Managed Dashboards.

### Exporting dashboards and widgets

You can export entire dashboards or individual widgets from a dashboard by clicking the **three dots icon** in the top right of either the dashboard or individual widget window.

**To export a widget or dashboard**, select **Export** and choose the desired file format. For dashboards you can export as either PDF or Schema representations, and for widgets, depending on the type of widget you can export as either CSV or PNG.

### Top Level data filters for dashboards

When viewing a dashboard you can filter the widget data simply by applying data scope filters to the board:

-   **To add a filter**: Click on the Filter icon in the Header of any Insights dashboard add a `Metadata` field, `Property`, or even a `tag`. The filter inputs will prepopulate with the data that exists in your J1 Graph, once selected the input values will be selectable from the input value dropdown.
-   **To change a filter**: Click on the Filter icon and use the filter modal to update the filters you have applied.
-   **To remove a filter**: Remove via the filter modal. This feature is available for all J1 dashboard users, the filters are saved at the User level. Currently, this feature is not applicable for charts that are using daily trend collection.

---

Source: /features/insights-and-alerts/rule-exemptions

# Exemptions

EARLY ACCESS

An **exemption** excludes one specific entity from a rule's results. The entity is still in your graph and the query still finds it, but the rule stops counting it: it is left out of the result totals the rule's condition is evaluated against, and it does not trigger any action the rule would otherwise have taken.

Use an exemption when a rule's query is right but keeps returning a result you have already looked at and decided is fine—a bastion host that is deliberately reachable from the internet, or a known test account the query will always match. Exempting it stops the rule alerting on that one entity while it goes on catching everything else, so you do not have to narrow the query or turn the rule off.

> **NOTE**
> 
> Exemptions are rolling out progressively and are not yet enabled for every account. If you do not see the **Exempt** action on your rule results, contact your JupiterOne account team.

## What an exemption does

Exempting an entity has five effects:

-   The entity is removed from the rule's results before they are counted, so it is not part of the totals the rule's condition is evaluated against.
-   The rule takes no action on it. No alert, no notification, no Jira or ServiceNow ticket, no webhook.
-   The entity remains in your graph, unchanged. An exemption is a statement about one rule, not about the asset.
-   The exempted entities are kept and shown separately, so the set you excluded is always reviewable and downloadable.
-   The change takes effect on the rule's **next scheduled evaluation**. Nothing re-evaluates at the moment you create the exemption.

> **NOTE**
> 
> Because exemptions apply at evaluation time, a rule that is currently alerting continues to alert until it next runs. To see the effect immediately, trigger the rule on demand.

An exemption applies to **the whole rule**, not to one query within it. If a rule runs three queries, exempting an entity removes it from all three. You cannot exempt an entity from a rule's finding query while still counting it in a supporting query.

## Creating an exemption

You need permission to update the rule. Exempting is a change to the rule, not to the entity, so asset-write permission is not sufficient.

1.  Navigate to **Alerts** and select the **Rules** tab, then open the rule.
    
2.  Select the **Evaluation history** tab and choose the evaluation whose results you want to work from.
    
3.  Expand the query whose results contain the entities to exempt.
    
4.  Select the rows you want to exempt, then click **Exempt**.
    
5.  Complete the exemption:
    
    -   **Justification**: Required. Why these entities do not count. This is the record other people read later, so write it for them.
    -   **Reason**: One of Risk accepted, Not applicable, False positive, or Compensating control.
    -   **Expires on**: Optional. Leave it empty for an exemption that never expires.
6.  Click **Exempt entities**.
    

The justification, reason, and expiry apply to the entire selection. Selecting twelve rows and exempting them files one decision covering twelve entities, rather than twelve separate decisions.

A selected row is skipped if it does not name exactly one entity. If some of your selection is skipped for that reason, the dialog tells you how many before you confirm.

> **NOTE**
> 
> A rule can hold at most **100 unexpired exemptions**, and you can exempt at most 100 entities at a time. Exempting beyond that is refused, and the message tells you how many the rule already has.
> 
> Expired exemptions do not count toward the limit, and re-exempting an entity that is already exempt replaces its existing exemption rather than using up another slot.
> 
> If you find yourself near the limit, that is usually a sign the query is matching more than it should. Narrowing the query is a better answer than exempting a hundred entities one by one.

## Which rules can accept exemptions

Not every rule can take exemptions, and this is the single most important thing to understand about the feature.

An exemption identifies **one individual entity**. Some queries do not return individual entities—they return counts, deduplicated values, or a graph—so there is nothing for an exemption to attach to. When a rule runs such a query, the **Exempt** action appears but is disabled, and hovering it explains why.

This is a property of the query the rule runs. It is not a permission problem, not a licensing limit, and not a defect. Rewriting the query so it returns entities makes the rule exemptable.

### Query shapes that cannot accept exemptions

| The rule's query | Why it cannot accept exemptions |
| --- | --- |
| Aggregates its results, with `count()`, `avg()`, `sum()`, or similar | A row is a summary of many entities, so no single entity can be excluded from it. |
| Uses `FIND UNIQUE` | A row stands for every entity sharing that value, not for one of them. |
| Uses `RETURN TREE` | A graph result has no rows. Removing vertices from it would leave relationships pointing at nothing. |
| Has a `RETURN` that names only values, and no entity | The results carry property values, with no entity identity to key an exemption on. |
| Has no query at all | There are no results. |

A rule can also be refused temporarily when JupiterOne cannot determine what its query returns—because the saved question behind it could not be loaded, or the query itself could not be read. The tooltip says which.

A rule can accept exemptions only when **every** query it runs can. A rule that mixes an entity-returning query with an aggregating one cannot take exemptions, because an exemption would apply to the first query and silently miss the second—leaving a condition that reads the second query's total still counting the entity you exempted.

### Entities a query traverses but does not return

An exemption can only target entities the query's `RETURN` actually names.

Consider `FIND Host THAT HAS UserAccount RETURN Host.displayName, Host._id`. The query traverses to user accounts in order to select hosts, but only hosts come back in the results. You can exempt a host from this rule. You cannot exempt a user account from it, because no user account appears in the results. To exempt user accounts, the query has to return them.

## Reviewing what you exempted

Under each query's results in **Evaluation history**, an **Exempted results** section lists the entities that evaluation held back, with a count and its own download. The two halves of the run are recorded together, so you can always see what a rule counted alongside what it did not.

This section reports what happened on that particular run. Revoking an exemption does not rewrite the runs it already applied to, and past evaluations are never edited.

Very large result sets are not rendered in the table. Download the exempted set instead.

The justification, reason, author, and expiry belong to the exemption rather than to any one run, so they are not shown here. They are on the rule's [Exemptions tab](#managing-a-rules-exemptions).

### Downloading each set separately

The included results and the exempted results each have their own download, in both CSV and JSON.

## Managing a rule's exemptions

The **Exemptions** tab on the rule detail page, alongside **Evaluation history** and **Relationships**, lists everything currently exempt from that rule.

Exemptions are grouped into the decisions that created them, newest first. Each decision shows its reason, justification, who filed it, when, and its expiry, together with what it covers—for example, "2 entities · 1 active, 1 orphaned". Expand a decision to see the individual entities, each with a **Status** of Active, Expired, or Orphaned.

Expired and orphaned exemptions are listed alongside active ones rather than being hidden. An exemption that quietly disappeared when it stopped applying would leave you to work out for yourself why a rule started alerting again.

Viewing the tab does not require permission to change the rule, so anyone with read access can review what is exempt. Revoking does require permission to update the rule.

> **NOTE**
> 
> A decision is described by what it covers **now**, not by how many rows were originally selected. Exempting an entity again under a later decision moves it to that newer decision, so revoking the older one can clear fewer entities than its header once showed. The confirmation and the result both tell you the number actually revoked.

Entity names on this tab are the ones recorded when the exemption was filed, and are not refreshed from the graph. A name can therefore lag what the entity is called today. The **Status** column is what tells you whether the exemption still matches anything: an orphaned exemption names an entity the rule no longer returns.

## Expiry

An exemption with an expiry date stops applying after that date, and the entity starts counting again on the next evaluation.

An expired exemption is **not deleted**. It stays on the rule's **Exemptions** tab marked as expired, so a rule that starts alerting again is always explainable—you can see which exemption lapsed and when. Exempting again, or extending the expiry, brings it back into effect.

Exemptions take effect as soon as they are created. There is no approval workflow in this release.

## Revoking an exemption

Revoking an exemption puts the entity back into the rule's results from the next evaluation onwards.

From the **Exemptions** tab, click **Revoke decision** to revoke a whole decision at once, or expand it, select individual entities, and revoke only those. Revoking part of a decision leaves the rest of it in place.

A revoked entity is reported as newly discovered on that next run, because the rule compares each run against the previous run's results.

Revoking always works, even on a rule that has since been edited into a shape that can no longer accept new exemptions. Exemptions never become permanently stuck.

## Limitations to plan around

### An exemption can be lost if the entity's identity changes

An exemption is keyed to the graph identity of the entity it covers. That identity is derived from the integration instance that ingested the entity together with the entity's key, so anything that changes either one detaches the exemption. A detached exemption stops applying, and the entity starts counting again.

> **WARNING**
> 
> **Removing an integration and adding it back breaks every exemption created from entities that integration ingested, all at once.** Re-adding an integration creates a new integration instance, which gives every entity it ingests a new identity. The exemptions do not follow.
> 
> If you need to reconfigure an integration, edit the existing configuration rather than deleting it and adding it again.

Other cases that detach an exemption:

-   **An integration version changes the format of its entity keys.** Affects every exemption created from that integration's entities.
-   **A placeholder entity created by a mapper is later ingested by a real integration.**

These cases do **not** affect an exemption:

-   The integration runs again and re-ingests the entity.
-   The entity is deleted and later re-ingested by the same integration instance.
-   The rule is edited, renamed, retagged, or rescheduled. Exemptions attach to the rule itself and survive its edits.

A detached exemption breaks visibly rather than silently: it stops applying, so the entity is counted again and the exemption shows on the exemptions list as orphaned. It never applies to the wrong entity.

### Exemptions are not durable on unified devices and identities

> **WARNING**
> 
> Do not rely on exemptions against [`UnifiedDevice`](/features/assets/device-unification.md) or [`UnifiedIdentity`](/features/assets/identity-unification.md) entities.
> 
> A unified entity is rebuilt whenever a new correlation arrives: JupiterOne creates a new combined entity and discards the previous one. That is routine operation, not an unusual event, so an exemption on a unified device or identity detaches on its own schedule and the entity starts counting again.

The exemption is not silently misapplied—it stops applying and shows as orphaned—but it will need re-creating, and you will not be told when. Nothing prevents you from creating one, so treat it as temporary rather than as a standing decision.

Where a rule can be written against the underlying `Host`, `Device`, or `User` entities instead, exempting those is durable, because their identity comes from the integration that ingested them rather than from correlation.

[`UnifiedVulnerability`](/reference/unified-vulnerability.md) entities are **not** affected. Their identity is derived from the CVE, so it is stable.

### One machine can need several exemptions

A query written against an entity class returns one row for every source that reported the asset, not one row per real-world thing.

`FIND Host WITH diskEncryption != true` returns a separate row for each system that reported that host. A single laptop known to your cloud provider, your CMDB, and your endpoint agent appears as three rows, and all three need exempting for the laptop to stop counting.

This is not new behavior—that query already returns three rows and the rule already counts three—but exempting is usually the moment it becomes visible. Select all the rows for that asset and exempt them together, which files them as one decision.

## Managing exemptions through the API

Everything above is available on the public GraphQL API: creating exemptions in bulk, revoking them, reading a rule's exemptions, checking whether a set of results can be exempted, and downloading either result set. See [Exemptions](/api/alert-rules.md#exemptions) in the alert rules API reference.

The JupiterOne Terraform provider does not manage exemptions.

---

Source: /features/insights-and-alerts/security-content-release-notes

# Security Content Release Notes

### June 2025

Published a new 'Kubernetes CIS Benchmark' Managed Rule Pack

NOTE: Dependencies to keep in mind: Kubernetes managed integration or similar container orchestration integration that ingests Kubernetes resources

-   kubernetes-cis-5.1.1-cluster-admin-role-usage
-   kubernetes-cis-5.1.2-minimize-access-to-secrets
-   kubernetes-cis-5.1.3-minimize-wildcard-use
-   kubernetes-cis-5.1.4-minimize-pod-create-access
-   kubernetes-cis-5.1.5-no-default-service-account-use
-   kubernetes-cis-5.1.6-sa-tokens-only-where-necessary
-   kubernetes-cis-5.1.7-avoid-system-masters-group
-   kubernetes-cis-5.1.8-limit-bind-impersonate-escalate
-   kubernetes-cis-5.1.9-minimize-pv-create-access
-   kubernetes-cis-5.1.10-minimize-node-proxy-access
-   kubernetes-cis-5.1.11-minimize-csr-approval-access
-   kubernetes-cis-5.1.12-minimize-webhook-config-access
-   kubernetes-cis-5.1.13-minimize-sa-token-creation-access
-   kubernetes-cis-5.2.1-policy-control-mechanism
-   kubernetes-cis-5.2.2-minimize-privileged-containers
-   kubernetes-cis-5.2.3-minimize-hostpid-containers
-   kubernetes-cis-5.2.4-minimize-hostipc-containers
-   kubernetes-cis-5.2.5-minimize-hostnetwork-containers
-   kubernetes-cis-5.2.6-minimize-allowprivilegeescalation-containers
-   kubernetes-cis-5.2.7-minimize-root-containers
-   kubernetes-cis-5.2.8-minimize-net-raw-capability
-   kubernetes-cis-5.2.9-minimize-added-capabilities
-   kubernetes-cis-5.2.10-minimize-capabilities-assigned
-   kubernetes-cis-5.2.11-minimize-windows-hostprocess
-   kubernetes-cis-5.2.12-minimize-hostpath-volumes
-   kubernetes-cis-5.2.13-minimize-hostports
-   kubernetes-cis-5.3.2-namespaces-network-policies
-   kubernetes-cis-5.4.1-secrets-as-files
-   kubernetes-cis-5.4.2-external-secret-storage
-   kubernetes-cis-5.6.1-administrative-boundaries-namespaces
-   kubernetes-cis-5.6.2-seccomp-profile-docker-default
-   kubernetes-cis-5.6.3-apply-security-context
-   kubernetes-cis-5.6.4-default-namespace-not-used

[https://github.com/JupiterOne/jupiterone-alert-rules/blob/main/rule-packs/kubernetes-cis.json](https://github.com/JupiterOne/jupiterone-alert-rules/blob/main/rule-packs/kubernetes-cis.json)

### February 2025

Published a new 'SBOM & App Security' Managed Rule Pack

NOTE: Dependencies to keep in mind: GitHub, Snyk, SonarCloud, or similar managed integration, and potentially a custom J1 Integration for CycloneDX or similar SBOM Generating Tool

-   sbom-code-modules-in-code-repos-with-finding
-   sbom-workloads-defined-by-code-repo-with-finding
-   sbom-all-module-versions-used
-   sbom-nested-sboms
-   sbom-commonly-used-code-modules
-   sbom-recently-merged-PRs-for-repos-with-critical-findings
-   sbom-repositories-with-active-findings
-   sbom-package-dependencies-flows
-   sbom-package-dependencies

[https://github.com/JupiterOne/jupiterone-alert-rules/blob/main/rule-packs/jupiterone-sbom.json](https://github.com/JupiterOne/jupiterone-alert-rules/blob/main/rule-packs/jupiterone-sbom.json)

### January 2025

Addition to JupiterOne Questions Library for Lansweeper integration. Checks basic configuration best practices. These will be useful for gaining more insight into your lansweeper environment.

-   integration-question-lansweeper-inactive-hosts
-   integration-question-lansweeper-hosts-outside-of-allowed-ip-range
-   integration-question-lansweeper-list-operating-system-types
-   integration-question-lansweeper-users-with-bad-status
-   integration-question-lansweeper-out-of-date-operating-systems

Additions to "MITRE ATT&CK: AWS Privilege Escalation" rule pack

-   integration-question-aws-search-for-secrets-in-lambda-functions

Addition to JupiterOne Questions Library. This question will allow an AWS user to search for keywords to ensure that there are no AWS exposed secrets in lambda function metadata. This will also enable a user to turn the question into an alert. [https://ask.us.jupiterone.io/question/a4db06a7ae955bc6c22896c651bd5cb7f0cc32e8?search=lambda&tagFilter=all](https://ask.us.jupiterone.io/question/a4db06a7ae955bc6c22896c651bd5cb7f0cc32e8?search=lambda&tagFilter=all)

-   privileges-unused-for-90-days

Addition to existing 'AWS Config' rule pack. Checks for aws role privileges that have been unused for 90 days or greater. It is recommended to review results returned and remove unused privileges.

-   aws-public-facing-resources-list

Addition to existing 'AWS Threat' rule pack. This alert returns all AWS resources that are public facing. Useful for delta detection and trending over time.

-   aws-high-privilege-lambda-function-wildcard
-   aws-high-privilege-lambda-function-lambda:\*
-   aws-high-privilege-lambda-function-get-policy
-   aws-high-privilege-lambda-function-get-function
-   aws-high-privilege-lambda-function-get-function-configuration
-   aws-high-privilege-lambda-function-list-functions

---

Source: /features/insights-and-alerts/vulns-and-findings

# Vulnerabilities and Findings

JupiterOne offers a dedicated view for highlighting vulnerabilities and findings within Alerts. This surfaces and consolidates findings and vulnerabilities imported from your configured integrations based on `Finding` class entities.

![JupiterOne Vulnerabilities and Findings](/assets/images/vulns-and-finds-overview-4526756aa2230b906aa670b270b7c6b7.png)

## Accessing Vulnerabilities and Findings

Vulnerabilities and findings now live in their own **Vulnerabilities** section in the left navigation, rather than behind a button on the Alerts page.

> **NOTE**
> 
> The steps below describe the legacy Vulnerabilities and Findings table. This experience is being reworked as part of the dedicated Vulnerabilities section, so the **Edit Query**, **Filters** tab, and **Exception** controls may differ from what you see today.

### Updating the query

By selecting **Edit Query**, you are able to adjust the query used to populate the Findings table. This will allow you to further tune the desired information that appears.

### Filtering results

With the Filters tab, you are able to filter the data to only display particular entity types, severities, or source accounts.

### Reviewing Findings

From the table, you are able to sort and adjust the findings by Type, Severity, Title/Description, Open since date, and the Source Account.

![JupiterOne finding expanded view](/assets/images/finding-expanded-2f19fc7a81c4b1df7a7c874ad7dd4af7.png)

To view a finding, simply select it from within the table. This will allow you to view the graph finding, query, and its associated metadata.

### Marking exceptions

You are able to mark findings for exception when relevant. To do so, find the entry within the table you'd like to mark as an exception, and select the **Exception** button on the right of the table.

Additionally, you are able to sort and view all exceptions with the **Show Exceptions** filter.

---

Source: /features/insights-and-alerts/whats-new-in-insights

# Insights Release Notes

**Release date: July 7, 2026**

A few improvements to Insights dashboards in the new JupiterOne app.

## What is new

| Change | What it means for you |
| --- | --- |
| Faster dashboards | The dashboards list and individual dashboards load noticeably faster |
| Compact number formatting | Number and Pie charts now display large values in a compact form — `234k` instead of `234,000`, `1.23m` instead of `1,230,000` — formatted for your locale |
| Refreshed chart styling | Charts are built on a new charting library, so you may notice small visual differences such as axis tick intervals |
| Trend timespan moved to the widget header | The trend timespan selector now lives in the widget header, giving charts more room and matching their non-trend counterparts |
| Public links in the new app | Open an existing public dashboard link in the new app by changing `apps` to `app` in the URL |

## Faster dashboards

Loading is noticeably quicker — both the dashboards list and individual dashboards open faster than before.

## Compact number formatting

Number and Pie charts now display large values in a compact form instead of writing them out in full. A value of `234,000` shows as `234k`, and `1,230,000` shows as `1.23m`, so big numbers stay readable at a glance and fit cleanly within the widget.

Numbers are formatted for your locale, so the separators and notation match your region — a user in Europe sees the format conventions for their locale rather than the US format.

## Refreshed chart styling

Charts are now built on a new charting library. Everything works the way it did before, but you may notice small visual differences — for example, the tick intervals on the x and y axes.

> **INFO**
> 
> If you run into any issues with how a chart renders, let us know.

## Trend timespan selector moved to the widget header

The trend timespan selector (1W, 1M, 3M, 1Y) now lives in the widget header instead of inside the chart area. This gives the chart more room to display your data and makes trend widgets look more like their non-trend counterparts.

## Open public links in the new app

Public dashboard links now work in the new JupiterOne app. To open an existing public link in the new app, change `apps` to `app` in the URL:

-   Current: `https://apps.us.jupiterone.io/...`
-   New app: `https://app.us.jupiterone.io/...`

That's the only change needed — the rest of the link stays the same.

---

Source: /features/insights-and-alerts/whats-new-in-rules-and-alerts

# Rules and Alerts Release Notes

**Release date: June 23, 2026**

JupiterOne has rebuilt Rules and Alerts on its modern app foundation. Everything you relied on before is still here, and the rebuild brought a few improvements worth calling out.

## What is new

| Change | What it means for you |
| --- | --- |
| Unified Rules page | Your rules and your firing alerts now share one page with **All rules** and **Alerting** tabs - no jumping between separate pages to connect an alert to its rule |
| Single rule detail page | Configuration, alert information, evaluation history, and relationships for a rule now live on one page |
| Jira tickets from live fields | The **Create Jira ticket** action pulls the real field definitions from your Jira instance, so you pick valid values instead of hand-writing JSON |
| Clearer action preview and test | Previewing and testing an action now opens in a dedicated view with room for the full rendered action and the test result |
| Live evaluation view | The rule detail page shows an evaluation as it runs, in real time |

## Rules and alerts now live on one page

Your rules and your firing alerts now share a single **Rules** page with two tabs:

-   **All rules** — every rule in your workspace.
-   **Alerting** — only the rules that are currently firing, surfaced highest-severity first.

Each firing rule sits right alongside its alert, so you can see what's alerting and why without jumping between separate pages.

![The Rules page showing the All rules and Alerting tabs, with rules and their firing alerts in one table](/assets/images/unified-rules-table-b7db74a57c2c797b01d4db903f5f587d.png)

## A single rule detail page

Every rule now has one detail page that brings its configuration, alert information, evaluation history, and relationships together in one place. When a rule is firing, its alert details sit right alongside the rule itself, so you no longer have to move between a separate alert view and the rule that produced it.

The **Evaluation history** tab shows results over time as a chart you can click through run by run. For any run, you can drill into the breakdown — queries (with downloadable result tables), conditions, actions, and outputs — and open the full logs for any action that ran.

![Rule detail page showing rule configuration and alert details up top, with the Evaluation history tab and its results-over-time chart and evaluation breakdown below](/assets/images/rule-detail-evaluation-history-4a7f746ec9af9d178276d6a739fc5d90.png)

You can also collapse the summary at the top of the page to give the evaluation details more room. When you're focused on a specific run's breakdown, collapse the rule configuration and alert summary to bring the chart and step-by-step breakdown front and center.

![Rule detail page with the top summary collapsed, giving the evaluation history chart and breakdown more room](/assets/images/rule-detail-collapsed-metadata-ae676ee671b1c31dcc605f929173453a.png)

## Build Jira tickets from real Jira fields

When you configure a **Create Jira ticket** action, the editor now pulls the live field definitions from your Jira instance for the issue type you choose. Instead of hand-writing JSON, you pick from the actual options that issue type accepts — dropdowns for single-select fields, checklists for multi-select fields, and text or number inputs for the rest.

This means the values you set are real and valid up front, with far less guesswork.

> **INFO**
> 
> If a field can't be loaded — for example, the connected Jira account lacks the required permission, or the instance isn't Jira Cloud — the editor tells you why and you can still set additional fields as JSON.

## A clearer way to preview and test actions

Previewing and testing an action while building a rule isn't new — but it now opens in a dedicated view that's much easier to read and work with.

-   **Preview** renders the action's template against a small sample of your rule's real query results — so you can confirm the message, ticket, or payload looks right with live data filled in.
-   **Test** executes the action against its live integration with that sample data and reports success or the failure reason. Test is available for webhook, Jira, and Slack actions.

Open it from **Preview** on the action you're editing. The view has room for the full rendered action and the test result, and closing it returns you to your configuration where you left it.

## Watch an evaluation run live

When a rule is evaluating — whether you just selected **Evaluate now** or a scheduled run is underway — the rule detail page shows the evaluation happening in real time. Instead of a static page you have to refresh, you'll see a live indicator and placeholder steps that fill in as the run progresses, then settle into the completed results when it finishes.

---

Source: /features/integrations/data-out-1-0

# Data Out 1.0 Release Notes

**Release date: May 19, 2026**

Data Out 1.0 launches a first-class outbound integration surface in JupiterOne. Workspace admins can authorize a Jira connection in three guided steps, stand up named workflow instances that route J1 events to a specific project + issue type, and watch every outbound delivery in a unified Jobs log. CCM users can turn any failing control into a tracked Jira ticket with a single click - and the resulting ticket is linked back from the control detail panel so closing the loop is one tap away.

## What is new in Data Out 1.0

| Feature | What it means for you |
| --- | --- |
| Top-level Data Out surface | Two new tabs - **Connections** and **Instances** - under the Integrations module, with a clean separation between getting data into J1 and getting it out |
| Jira provider (live) | Authenticate Jira workspaces via Atlassian API token, see "coming soon" placeholders for ServiceNow and Asana |
| Guided Connection wizard | Two steps to authorize a Jira workspace (Connect + Verify) plus an optional Configure + Test pass to spin up the first instance in the same flow |
| Add Jira instance wizard | A 3-step Stepper modal (Select Connection -> Configure -> Test) that creates a named instance scoped to a Jira project + issue type, with an optional in-wizard test ticket |
| Instance lifecycle controls | Edit, Stop, and Delete instances from a single hover row; per-instance detail page with summary metrics and a focused jobs table |
| Per-instance Jobs table | Every outbound delivery for an instance is recorded on its detail page, with status, timestamps, and per-job error messages for triage |
| CCM Create ticket | A prominent **Create ticket** action on every failing CCM control test, opening a 4-field modal (Workflow / Title / Description / Assignee) and dropping a ready-to-go ticket into Jira |
| Linked Jira issues + View in Jira | Tickets created from CCM appear inline on the originating control detail panel, with a one-click **View in Jira** link |
| Full-admin gate | Connection and instance configuration is locked to full admins so credentials and routing stay under tight control |

## Top-level Data Out surface

Data Out is now its own destination in the J1 left navigation under Integrations. Two tabs split the responsibility cleanly: **Connections** is for credentials, and **Instances** is for routing - with execution history surfaced on each instance's detail page.

![Data out tabs - Connections and Instances](/assets/images/data-out-tabs-overview-53e3ff3531c872543aae8edfbe501e29.png)

The Connections tab presents the provider catalog. Jira ships live with a green **Connected** badge once you finish the wizard; ServiceNow and Asana are surfaced as **Coming soon** placeholders so customers know they are coming without us blocking the rollout on them.

![Data out Connections tab with Jira (Connected), ServiceNow (Coming soon), Asana (Coming soon)](/assets/images/connections-tab-providers-29dcfdbab6f6e86ef38f194c899b1a7a.png)

> **TIP**
> 
> Use the **Connections** tab as the single source of truth for "is this credential still good?" - the **Authorization status** badge on each connection card flips to **Needs reauthorization** the moment a token expires.

## Guided Jira connection wizard

Authorizing Jira is now a two-step Stepper experience. The Connect step captures the Atlassian site, account email, and API token; the Verify step proves the credentials work by listing the Jira projects we can read with them.

![Connection wizard Step 1 - Connect: Connection name, Host name, Email, API Token](/assets/images/connection-wizard-connect-39b9d953fceea4528547c70af2fce043.png)

![Connection wizard Step 2 - Verify: Your connection is working! with project list](/assets/images/connection-wizard-verify-ec2378139b42051aa7c12384d57515b2.png)

In the new-connection flow, the wizard continues directly into the Add Jira instance Configure + Test steps, so an admin finishes with a working connection **and** a first running workflow in a single pass. See the [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md) guide for the end-to-end walkthrough.

## Add Jira instance wizard

Standing up an instance is a 3-step Stepper modal: pick a connection, configure the workflow, and (optionally) send a test ticket through it.

![Add Jira instance Step 1 - Select Connection](/assets/images/add-instance-step1-select-connection-d21a0efb8403be67ce526fd95c93a8b7.png)

The Configure step is where you tell Data Out which Jira project and issue type the instance writes to. The **Data in Jira integration** field links the instance to a project J1 already ingests, so the **Issue type** dropdown is populated from the project's real metadata.

![Add Jira instance Step 2 - Configure: Workflow name, Data in Jira integration, Issue type](/assets/images/add-instance-step2-configure-4300422dfe84c46c63c372728f52c403.png)

The Test step lets you confirm the round-trip before you trust the instance with real CCM tickets. It posts a real Jira ticket with a Summary and Description you can edit.

![Add Jira instance Step 3 - Test: Send a test payload to verify the workflow is running](/assets/images/add-instance-step3-test-59e2ead3b0f88a29ef0b3aa585706f4f.png)

See the [Create an instance](/integrations/data-out/create-instance.md) guide for the full walkthrough.

## Instance lifecycle and the Instances tab

The Instances tab groups every running instance by provider with **N instances / N active** badges per group. Hovering a row reveals **Stop**, **Edit**, and **Delete** actions on the right edge.

![Instances tab grouped by provider with Jira instances](/assets/images/instances-tab-3b5c2f3ab86408aca7a5c6e44177ebc4.png)

Clicking an instance opens a per-instance detail page with eight headline metrics (Status / Last run / Last updated / Lifetime tasks / Jobs succeeded / Jobs failed / Data in integration / Issue type) plus a focused per-instance Jobs table.

![Instance detail page with summary header and per-instance jobs table](/assets/images/instance-detail-page-1e9050638080568892d8dcfbc44a7fa7.png)

See the [Manage instances](/integrations/data-out/manage-instances.md) guide for the full reference.

## CCM Create ticket

The flagship producer experience in 1.0 is the **Create ticket** action on every failing CCM control test. From the control detail panel, click **Create ticket** to open a 4-field modal: pick a Workflow, edit the prefilled Title and Description, optionally assign a teammate, and click Create.

![CCM Create ticket modal with Workflow, Title, Description, and Assignee fields](/assets/images/create-ticket-modal-d6303c087312c4cf37c3c67e61c8da53.png)

The Description editor renders rich markdown (headings, lists, links, tables) and converts cleanly to Jira wiki markup on submit, so the resulting Jira ticket reads naturally:

![Resulting Jira ticket: Control failure title, Failing control tests description, Reporter and Assignee populated](/assets/images/jira-ticket-created-7c6d2be5daca9b99f974115384bbe98a.png)

In 1.0 the modal exposes only the four fields above. Project, issue type, priority, labels, and other Jira-side configuration are determined by the selected Workflow - so admins can pre-bake routing decisions and let CCM users focus on the message they want to land.

After Create ticket succeeds, the originating control detail panel surfaces a **Linked Jira issues** section listing every ticket created from that control, each with a **View in Jira** external link.

See the [Create a Jira ticket from a failing CCM control test](/integrations/data-out/create-ticket-from-ccm.md) guide for the full round-trip.

## Per-instance Jobs table

Every outbound delivery for an instance is recorded on the instance's detail page (`Data out > Instances > {Workflow name}`) with **Job ID**, **Status**, **Started**, **Completed**, and **Error message** columns. The same page surfaces lifetime success and failure counts so admins can spot a degraded instance at a glance.

See the [Manage instances - Per-instance Jobs table](/integrations/data-out/manage-instances.md#per-instance-jobs-table) guide for the full reference.

## Permissions

Data Out 1.0 is admin-first by design:

-   **Connections** and **Instances** tabs require the **full admin** role
-   The **Create ticket** modal in CCM is available to any user who can open the control detail panel - but if no Active workflow exists, non-admins see "Ask an admin to set up a data-out ticketing workflow."
-   **View in Jira** links inherit the user's existing Jira project permissions in Atlassian

## Getting started

If you are a workspace admin setting up Data Out for the first time:

1.  Read the [Data Out overview](/integrations/data-out/overview.md) to orient yourself
2.  Mint an API token and follow [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md)
3.  Continue into [Create an instance](/integrations/data-out/create-instance.md) and send a test ticket
4.  Tell your CCM users they can now click **Create ticket** on failing controls - link them to the [Create a ticket from CCM](/integrations/data-out/create-ticket-from-ccm.md) walkthrough

---

Source: /features/jupiterone-ai

# JupiterOne AI

JupiterOne AI brings artificial intelligence capabilities directly into the JupiterOne platform, helping you work faster and more effectively with your security data. Rather than requiring deep knowledge of query syntax or data models, you can interact with your asset graph using natural language.

## Capabilities

JupiterOne AI includes several capabilities designed to accelerate common security and IT workflows:

| Capability | Description |
| --- | --- |
| [AI Chatbot](/features/jupiterone-ai/ai-capabilities.md#ai-chatbot) | Ask questions about your security posture, assets, and compliance in natural conversation |
| [Natural language search](/features/jupiterone-ai/ai-capabilities.md#natural-language-search) | Convert plain English questions into J1QL queries |
| [AI Entity Summary](/features/jupiterone-ai/ai-capabilities.md#ai-entity-summary) | Get auto-generated, human-readable summaries of any entity in your graph |
| [AI Remediation Recommendations](/features/jupiterone-ai/ai-capabilities.md#ai-remediation-recommendations) | Receive step-by-step vulnerability remediation guidance tailored to your environment |
| [AI Control Authoring](/features/jupiterone-ai/ai-capabilities.md#ai-control-authoring) | Generate compliance control descriptions, remediation steps, and exception processes |

For detailed usage instructions and prompt tips for each capability, see the [capabilities guide](/features/jupiterone-ai/ai-capabilities.md).

## Security and privacy

JupiterOne AI is built with enterprise security requirements in mind. All AI processing occurs within JupiterOne's own AWS infrastructure.

### Model and infrastructure

JupiterOne AI is powered by **large language models developed by Anthropic**, accessed through **AWS Bedrock**. This means:

-   **Your data stays within JupiterOne's AWS account.** All requests to the AI model are routed through AWS Bedrock within JupiterOne's own AWS infrastructure. No customer data is sent to third-party AI providers or external endpoints.
-   **Your data is not used to train AI models.** AWS Bedrock does not use customer inputs or outputs to train, improve, or fine-tune foundation models. Your queries, data, and results remain private.
-   **Enterprise-grade security.** AWS Bedrock provides encryption in transit and at rest, and is covered by AWS compliance certifications including SOC 2, ISO 27001, and HIPAA eligibility.

### What data does JupiterOne AI access?

The data available to JupiterOne AI depends on which capability you are using:

-   **Natural language search:** JupiterOne AI uses your question along with knowledge of the JupiterOne data model and J1QL syntax to generate queries.
-   **AI Chatbot:** The chatbot can execute J1QL queries on your behalf and reason about the results. It has access to the same data your user account can access in JupiterOne.
-   **AI Entity Summary:** The AI receives the properties of the specific entity you are viewing to generate a summary.
-   **AI Remediation Recommendations:** The AI receives vulnerability details (CVE information, severity scores, affected asset metadata) to generate remediation steps.
-   **AI Control Authoring:** The AI receives the control context you provide to generate compliance documentation.

> **INFO**
> 
> JupiterOne AI does not have access to data outside of what is available in your JupiterOne account. It cannot access your source systems (such as AWS, GitHub, or Okta) directly — it only works with the data already ingested into JupiterOne.

## Frequently asked questions

**What large language model does JupiterOne AI use?**

JupiterOne AI uses various Anthropic large-language models, accessed through AWS Bedrock. Different capabilities use different model sizes optimized for their specific task — for example, entity summaries use a smaller, faster model while the chatbot and remediation recommendations use a more capable model.

**Is my data used to train AI models?**

No. AWS Bedrock does not use customer inputs or outputs to train or improve foundation models. Your data remains private and is never shared with model providers.

**Can JupiterOne AI build dashboards or create alert rules automatically?**

JupiterOne AI currently focuses on querying, analysis, and recommendations. It does not create or modify platform configurations such as dashboards, alert rules, or integrations. For automated platform interactions using AI tools, see the [JupiterOne MCP Server](/integrations/jupiterone-mcp-server.md).

**Who can use JupiterOne AI?**

JupiterOne AI capabilities are available to all users within your JupiterOne account. Access to specific capabilities may vary based on your account plan and feature availability.

**Can JupiterOne AI be disabled for my account?**

Yes. If your organization requires that AI features be disabled, contact your JupiterOne account team to configure this setting for your account.

## Related topics

-   [JupiterOne AI capabilities](/features/jupiterone-ai/ai-capabilities.md)
-   [J1QL overview](/j1ql.md)
-   [JupiterOne MCP Server](/integrations/jupiterone-mcp-server.md)

---

Source: /features/jupiterone-ai/ai-capabilities

# JupiterOne AI capabilities

JupiterOne AI provides several capabilities that help you work with your security data more efficiently. This page covers how to use each capability and provides tips for getting the best results.

## AI Chatbot

The AI Chatbot provides a conversational interface for interacting with your JupiterOne data. You can ask questions about your security posture, investigate assets, explore relationships, and get answers in natural language.

### Using the AI Chatbot

1.  Select **Ask AI** in the top right of the app.
2.  Enter your question in the chat input field.
3.  The chatbot processes your question, and may execute J1QL queries on your behalf to gather relevant data.
4.  Review the response, which includes both the answer and any queries that were run.

In supported views, the assistant is context-aware — when you have an entity open in the inspector or an active query result, it has context of what you're looking at and can link you directly to specific entities in its responses.

The chatbot maintains conversation context within a session, so you can ask follow-up questions without repeating background information.

> **NOTE**
> 
> Chat conversations are not persisted between sessions. If you close or navigate away from the chat, the conversation history is not retained.

### Example prompts

-   "What are my most critical unpatched vulnerabilities?"
-   "Show me all AWS S3 buckets that are publicly accessible"
-   "Which users have admin access to production environments?"
-   "How many new assets were added in the last 7 days?"
-   "What integrations are currently failing?"

> **TIP**
> 
> Be specific in your questions. Instead of "What is my security posture?" try "What are my open critical vulnerabilities that have been unpatched for more than 30 days?" The more context you provide, the more accurate the response.

### Providing feedback

Each chatbot response includes feedback options. Use these to indicate whether a response was helpful. Your feedback helps improve the accuracy of future responses.

---

## Natural language search

Natural language search converts your plain text questions into JupiterOne Query Language (J1QL), so you can find information without needing to know query syntax.

### Using natural language search

1.  Enter your question in the search bar. Any input that doesn't start with `FIND` defaults to AI mode.
2.  Press **Enter**.
3.  JupiterOne AI returns several query candidates based on your question — pick the one that best matches your intent.
4.  Review and edit the query if needed, then run it.

If you want to write J1QL directly, start your input with `FIND` and the search bar switches to J1QL mode with autocomplete.

![JupiterOne AI natural language search showing Ask AI in the search bar](/assets/images/ask-ai-searchbar-37db52f8c9df49bf5009f2a5eb23a11f.png)

### Example queries

| Natural language question | Generated J1QL |
| --- | --- |
| "What new S3 buckets were created in the last week?" | `FIND aws_s3_bucket WITH createdOn > date.now-7days` |
| "Show me all IAM users created in the last week" | `FIND aws_iam_user WITH createdOn > date.now-7days` |
| "Which EC2 instances are running without encryption?" | `FIND aws_instance THAT !USES aws_kms_key` |

> **NOTE**
> 
> Natural language search generates queries based on JupiterOne's data model. The generated query may not always match your exact intent — review and edit the query before running it for best results.

### Tips for better results

-   **Be specific about time ranges.** "Recently" is ambiguous — use "in the last 7 days" or "since January" instead.
-   **Use entity names when you know them.** "AWS S3 buckets" generates better results than "storage."
-   **Ask one question at a time.** Complex multi-part questions may not translate well into a single query.
-   **Review the generated query.** Edit the J1QL if the AI misinterpreted your intent before running it.

---

## AI Entity Summary

AI Entity Summary generates a human-readable explanation of any entity in your JupiterOne graph. Instead of reading through raw properties, you get a concise summary that highlights what the entity is and any noteworthy attributes.

### Using AI Entity Summary

1.  Navigate to any entity detail page in JupiterOne.
2.  The AI-generated summary appears automatically, providing a 50-100 word description of the entity.

The summary includes:

-   What the entity is and its role in your environment
-   Notable properties or configurations
-   Any unusual or noteworthy attributes that may require attention

### Example

For an AWS EC2 instance, the summary might read:

> This is a production Linux EC2 instance (t3.large) running in us-east-1a. It was launched 45 days ago and is currently running. The instance has a public IP address assigned and is associated with a security group that allows inbound SSH from 0.0.0.0/0, which may warrant review.

---

## AI Remediation Recommendations

AI Remediation Recommendations provide step-by-step guidance for resolving vulnerabilities identified in your environment. The recommendations are tailored to the specific vulnerability, affected assets, and the integration source that detected the issue.

### Using AI Remediation Recommendations

1.  Navigate to a vulnerability in JupiterOne.
2.  Remediation recommendations are generated automatically.
3.  Review the generated guidance, which includes:
    -   **Recommended actions** — numbered, actionable remediation steps
    -   **Vulnerability details** — CVSS score, EPSS percentile, exploit maturity
    -   **Affected assets** — grouped by type and source integration
    -   **Cautions** — safety warnings and testing recommendations

### What the recommendations include

AI Remediation Recommendations are context-aware and vary based on how the vulnerability was detected:

-   **SBOM-sourced vulnerabilities:** Package manager commands (npm, pip, maven, apt, yum) with specific version upgrade targets
-   **AWS Inspector findings:** AWS Systems Manager Patch Manager procedures or OS-level patching commands
-   **Endpoint detection (CrowdStrike, Tenable, Qualys):** Standard OS update procedures and patch deployment guidance
-   **General vulnerabilities:** Vendor advisory monitoring, defense-in-depth measures, and compensating controls

> **WARNING**
> 
> Always test remediation steps in a non-production environment before applying them to production systems. Verify that the recommended actions are applicable to your specific configuration before proceeding.

### Tips for using remediation recommendations

-   **Check the affected asset list.** The recommendations are based on a sample of affected entities — verify applicability across your full environment.
-   **Review version-specific guidance.** When upgrade targets are provided, confirm the target version is compatible with your application dependencies.
-   **Use the urgency indicators.** Vulnerabilities with active exploits (KEV catalog, public exploits) should be prioritized.

---

## AI Control Authoring

AI Control Authoring helps you create and complete compliance control documentation. When authoring controls in JupiterOne, the AI can generate descriptions, remediation steps, and exception processes based on the control context you provide.

### Using AI Control Authoring

1.  Navigate to **Compliance** > **Controls**.
2.  Create or edit a control.
3.  Use the AI assist option to generate content for fields such as:
    -   **Control description** — a clear explanation of what the control requires
    -   **Remediation steps** — guidance for addressing control failures
    -   **Exception process** — documentation for handling exceptions to the control
4.  Review and edit the generated content before saving.

### Tips for control authoring

-   **Provide a clear control name and identifier.** The more context the AI has about the control's purpose, the better the generated content.
-   **Specify the framework context.** Indicate which compliance framework (SOC 2, ISO 27001, CIS) the control relates to for more relevant output.
-   **Review and customize.** AI-generated control content is a starting point — always review and adjust to match your organization's specific policies and terminology.

---

## General tips for working with JupiterOne AI

-   **Start simple, then refine.** Begin with straightforward questions and add detail as needed.
-   **Use JupiterOne terminology.** Refer to entities, classes, and types using JupiterOne's data model terminology for more accurate results. For example, use "aws\_instance" rather than "virtual machine."
-   **Provide context.** Include relevant details like time ranges, specific asset types, or severity levels.
-   **Iterate.** If the first response is not quite right, rephrase your question or provide additional context rather than starting over.

## Related topics

-   [JupiterOne AI overview](/features/jupiterone-ai.md)
-   [J1QL overview](/j1ql.md)
-   [JupiterOne MCP Server](/integrations/jupiterone-mcp-server.md)
-   [Compliance controls](/features/ccm/continuous-control-monitoring.md)

---

Source: /features/vulnerability-management

# Unified Vulnerability Management

JupiterOne Unified Vulnerability Management (UVM) takes the raw output of every vulnerability scanner you run and turns it into a short list of remediation plans, routed to the right team. You see one row per vulnerability per asset across all sources, you prioritize using a risk score you control, and you act on plans rather than triaging a million findings.

UVM is also the system of record for what happens next. Every vulnerability on every asset carries a [lifecycle state](/features/vulnerability-management/vulnerability-lifecycle.md) — open, awaiting verification, fixed, mitigated, exempted — tracked in one place across all of your scanners, verified against scanner evidence, and synchronized with Jira in both directions.

UVM is designed for security analysts who triage findings, security leaders who need a defensible prioritization model, and the service owners who actually apply the fixes.

## Overview

Unified Vulnerability Management enables your team to:

-   **Deduplicate vulnerability findings** across infrastructure scanners, cloud-native tools, and endpoint platforms into a single row per vulnerability per asset
-   **Prioritize using a transparent, layered risk score** that combines technical impact and exploitation likelihood with asset context and control evidence, with a model and threshold you configure
-   **Group prioritized vulnerabilities into remediation plans** that share a common fix, so your teams act on dozens of plans instead of thousands of CVEs
-   **Route cases to the team that owns the affected assets** through organizational unit ownership, with AI-generated remediation context attached
-   **Track the lifecycle of every vulnerability per asset** — claim fixes and have scanners verify them, record false positives, and see every state change on an attributed timeline
-   **Manage exemptions with expiry dates** — accept risk or mark vulnerabilities non-exploitable with a justification, and review each exemption when it expires instead of losing track of it
-   **Synchronize with Jira in both directions** — ticket closures propose lifecycle states in JupiterOne, and case progress writes back to the ticket
-   **Report remediation outcomes to leadership** from an executive dashboard built on daily snapshots
-   **Ask the AI assistant** to sort, filter, and navigate the UVM views in natural language

![Unified Vulnerability Management landing page with summary metrics, the prioritization funnel, and the vulnerabilities table](/assets/images/uvm-overview-c2c88797961777540d91d71a6276a624.png)

The summary header on every UVM page shows:

-   **Overall risk score** — the average CVSS score across your prioritized vulnerabilities (0–10)
-   **Unresolved vulnerabilities** — total deduplicated vulnerabilities still open
-   **Critical findings** — count of critical-severity vulnerabilities, broken down by how many are prioritized and how many lack a plan
-   **Active remediation cases** — count of cases currently routed to your service teams

## The prioritization funnel

Every UVM view is a stage in a single funnel. You start with raw findings on the left and end with team-routed cases on the right. The Sankey diagram at the top of every UVM page shows the live shape of the funnel for your environment, including which scanners are contributing to each stage.

The four stages are:

| Stage | What it contains | What it answers |
| --- | --- | --- |
| **Source** | Raw findings, one row per scanner per asset per CVE | Which vulnerabilities did each tool report? |
| **Unified** | Deduplicated vulnerabilities, one row per CVE per asset, with all reporting sources rolled up | What is the real, unique set of vulnerabilities I have? |
| **Prioritized** | Unified vulnerabilities whose risk score exceeds your configured threshold | Which vulnerabilities should I work on first? |
| **Remediation plans** | Prioritized vulnerabilities grouped by a common fix, routed to owning teams as cases | What is the smallest set of actions that addresses the most risk? |

Each stage is a tab in the UVM navigation. You can click any node in the Sankey diagram to filter the underlying table to that segment of the funnel.

## Source vulnerabilities

The **Source** tab shows raw findings exactly as your scanners report them. One row exists for every (scanner, asset, CVE) tuple. This is the data ingestion layer of UVM — the same vulnerability seen by three scanners on one host appears as three rows here.

Use this view when you need to:

-   Audit which scanner reported a specific finding
-   Compare coverage between tools
-   Investigate why a finding does or does not appear in the Unified view

**Columns:** Vulnerability, CVE, Asset, Source, CVSS, Source severity, Age, Remediation plan.

**Filters:** Source (scanner integration), CVSS range, Severity, Age. The Search field matches against CVE identifier, vulnerability title, and asset name.

> **NOTE**
> 
> The **Source severity** column shows severity exactly as the reporting scanner rated it. The Unified and Prioritized views show a normalized severity derived from CVSS, so the same finding can carry different severities in the Source view and the unified views.

The **Remediation plan** column links each finding to the plan that addresses it, when one exists. Findings without a plan show an em dash.

## Unified vulnerabilities

The **Unified** tab is where deduplication happens. JupiterOne aligns vulnerability data from every configured scanner against a single ontology and collapses duplicate findings into one row per CVE per asset. The **Sources** column shows which scanners reported each finding.

![Unified Vulnerabilities tab showing deduplicated CVEs with EPSS, KEV indicators, and source attribution chips](/assets/images/unified-view-84d74b988a2e1c7fdc28c3ce754e0bba.png)

**Columns:** Vulnerability, CVE, Asset, Severity, CVSS, EPSS, KEV, Sources, State.

**Filters:** Severity, CVSS range, Source, Age, State.

The **State** column shows where each vulnerability stands in its [lifecycle](/features/vulnerability-management/vulnerability-lifecycle.md). By default the Unified and Prioritized views show your active work: vulnerabilities in closed states (Fixed, Mitigated, Accepted risk, Non-exploitable, and False positive) are hidden. Use the **State** filter to view them — closed vulnerabilities are archived by filter, not moved to a separate page.

### EPSS and KEV

The Unified view enriches every CVE with:

-   **EPSS** — The Exploit Prediction Scoring System probability, expressed as a percentage. This is the likelihood that the vulnerability will be exploited in the wild in the next 30 days, sourced from FIRST.org and updated weekly. The exact data refresh date is shown above the table.
-   **KEV** — A chip indicating that the CVE appears in CISA's Known Exploited Vulnerabilities catalog. KEV CVEs have confirmed in-the-wild exploitation.

> **TIP**
> 
> Sort by EPSS descending to see the vulnerabilities most likely to be exploited soon. Combine the **KEV** filter with the **Severity = Critical** filter for a focused view of CVEs that are both severe and actively exploited.

### Source attribution

Each row shows a chip for every scanner that reported the underlying finding. A CVE seen by CrowdStrike, SentinelOne, Tenable, and Wiz on the same host appears as one row in this view with four source chips. Click any row to inspect the underlying raw findings.

UVM ships with first-class support for the following scanner integrations:

-   CrowdStrike Falcon
-   Qualys VMDR
-   SentinelOne
-   Tenable.io
-   Wiz

Findings from Software Bill of Materials (SBOM) ingestion also appear as a source chip on affected assets.

## Prioritized vulnerabilities

The **Prioritized** tab shows the subset of unified vulnerabilities whose risk score exceeds the prioritization threshold you have configured. This is the working list for your security analyst.

![Prioritized Vulnerabilities tab showing CVEs with risk scores, owner teams, and context columns](/assets/images/prioritized-view-9193d2b4da359eb76c77e2728e339872.png)

**Columns:** CVE, Owner team, Asset, Risk, Severity, CVSS, EPSS, KEV, Context.

**Filters:** Team, Severity, CVSS, Context, Source, Age.

### What "prioritized" means

A vulnerability is prioritized when its **Risk** score meets the prioritization threshold — 90% by default. The **Risk** column shows scores on a 0–10 scale, so with the default threshold a vulnerability needs a score of at least 9.0 to appear here. You can adjust the scoring model and the threshold from the [Risk configuration](/features/vulnerability-management/risk-scoring.md) panel.

### Owner team

The **Owner team** column shows which organizational unit (OU) owns the affected asset. This drives where the case is routed when a remediation plan is created. OUs are configured once and shared across JupiterOne — see [Organizational Units](/features/admin/organizational-units.md) for how OUs are derived, how to set owner and routing metadata, and how to filter by OU.

### Context

The **Context** column surfaces asset-level signals that influenced the risk score, including whether the asset is tagged as a crown jewel and whether it is reachable from the public internet.

## Remediation plans

The **Remediation plans** tab is where your team takes action. A plan groups multiple prioritized vulnerabilities that share a common fix — for example, all CVEs resolved by patching Apache ActiveMQ to 5.18.3.

![Remediation Plans tab with plan cards showing severity, case coverage, risk reduction, and CVEs covered](/assets/images/plans-view-1b626ddb8261d3b0ae509472d5b7fdcf.png)

Each plan card shows:

-   **Title** — A descriptive action statement (for example, "Upgrade Apache ActiveMQ to 5.18.3+ or 5.17.6+")
-   **Owner team** — The organizational unit responsible for the plan, or an em dash if no owner is assigned
-   **Severity** — The highest severity across the plan's CVEs
-   **Matched by product name** — How the plan was grouped. UVM groups vulnerabilities by Common Platform Enumeration (CPE), using the product name resolved from each finding.
-   **Case coverage** — Percentage of affected assets covered by a routable case
-   **Risk reduction** — The total risk score reduction your environment achieves when this plan is completed
-   **CVEs covered** — Number of unique CVEs addressed by this plan
-   **Highest CVSS** — The most severe CVSS score among the plan's CVEs

**Filters:** Severity, CVSS (sortable by Highest CVSS), Age.

Each plan card also lists its cases with their derived status. Use the **By plan** / **By case** pivot to switch the tab between plan cards and a flat list of cases, filterable by team and case status.

### Plan detail

Click any plan card to open the plan detail panel.

![Plan detail panel showing the AI-generated remediation summary, risk metrics, and affected assets](/assets/images/plan-detail-0030556e45780c0ab8d2556150532a95.png)

The plan detail panel provides:

-   **Remediation summary** — An AI-generated description of the vulnerability, its impact, and why the plan should be prioritized
-   **Plan metrics** — Risk reduction, CVEs covered, CVEs in KEV, Highest CVSS, Highest EPSS
-   **Stat tabs** — Counts and lists for **Assets**, **Cases**, and **CVEs** included in the plan
-   **AI remediation steps** — Step-by-step fix instructions generated for this specific plan
-   **Properties**, **Tags**, **Metadata**, and **Raw Data** tabs for the underlying graph entity

The plan persists as a graph entity in your JupiterOne account, so you can query plans with J1QL alongside the rest of your asset data.

## AI Assistant

The **Ask AI** button in the UVM header opens the AI Assistant sidebar. The assistant operates on the current UVM view and helps you sort, filter, and navigate without writing queries.

![AI Assistant sidebar with suggested prompts including &#39;Which plan should I start with for the most impact?&#39;](/assets/images/ai-assistant-5a82656fe545a7d1896dfc22ea9a30a3.png)

The assistant supports natural-language commands such as:

-   "Sort by EPSS descending"
-   "Filter to plans addressing critical vulnerabilities"
-   "Which plan should I start with for the most impact?"
-   "How are plans created, and what do confidence levels mean?"

When the assistant references a specific entity in its response, click the reference to open the entity inspector with full context.

> **NOTE**
> 
> The AI Assistant is in beta. Responses can occasionally be incorrect, and very large contexts can slow the response. JupiterOne does not use your workspace data to train its models.

## Getting started

### Step 1: Confirm your scanner integrations are configured

UVM aggregates findings from your configured integrations. From **Integrations**, confirm that at least one of the following is configured and syncing:

-   CrowdStrike Falcon
-   Qualys VMDR
-   SentinelOne
-   Tenable.io
-   Wiz

You can see how many findings each scanner is contributing by hovering any source node in the Sankey diagram on the UVM landing page.

### Step 2: Tag your crown jewel assets

Crown jewel status is a major lever in the default risk score. To make sure your most important assets surface near the top of the Prioritized view:

1.  Identify the assets that are business-critical (production databases, payment systems, customer-data stores)
2.  Apply `tag.crownJewel` in your cloud or infrastructure provider, or
3.  Author a [Smart Class](/features/assets/smart-classes.md) J1QL query that selects them — targeting unified devices for the fastest effect

Tagged assets influence prioritization once the tag reaches the unified device, which can take up to 7 days for source-applied tags.

### Step 3: Set your scoring model and prioritization threshold

1.  Open the **Risk configuration** panel by selecting the edit (pencil) icon on the Overall risk score card
2.  Review the layered scoring defaults: the threat blend of technical impact and exploitation likelihood, the KEV floor, and the context multipliers for crown jewel and publicly exposed assets
3.  Adjust the model to match your organization's risk priorities. For example, raise the crown jewel multiplier if asset criticality should dominate, or enable the controls layer once your CCM controls carry MITRE ATT&CK technique mappings.
4.  Set the **Prioritization threshold**. A lower threshold widens the Prioritized view; a higher threshold tightens it.
5.  Click **Apply changes**

### Step 4: Confirm case routing is configured

1.  From the Risk configuration panel, select the **Cases — Ownership assignment** namespace you use for team routing
2.  Confirm each organizational unit in that namespace has an owner email and ticketing workflow configured
3.  Open the **Plans** tab and confirm that plans show owner teams (rather than em dashes) on the cards you intend to route

### Step 5: Configure the Jira status mapping

1.  For each Jira project and issue type you route cases to, map case statuses to Jira statuses and resolutions, and Jira resolutions to lifecycle states
2.  Verify each mapping with one test round trip — see [Configure the status mapping](/features/vulnerability-management/cases-and-jira.md#configure-the-status-mapping) for why this step matters
3.  Confirm the analysts who will manage the lifecycle have graph-write permission — state transitions require it

### Step 6: Create your first tickets

1.  Open the **Plans** tab and sort by **Highest CVSS** or **Risk reduction**
2.  Open the highest-priority plan
3.  Review the AI-generated remediation summary and steps
4.  Confirm the affected assets and the owning teams
5.  Create tickets for the plan's cases — UVM has already partitioned the assets by owning team, one case per team

### Step 7: Adopt the lifecycle

1.  Have remediation owners select **Mark remediated** after applying a fix (or close the Jira ticket as Patched) so every fix goes through verification
2.  Record risk acceptances and false positives as [lifecycle states](/features/vulnerability-management/vulnerability-lifecycle.md) with justifications, instead of closing tickets around them
3.  Make the **Inbox** part of your team's weekly routine — verification confirmations, expiring exemptions, and ticket disagreements all wait there

### Step 8: Monitor progress

-   The **Active remediation cases** count on the summary header tracks open cases
-   The **Critical findings** card shows how many critical-severity vulnerabilities lack a plan
-   Open the Plans tab regularly to review case coverage and apply new plans as new vulnerabilities surface
-   Open the [Executive dashboard](/features/vulnerability-management/executive-dashboard.md) to baseline time to remediate, reopens by fix confidence, and accepted risk once your first snapshots accrue

## Best practices

### Start narrow, then widen

Begin with the default risk configuration and a small set of crown jewel assets. Work through the top-of-funnel plans for that subset before widening crown jewel coverage or lowering the prioritization threshold. This produces a manageable Prioritized list and gives your team a clear early win.

### Use plans, not individual findings

The Plans view is the right working list for most teams. A plan represents the smallest action that addresses the most risk, and one case routed to one team replaces dozens of duplicate tickets across owners. Investigate individual findings only when a plan is unclear or when you need to audit a specific scanner result.

### Tune the model, not the threshold

The fastest way to change which vulnerabilities surface as prioritized is to adjust the scoring model, not the threshold. Raising the exploitation likelihood weight in the threat layer favors in-the-wild exploitation; raising the crown jewel multiplier favors business-critical assets. The threshold should change only when you want to widen or tighten the size of the Prioritized view.

### Watch the Sankey diagram

The Sankey diagram at the top of every UVM page is your fastest signal that something is wrong upstream. Sudden drops in source contributions, missing scanners, or unusually wide gaps between Unified and Prioritized stages usually point to integration or configuration issues rather than vulnerability changes.

### Claim fixes so they verify

Prefer **Mark remediated** (or closing the ticket as Patched) over **Mark fixed**. Claimed fixes come back scanner-confirmed; closes without a standing claim are recorded as assumed, and any fixed vulnerability that genuinely disappeared and then returns reopens automatically. The **Reopens by fix confidence** panel on the executive dashboard will show you which habit your team has.

### Record exemptions in JupiterOne, not in tickets

When a vulnerability will not be remediated (accepted risk, non-exploitable, false positive), record it as a [lifecycle state](/features/vulnerability-management/vulnerability-lifecycle.md) with its justification rather than closing a ticket around it. Exemptions in JupiterOne carry an approver and an expiry date, survive rescans, and come back for review when they lapse — a note in a closed ticket does none of that.

### Work the Inbox, not the whole list

The Inbox holds everything that actually needs a human decision: fixes ready to confirm, claims that did not hold, exemptions coming due, and ticket disagreements. A short weekly pass through the Inbox keeps the lifecycle honest without anyone re-triaging the full vulnerability list.

## Related topics

-   [What's new in UVM 2.0](/features/vulnerability-management/uvm-2-0.md)
-   [The vulnerability lifecycle](/features/vulnerability-management/vulnerability-lifecycle.md)
-   [Risk scoring](/features/vulnerability-management/risk-scoring.md)
-   [Cases and Jira sync](/features/vulnerability-management/cases-and-jira.md)
-   [Executive dashboard](/features/vulnerability-management/executive-dashboard.md)
-   [Permissions](/features/vulnerability-management/permissions.md)
-   [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md)
-   [Smart classes](/features/assets/smart-classes.md)
-   [JupiterOne AI](/features/jupiterone-ai.md)

---

Source: /features/vulnerability-management/cases-and-jira

# Cases and Jira sync

A remediation **case** is a unit of work scoped to a single owning team. UVM generates cases automatically: each plan's affected assets are partitioned by their owning organizational unit, producing one case per unit — plus an Unassigned case for assets with no owning unit. What you create is the Jira ticket for a case. Each case carries:

-   The plan's AI-generated remediation summary and step-by-step instructions
-   The list of affected assets in that unit's scope
-   The risk reduction the team will deliver by completing the case

Tickets are created and updated through [Data Out](/integrations/data-out/overview.md), JupiterOne's outbound integration surface — not through the inbound Jira integration you may use to ingest projects. Each [organizational unit](/features/admin/organizational-units.md)'s routing configuration names its owner and its ticketing workflow, and that workflow instance determines the Jira project and issue type the team's tickets land in.

## Case status is derived, never set

A case reflects the lifecycle states of its constituent vulnerabilities — you never set a case status directly. Work the vulnerabilities, or work the ticket, and the case follows:

| Case status | When |
| --- | --- |
| **Open** | At least one constituent vulnerability is Open, or the constituents are in a mix of states |
| **Awaiting verification** | Every constituent vulnerability is Awaiting verification |
| **Resolved** | Every constituent vulnerability is closed |

When a case's vulnerabilities share an outcome, a closure reason is derived from it: a case whose vulnerabilities are all awaiting verification reads as Patched, and a resolved case derives Compensating control in place, Accepted risk, or False positive. Vulnerabilities resolved as Fixed or Non-exploitable, or a mix of resolutions, yield no closure reason — which matters for the outbound sync below.

## Jira sync, in both directions

**Outbound — case to ticket.** Case progress updates the linked Jira ticket. An open case keeps the ticket in progress, and a case that moves to awaiting verification adds a comment rather than transitioning the ticket, because the fix is not yet confirmed. A resolved case transitions the ticket to done with the matching resolution when it has a closure reason — Accepted risk, Compensating control in place, or False positive. A case resolved by fixes, or with mixed resolutions, instead posts a comment asking the assignee to close the ticket: an automatic close with no resolution would echo back through the inbound mapping and reopen the case. A case that reopens from resolved transitions the ticket back to in progress.

**Inbound — ticket to lifecycle states.** When a linked ticket closes in Jira, its resolution translates into a proposed transition for the case's constituent vulnerabilities:

| Jira resolution | Proposed lifecycle state |
| --- | --- |
| Fixed, Patched, or Done | **Awaiting verification** — the close is a claim, and the vulnerabilities close as Fixed when scanners confirm |
| Won't Do or Accepted Risk | **Accepted risk**, with a 90-day expiry |
| Not Exploitable | **Non-exploitable**, with a 180-day expiry |
| False Positive | **False positive** |
| Mitigated | No change — a mitigation requires a linked control, which a ticket cannot name. When the vulnerability already carries a stored decision, the conflict is flagged in the Inbox. |
| Any unmapped resolution | No change — the closure is ignored until you add the resolution to the status mapping |

Ticket closures never override a decision a person made in JupiterOne. A conflicting closure is refused and surfaces as a [Ticket disagreement](/features/vulnerability-management/vulnerability-lifecycle.md#the-inbox) in the Inbox, and reopening a ticket only withdraws a claim the ticket itself made — it never revokes a settled decision.

## Set up the sync

The sync is delivered by Data Out workflow instances, so setup spans a few surfaces. Work through them in this order:

1.  **Create a Jira connection.** From **Integrations** > **Data Out** > **Connections**, authorize your Jira workspace with an Atlassian site, account email, and API token. See [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md).
2.  **Create a workflow instance for each Jira project and issue type** your cases route to. The instance is what actually writes and updates tickets — creating a ticket for a case requires selecting an instance, so no instance means no ticket. See [Create an instance](/integrations/data-out/create-instance.md).
3.  **Confirm case routing.** Each [organizational unit](/features/admin/organizational-units.md) needs an owner and a ticketing workflow in its routing configuration — the selected workflow instance determines which Jira project and issue type the team's tickets land in.
4.  **Configure the status mapping** for each project and issue type (below).
5.  **Verify with a test round trip** before relying on the sync — see the warning below, and [Test an instance](/integrations/data-out/test-instance.md).

## Configure the status mapping

You configure the mapping between case statuses, Jira statuses, and Jira resolutions per Jira project and issue type, so the sync speaks each project's workflow. Both directions are covered by the same mapping: which Jira status and resolution each case status writes outbound, and which lifecycle state each Jira resolution proposes inbound.

> **WARNING**
> 
> JupiterOne cannot validate your Jira workflow at configuration time. If a mapped transition is not allowed in the target project's workflow, the update fails silently on the Jira side — the ticket stays put while the case in JupiterOne moves on. After configuring a mapping, verify it with one test round trip: create a case, resolve its vulnerabilities, confirm the ticket transitions with the expected resolution, then close a ticket in Jira and confirm the proposed state appears in JupiterOne.

## Troubleshoot sync failures

When a ticket did not appear, did not transition, or a closure did not reach JupiterOne:

-   **Check the instance's Jobs table first.** Every outbound delivery is recorded on the Data Out instance's detail page with status, timestamps, and per-job error messages. See [Troubleshooting Data Out](/integrations/data-out/troubleshooting.md).
-   **A resolved case whose ticket stayed open** is often by design: a case resolved by fixes posts a comment asking the assignee to close the ticket rather than transitioning it (see the outbound direction above).
-   **A ticket that will not transition** usually means the mapped Jira status is not reachable from the ticket's current status in that project's workflow — fix the mapping or the Jira workflow, then re-test.
-   **A closure that made no state change** may be an unmapped resolution (ignored until you add it to the status mapping for that project and issue type) or a conflict with a decision made in JupiterOne (surfaces as a Ticket disagreement in the [Inbox](/features/vulnerability-management/vulnerability-lifecycle.md#the-inbox) when the vulnerability carries a stored decision).

---

Source: /features/vulnerability-management/emerging-threats

# Emerging threats

EARLY ACCESS

Emerging threats answers a narrow question: of everything happening in the vulnerability landscape right now, what changed recently enough to deserve your attention today?

> **NOTE**
> 
> Emerging threats is rolling out progressively and is not yet enabled for every account. If you do not see it under Vulnerability Management, contact your JupiterOne account team.

It is a threat intelligence view, not an inventory view. Nothing on it is scoped to your environment — it reports on the CVE itself, drawing on public and commercial threat intelligence sources. Use it to decide whether a CVE is worth reacting to, then use [Unified Vulnerability Management](/features/vulnerability-management.md) to find out whether you are affected.

The view has two screens:

-   **The emerging threats list** — up to ten CVEs currently trending, ranked. The card is headed **Top 10 emerging threats**.
-   **The threat brief** — a full assessment of a single CVE. Open one from the list, or search for any CVE by identifier.

## The emerging threats list

The list shows threats that recently **got worse**. It is not the most severe CVEs, and it is not the newest ones.

### How trending is ranked

Ranking blends how recently a CVE crossed an escalation threshold with how dangerous it is, and lifts anything under confirmed active exploitation.

The escalation thresholds are:

| Escalation | What it means |
| --- | --- |
| **Public exploit** | Working proof-of-concept exploit code became publicly available |
| **Weaponized** | A reliable, packaged exploit exists — no longer just a proof of concept |
| **Exploited in the wild** | Exploitation against real targets has been confirmed |
| **Added to KEV** | The CVE was added to CISA's or VulnCheck's Known Exploited Vulnerabilities catalog |

Because the rank keys on _transitions_ rather than on state, the list behaves differently from a severity-sorted feed:

-   A CVE that has been exploited steadily for years drops off — nothing about it changed this week.
-   An old, unremarkable CVE that picks up its first ransomware campaign today surfaces to the top.

Recency is one input to the rank, not the sort order. You cannot re-sort the list, and rows are always shown in the engine's ranked order.

### What each row tells you

Every row carries its own labels, so nothing on the list depends on a legend:

-   The **CVE identifier** and, where a CPE record identifies one, the affected vendor and product.
-   The **escalations it has reached**, as chips. A chip you do not see means that escalation has not happened, or is not recorded.
-   **No scanner coverage**, when no commercial scanner ships a check for the CVE. See [Scanner coverage gaps](#scanner-coverage-gaps).
-   **Why it ranked** — the escalation that drove it onto the list, and how many days ago that happened. A CVE that ranked without a recent escalation says so.
-   Its **threat tier**.

## Threat tiers

Every ranked CVE and every brief carries one of four tiers. The tier is a stance on the whole CVE, and it is the same value in both places.

| Tier | Read it as |
| --- | --- |
| **Act now** | Confirmed, dangerous, and moving. Treat as time-sensitive. |
| **Elevated** | Escalating and worth planning around, but not an emergency today. |
| **Monitor** | Nothing yet demands action. Keep it in view. |
| **Low** | No meaningful exploitation signal. |

## The threat brief

A brief opens with the verdict: the tier, a headline judgement, and a short narrative translating the intelligence into a decision. When automatable exploitation is a factor — meaning the exploit lends itself to mass, unattended use — the brief calls that out as a separate note, because it amplifies impact without changing the tier.

Below the verdict sit four reference metrics:

| Metric | What it reports |
| --- | --- |
| **CVSS base score** | The published severity score and rating |
| **EPSS percentile** | How this CVE's exploitation probability ranks against every other scored CVE. This is the percentile, not the probability itself. |
| **Exploit maturity** | None known, proof of concept, commercial, or weaponized |
| **KEV** | Whether the CVE appears in CISA KEV or VulnCheck KEV |

A metric with no published value reads **Not scored**. The brief never substitutes a guess for a missing number.

### Brief sections

The rest of the brief is organized into eight sections.

**Remediation guidance** — how urgently to remediate, scored on CISA's four Stakeholder-Specific Vulnerability Categorization (SSVC) decision points. The resulting timeline is CISA's benchmark from Binding Operational Directive 26-04 (June 2026): binding for federal civilian agencies, and a useful yardstick for everyone else. Where the timeline depends on whether the affected asset is internet-facing, both branches are shown so you can pick the one that describes your deployment. When two intelligence sources disagree about a decision point, the disagreement is surfaced on the row it affects rather than resolved silently.

**Exploitation timeline** — how the threat matured, and how quickly defenders responded. The stages are disclosure, scanner checks shipping, public proof of concept, weaponized exploit, in-the-wild exploitation, and KEV listing. A filled dot happened; an outlined one has not. The stages are in a fixed order, so dates can legitimately read out of order — a CVE exploited in the wild before any scanner check shipped is common, not an error. A stage can also be marked as happened with an unknown date.

**What it is** — the published description, its CWE weakness classification, and a summary of the affected product and version footprint.

**Who is using it** — exploitation activity broken out by actor class: threat actors, ransomware, botnets, and public exploit repositories. Each class reports how much activity was observed, and — for threat actors, ransomware, and botnets — when it was first and most recently seen. Where named detail exists, you can open it in a side panel: specific actors with attribution country, ransomware families, botnets, and the exploit repositories themselves.

**Can the ecosystem see it** — per-scanner coverage: whether a check exists for this CVE and when it shipped. A patch and an EPSS score are useless if your scanner has no check.

**Fix and mitigation** — published patch and mitigation references.

**Detection and investigation** — whether detection tooling covers the CVE, and how it maps to detection frameworks and controls. If a public exploit needs no credentials and no user interaction, this section says so prominently.

**Sources and provenance** — when the brief was assessed, which sources were consulted, the underlying references, and source attribution.

Sections with no data available say so explicitly. An absent section is an absence of published intelligence, not an absence of risk.

## Scanner coverage gaps

A **no scanner coverage** flag means no commercial scanner ships a check for that CVE. This matters more than it first appears: if no check exists, the CVE will not appear in your scan results whether or not you are affected. A clean scan is not evidence of absence.

Two things to know about how the flag is derived:

-   It is computed from commercial scanners only. An open-source tool may well have a check for a CVE that is flagged as uncovered.
-   The absence of the flag is not a promise of coverage — it only means there is no known commercial blind spot.

## Data freshness

The two screens are refreshed differently, on purpose:

-   **The list** is a snapshot, refreshed periodically rather than live. The header carries an "as of" timestamp so you always know how current the ranking is.
-   **A brief** is assessed when you open it, because freshness is the whole point of an emerging threat. The assessment time appears in the brief's **Sources and provenance** section.

---

Source: /features/vulnerability-management/executive-dashboard

# Executive dashboard

The **Executive dashboard** reports remediation outcomes over time. It is built on daily snapshots of your environment, so leadership sees progress — not a live list of findings. Panels include:

-   **Open vulnerabilities over time** — the trend of your active exposure
-   **Current exposure by severity**
-   **Time to remediate by OU** — median days per organizational unit, reported as two separate measures (see below)
-   **Reopens by fix confidence** — confirmed-fix regressions and assumed-fix reopens, separately
-   **Accepted risk over time** and **Accepted risk by OU** — the exposure your business is explicitly carrying
-   **Open exposure by OU**

Charts support drill-downs, organizational unit and time window filters, and CSV download. The **Historical trends** and **Historical records** views are point-in-time records from the daily snapshots. Rows in Historical records open the live entity inspector where the snapshot captured the entity identifier, but the values in the row remain what was true on the snapshot date. Panels populate as snapshots accrue, so a newly enabled account fills in over its first days.

## Time to remediate is two numbers, on purpose

The dashboard never blends remediation speed into a single headline:

-   **Verified** — from first observation to a scanner-confirmed fix. This is the audit-grade remediation clock, and claiming a fix does not stop it — only verification does.
-   **Disposition** — from first observation to any closed state, including exemptions and false positives. This measures decision velocity.

Reported together, the two numbers keep an uncomfortable question answerable: are we fixing vulnerabilities, or closing them? The **Reopens by fix confidence** panel is the check on the same discipline — assumed fixes that keep coming back are visible as exactly that.

---

Source: /features/vulnerability-management/permissions

# Permissions

Access to Unified Vulnerability Management is governed by the [App Level Permissions](/features/admin/access-controls.md#app-level-permissions) layer of JupiterOne's [role-based access control](/features/admin/access-controls.md) system. Two permissions decide whether a user can open UVM at all, and a small set of additional permissions decides what that user can change once inside.

## Opening UVM requires two permissions

Reaching the vulnerability pages is not a single permission. A user needs **both** of the following.

**1\. Permission to open the app** — any one of:

| Permissions grid row | Level | Permission string |
| --- | --- | --- |
| **Vulnerabilities** | Read-only | `accessVulnerabilities` |
| **Vulnerabilities** | Admin | `adminVulnerabilities` |
| **Full Admin Access** | Read-only | `fullReadAccess` |
| **Full Admin Access** | Admin | `accessAdmin` |

**2\. Permission to read graph data** — any one of:

| Permissions grid row | Level | Permission string |
| --- | --- | --- |
| **Shared: Graph Data** | Read | `readGraph` |
| **Full Admin Access** | Read-only | `fullReadAccess` |
| **Full Admin Access** | Admin | `accessAdmin` |

The vulnerability screens are built almost entirely from graph queries. A user who holds **Vulnerabilities** access but no graph read permission reaches the pages and sees empty tables, because the permission controls the door and graph read controls the data behind it.

> **NOTE**
> 
> Your account also needs the Unified Vulnerability Management entitlement. If **Vulnerabilities** does not appear in the navigation for a user who holds the permissions above, confirm the entitlement with your JupiterOne representative.

## What each action requires

Every action below also requires app access and graph read, described above. The permissions listed here are what each action needs in addition.

| Action | Additional permissions required |
| --- | --- |
| View vulnerabilities, remediation plans, the executive dashboard, and emerging threats | None — app access and graph read are enough |
| Change a vulnerability's [lifecycle state](/features/vulnerability-management/vulnerability-lifecycle.md), individually or in bulk | **Full Admin Access: Admin**, or both **Vulnerabilities: Admin** and **Shared: Graph Data: Write** |
| Edit the [risk configuration](/features/vulnerability-management/risk-scoring.md) — scoring weights and plan priority thresholds | **Vulnerabilities: Admin** or **Full Admin Access: Admin** |
| Edit the [Jira status mapping](/features/vulnerability-management/cases-and-jira.md) | **Vulnerabilities: Admin** or **Full Admin Access: Admin** |
| Rebuild remediation plans on demand, or bulk-delete plans | **Vulnerabilities: Admin** or **Full Admin Access: Admin** |
| Manage crown jewel queries | **Vulnerabilities: Admin** or **Full Admin Access: Admin** |
| Create a Jira ticket from a remediation case | **Vulnerabilities: Admin** or **Full Admin Access: Admin** |
| Create a Jira ticket from a compliance control | **Full Admin Access: Admin** |

Two of these deserve elaboration:

-   **Lifecycle changes need both halves.** Changing a vulnerability's state writes to the graph, so a vulnerability admin without graph write sees the status controls disabled. Graph write on its own does not confer authority over vulnerability decisions either. Users who triage vulnerabilities need **Vulnerabilities: Admin** and **Shared: Graph Data: Write** together.
-   **Ticket creation is scoped to remediation cases.** A vulnerability admin can create the Jira ticket for a remediation case, and needs no **Shared: Graph Data: Write** to do it — unlike a lifecycle change, which records the vulnerability's new state in the graph. The permission reaches no further: ticketing a compliance control still requires **Full Admin Access: Admin**, and so does configuring Data Out itself — creating, editing, enabling, disabling, or deleting a ticketing workflow instance, and managing the Jira and ServiceNow connections behind it. A vulnerability admin can send a case's ticket but cannot change where it goes. **Vulnerabilities: Read-only** cannot create tickets at all; a read-only user sees the ticketing workflows configured for the account, but creating a ticket is a write.

Read access to configuration is deliberately broader than write access. Anyone who can open UVM can read the risk configuration and the Jira status mapping — the risk configuration opens as a read-only view with a banner, and the status mapping page hides its **Save** and **Restore defaults** controls rather than disabling them.

## Granting the permissions

The two vulnerability permissions appear as the **Vulnerabilities** row in the App Access section of the permissions grid, in the same read-only and admin pair as every other JupiterOne app. Only an account administrator can grant them.

1.  Navigate to **Settings > User groups**
2.  Select the group you want to edit
3.  In the App Level Permissions section, set the level on the **Vulnerabilities** row
4.  On the **Shared: Graph Data** row, set **Read** for users who view vulnerabilities, or **Write** for users who change vulnerability states
5.  Select **Save group**

Grant **Vulnerabilities: Read-only** to users who need to browse vulnerabilities, plans, and dashboards. Grant **Vulnerabilities: Admin** to users who also act on vulnerabilities, and pair it with **Shared: Graph Data: Write** so that lifecycle changes succeed.

> **NOTE**
> 
> Permissions are evaluated at login. A user whose group permissions change needs to sign out and sign back in before the change takes effect.

Granting the vulnerability permissions takes nothing away from existing administrators. Anyone with **Full Admin Access: Admin** retains every UVM action.

## Troubleshooting

| Symptom | Cause | Resolution |
| --- | --- | --- |
| **Vulnerabilities** appears in the navigation, but every table is empty | The user holds a vulnerability permission but no graph read permission | Add **Shared: Graph Data: Read** (or **Full Admin Access: Read-only**) to the group |
| **Vulnerabilities** does not appear in the navigation at all | The account lacks the UVM entitlement, or the user holds none of the four permissions that open the app | Confirm the entitlement, then add **Vulnerabilities: Read-only** along with a graph read permission |
| The lifecycle status controls are disabled when vulnerabilities are selected | The user holds **Vulnerabilities: Admin** but not **Shared: Graph Data: Write** | Add **Shared: Graph Data: Write**. Hovering the disabled control shows a tooltip naming what is missing |
| The Jira status mapping page has no **Save** button | Working as designed — the controls are hidden, not disabled, without **Vulnerabilities: Admin** or **Full Admin Access: Admin** | Add **Vulnerabilities: Admin** |
| The risk configuration opens, but every field is locked | Working as designed — it is a read-only view for anyone without **Vulnerabilities: Admin** | Add **Vulnerabilities: Admin** |
| A group permission changed, but the user sees no difference | The user has not signed out since the change, or only one of the two required halves was granted | Confirm both the **Vulnerabilities** and **Shared: Graph Data** levels, then have the user sign out and sign back in |
| A user can change vulnerability states but cannot create a ticket for a case | The user holds **Vulnerabilities: Read-only** rather than **Vulnerabilities: Admin**, or has not signed out since the level changed | Set the **Vulnerabilities** row to Admin, then have the user sign out and sign back in |
| A vulnerability admin can ticket a remediation case but not a compliance control | Expected — ticketing a compliance control requires **Full Admin Access: Admin** | No group-level change grants control ticketing to a vulnerability admin today |
| Ticket creation is refused for one particular case | The case covers an entity the user cannot see in the graph under their query policy | Widen the group's [Data Layer RBAC](/features/admin/access-controls.md#data-layer-rbac) query policy, or have a user with broader data access create the ticket |

## Related topics

-   [Role-Based Access Control (RBAC)](/features/admin/access-controls.md)
-   [IAM operations](/api/iam-operations.md) — the permission strings above are set through the `abacPermissions` field
-   [Unified Vulnerability Management](/features/vulnerability-management.md)
-   [The vulnerability lifecycle](/features/vulnerability-management/vulnerability-lifecycle.md)
-   [Risk scoring](/features/vulnerability-management/risk-scoring.md)
-   [Cases and Jira sync](/features/vulnerability-management/cases-and-jira.md)

---

Source: /features/vulnerability-management/risk-scoring

# Risk scoring

Risk scoring is fully configurable from the **Risk configuration** panel, which you open by selecting the edit (pencil) icon on the **Overall risk score** card.

## The risk score model

UVM scores every unified vulnerability with a layered model:

```text
Risk = Threat × Context × Controls
```

Each layer answers one question, in order: how dangerous is this vulnerability, how much does it matter on this asset, and is anything already containing it? The model is layered, bounded, and zero-preserving — context can amplify a real threat but never creates risk where there is none, and control evidence can only reduce a score that exists. The configuration panel walks a worked example through each enabled layer as you adjust settings, so you can see the effect of every change on a real score.

Every signal that feeds the score enters at exactly one layer:

| Signal | Where it enters | Effect |
| --- | --- | --- |
| **CVSS** | Threat | Technical impact, blended with EPSS |
| **EPSS** | Threat | Exploitation likelihood, blended with CVSS |
| **KEV** | Threat | A floor applied after the blend |
| **Crown jewel** | Context | Multiplier on the threat score |
| **Public exposure** | Context | Multiplier on the threat score |
| **Control evidence** | Controls | Discount on the final score (off by default) |

## Layer 1: Threat

The threat layer is a weighted blend of **Technical impact** (from CVSS) and **Exploitation likelihood** (from EPSS), each normalized to a 0–1 value first:

```text
Threat = (CVSS weight × Technical impact) + (EPSS weight × Exploitation likelihood)
```

-   **Technical impact** is the CVE's CVSS impact subscore normalized to 0–1 (divided by its 6.05 maximum). When a CVE reports no impact subscore, the CVSS base score divided by 10 is used instead.
-   **Exploitation likelihood** is the CVE's EPSS probability, which is already a 0–1 value.
-   The two weights default to **0.50 each** and always sum to 1. A factor that is unavailable for a CVE contributes zero — the KEV floor below is the backstop that keeps actively exploited CVEs with missing or low EPSS data from scoring under your threshold.

A CVE listed in CISA's Known Exploited Vulnerabilities catalog is floored at a high threat value (0.90 by default on the 0–1 threat scale, configurable) regardless of its EPSS score. Many actively exploited CVEs carry low EPSS probabilities, and the KEV floor keeps confirmed exploitation from being scored below your threshold.

## Layer 2: Context

The context layer applies bounded multipliers for what the vulnerability sits on:

| Signal | Default multiplier |
| --- | --- |
| **Crown jewel asset** | ×1.5 |
| **Publicly exposed asset** | ×1.2 |

The combined context multiplier is capped at ×1.5, and an asset with neither signal is scored exactly neutrally (×1.0). Unlike a weighted average, context can never dilute severity — an untagged asset costs a vulnerability nothing.

## Layer 3: Controls

The controls layer can apply a small discount (10 percent by default) while a vulnerability is mitigated by currently passing, technique-relevant control evidence — a [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md) control test on the affected asset whose MITRE ATT&CK technique matches the vulnerability. Missing evidence never lowers a score, and the moment no relevant control passes, the full score returns on the next evaluation.

This layer is off by default. Enable it once your CCM controls carry MITRE ATT&CK technique mappings.

## A worked example

Consider a CVE with a CVSS base score of 9.8, no impact subscore reported, and an EPSS probability of 0.10, found on a crown jewel asset that is not publicly exposed, with default settings throughout:

1.  **Threat** — technical impact is 9.8 ÷ 10 = 0.98, and exploitation likelihood is 0.10. The blend is (0.50 × 0.98) + (0.50 × 0.10) = **0.54**. The CVE is not in the KEV catalog, so no floor applies.
2.  **Context** — the crown jewel multiplier applies: 0.54 × 1.5 = **0.81**.
3.  **Controls** — the layer is off, so the score stands at **0.81**.

At 0.81 the vulnerability falls below the default 0.90 threshold and is not prioritized — a severe-but-unlikely-to-be-exploited CVE on an important asset. Now suppose CISA adds the CVE to the KEV catalog: the threat blend is floored at 0.90 before context applies, so the score becomes min(0.90 × 1.5, 1) = **1.0**, and the vulnerability is prioritized. That is the model working as intended — confirmed exploitation outranks a low EPSS estimate.

## Prioritization threshold

The **Prioritization threshold** sets the minimum score a vulnerability must reach to appear in the Prioritized view. The default is 90% (a score of 0.90). Score displays vary by surface: the Prioritized table shows scores on a 0–10 scale, and the entity inspector shows the same score on a 0–100 scale. Lower the threshold to widen the working list; raise it to focus on only the highest-risk vulnerabilities.

## Plan priority thresholds

UVM assigns each remediation plan a priority of **Critical**, **High**, **Medium**, or **Low** based on how much risk reduction the plan delivers. The thresholds are expressed in standard deviations from the mean risk reduction across all plans, so they adapt to the shape of your environment.

| Priority | Default threshold | Approximate share |
| --- | --- | --- |
| **Critical** | +1.5 standard deviations | Top ~7% of plans |
| **High** | +0.5 standard deviations | Top ~31% of plans |
| **Medium** | \-0.5 standard deviations | Middle ~31% of plans |
| **Low** | Below medium threshold | Remaining plans |

You can adjust each threshold independently. UVM enforces the ordering rule that the Critical threshold must be greater than or equal to High, which must be greater than or equal to Medium.

## Case routing namespace

The **Cases — Ownership assignment** setting controls which Hierarchical Resource Group namespace is used to determine asset ownership. When UVM creates a case for a remediation plan, it looks up the owning organizational unit in the selected namespace and routes the case to the team responsible for that unit. The panel shows the count of organizational units available in each namespace.

> **TIP**
> 
> Click **Reset to defaults** at the bottom of the panel to return the scoring model and thresholds to JupiterOne's recommended starting configuration. The ownership namespace keeps its saved value.

## Crown jewels and public assets

Two graph-derived signals — crown jewel status and public exposure — feed directly into the risk score and appear in the **Context** column of the Prioritized view.

### Crown jewel assets

An asset is treated as a crown jewel when it carries the `tag.crownJewel` property. You can apply this tag in two ways:

-   **Vendor tags** — Cloud and infrastructure tags imported through your integrations are evaluated automatically
-   **Smart classes** — Author a J1QL Smart Class query that selects critical assets in your environment. Matching assets receive `tag.crownJewel = true`.

> **NOTE**
> 
> Risk scoring reads crown jewel status from the unified device. Tags applied at the source asset propagate to unified devices on the unification cycle, which can take up to 7 days. For the fastest effect, author your Smart Class query against unified devices directly.

See [Smart classes](/features/assets/smart-classes.md) for details on authoring Smart Class queries.

### Public assets

An asset is treated as publicly exposed when JupiterOne resolves its **public** property to `Public`. UVM merges signals from multiple sources to compute this property, including cloud provider configuration, network scanners, and external attack surface tools.

When sources disagree about an asset's exposure, the property resolves to `Conflicting`, which is a diagnostic state. Investigate conflicting assets to confirm their true exposure and update integrations as needed.

---

Source: /features/vulnerability-management/uvm-1-0

# UVM 1.0 Release Notes

**Release date: May 2026**

UVM 1.0 introduces JupiterOne's Unified Vulnerability Management product. You can now take raw findings from every scanner you run, deduplicate and prioritize them on the graph, and route remediation cases to the teams that own the affected assets.

## What is new

| Feature | What it means for you |
| --- | --- |
| **The prioritization funnel** | A four-stage workflow — Vulnerabilities → Unified → Prioritized → Plans — visible as a live Sankey diagram on every UVM page |
| **Vulnerability unification** | One row per CVE per asset, deduplicated across every configured scanner, with full source attribution |
| **EPSS and KEV enrichment** | Exploitation probability from FIRST.org and CISA's Known Exploited Vulnerabilities catalog on every CVE |
| **Configurable risk scoring** | A transparent composite score combining CVSS, EPSS, crown jewel status, and public exposure — weights you own |
| **CPE-based remediation plans** | Prioritized vulnerabilities grouped by common fix, so teams act on a short list of plans instead of thousands of CVEs |
| **AI-generated plan content** | Every plan ships with an AI-written remediation summary and step-by-step fix instructions |
| **Ownership-based case routing** | Cases route to owning teams in Jira through Hierarchical Resource Groups |
| **AI Assistant** | Sort, filter, and navigate UVM views in natural language |

## Supported scanner integrations

UVM 1.0 ships with first-class support for CrowdStrike Falcon, Qualys VMDR, SentinelOne, Tenable.io, and Wiz. SBOM-sourced findings are also recognized.

## Getting started

1.  Confirm at least one supported scanner integration is configured and syncing
2.  Tag your business-critical assets with `tag.crownJewel`
3.  Open **Vulnerabilities** in the navigation and review the default risk configuration
4.  Open the **Plans** tab and create cases for the top remediation plans
5.  Confirm cases arrive in the correct Jira projects

For full feature documentation, see [Unified Vulnerability Management](/features/vulnerability-management.md).

---

Source: /features/vulnerability-management/uvm-2-0

# UVM 2.0 Release Notes

**Release date: August 2026**

UVM 1.0 turned raw scanner findings into a prioritized, team-routed list of remediation plans. UVM 2.0 makes JupiterOne the system of record for what happens next. Every vulnerability on every asset now carries a lifecycle state — open, remediated, exempted, mitigated, or closed — tracked in one place across all of your scanners, verified against scanner evidence, and synchronized with Jira in both directions. You no longer log into five consoles to answer "what is the status of this vulnerability?", and your decisions are never silently overwritten by a rescan.

## What is new

| Feature | What it means for you |
| --- | --- |
| **Vulnerability lifecycle tracking** | Eight lifecycle states per vulnerability per asset — one source of truth for vulnerability status across every scanner you run |
| **Verified fixes** | **Mark remediated** claims a fix; JupiterOne verifies the claim against scanner evidence and distinguishes claimed-and-confirmed fixes from assumed ones |
| **Exemption management** | Accept risk or mark a vulnerability non-exploitable with a justification and an expiry date. Exemptions expire to a review queue — never silently, and never straight back to open. |
| **Control-backed mitigations** | Link a mitigation to a passing Continuous Control Monitoring control. If the control later fails or is deleted, the vulnerability reopens automatically. |
| **The Inbox** | A single decision queue for everything that needs a human: vulnerabilities your scanners no longer observe, claimed fixes still being detected, expiring exemptions, and ticket disagreements — with bulk actions |
| **Bidirectional Jira sync** | Closing a Jira ticket proposes the matching lifecycle state in JupiterOne, and case progress writes back to Jira — with a configurable status mapping per project and issue type |
| **Executive dashboard** | Historical reporting on remediation outcomes: open vulnerabilities over time, time to remediate by team, reopens by fix confidence, and accepted risk over time |
| **Layered risk scoring** | A new Threat × Context × Controls model with a KEV floor replaces the additive weighted blend from UVM 1.0 |

## The vulnerability lifecycle

The centerpiece of UVM 2.0 is the lifecycle state machine. JupiterOne tracks two things independently for every vulnerability on every asset: what your scanners currently observe, and what your team has decided. Scanner evidence never silently overwrites a human decision — a rescan reopens a fixed vulnerability, but it never reopens a false positive, an accepted risk, or a mitigation.

For the full model — the eight states, verification, exemptions, and what happens when a scanner detects a closed vulnerability again — see [The vulnerability lifecycle](/features/vulnerability-management/vulnerability-lifecycle.md).

## The Inbox

The **Inbox** is the analyst work queue for UVM 2.0. Nothing in the lifecycle changes silently: scanner signals arrive here as proposals for a human to confirm, in bulk. Sections include vulnerabilities **no longer observed** by any scanner (bulk mark fixed), **claimed but still observed** fixes (bulk reopen), **expiring exemptions**, and **ticket disagreements** where a Jira closure conflicted with a decision made in JupiterOne.

## Bidirectional Jira sync

Remediation owners live in Jira, so the ticket is now a first-class way to drive the lifecycle. When a linked ticket closes, its Jira resolution translates into the matching vulnerability state — a ticket resolved as Patched enters verification rather than closing outright, and a ticket resolved as Won't Do proposes an accepted-risk exemption with an expiry date. In the other direction, case progress updates the Jira ticket's status and resolution. You configure the mapping per Jira project and issue type.

## Executive dashboard

UVM 2.0 adds daily snapshots and a dedicated executive dashboard, so leadership sees remediation progress rather than raw findings: open vulnerabilities over time, current exposure by severity, time to remediate by organizational unit (verified fixes and dispositions reported separately), reopens by fix confidence, and accepted risk over time. Historical views are point-in-time records and support CSV download.

## Layered risk scoring

UVM 2.0 replaces the additive weighted risk score from UVM 1.0 with a layered model:

```text
Risk = Threat × Context × Controls
```

-   **Threat** blends technical impact (CVSS) with exploitation likelihood (EPSS). A CVE listed in CISA's Known Exploited Vulnerabilities catalog is floored at a high threat score regardless of EPSS.
-   **Context** applies bounded multipliers for crown jewel assets and public exposure. Context can amplify a real threat but never creates risk where there is none, and untagged assets are scored neutrally.
-   **Controls** can apply a small discount when a vulnerability is mitigated by currently passing, technique-relevant control evidence. Missing evidence never lowers a score. This layer is off by default.

If you tuned score weights in UVM 1.0, review the new configuration — the old sum-to-one weight sliders no longer exist. See [Configure risk scoring](/features/vulnerability-management/risk-scoring.md).

## Upgrading from UVM 1.0

UVM 2.0 is enabled per account on a coordinated schedule. Two things to know:

> **WARNING**
> 
> As part of enablement, existing remediation plans and cases are regenerated on the new lifecycle model. Plan and case history from UVM 1.0 does not carry over — export anything you need before your scheduled enablement, and expect plan and case identifiers to change. Your JupiterOne account team coordinates the timing with you.

-   Vulnerability findings, unified vulnerabilities, and risk configuration are unaffected.
-   Lifecycle states start fresh: every observed vulnerability begins as **Open** until your team or your tickets act on it.

## Supported scanner integrations

Scanner support is unchanged from UVM 1.0: CrowdStrike Falcon, Qualys VMDR, SentinelOne, Tenable.io, and Wiz, plus SBOM-sourced findings. UVM tracks vulnerabilities on unified devices — servers, laptops, and cloud instances. Application-level weaknesses without a CVE and ephemeral container workloads are not yet in scope.

## Getting started with 2.0

1.  Confirm your scanner integrations are syncing and your [risk configuration](/features/vulnerability-management/risk-scoring.md) reflects the new layered model
2.  Confirm your analysts have graph-write permission — vulnerability state transitions require it
3.  Configure the Jira status mapping for each project and issue type you route cases to, and verify a test ticket round-trips
4.  Make the **Inbox** part of your team's weekly routine — it is where verification, expiring exemptions, and ticket disagreements wait for a decision
5.  Open the **Executive dashboard** after your first week of snapshots to baseline time to remediate and accepted risk

For full feature documentation, see [Unified Vulnerability Management](/features/vulnerability-management.md).

---

Source: /features/vulnerability-management/vulnerability-lifecycle

# The vulnerability lifecycle

Every unified vulnerability carries a lifecycle state on each affected asset. The state answers "where does this stand?" — untouched, claimed as fixed, exempted, mitigated, or closed — and it lives in JupiterOne rather than in any single scanner console. You no longer reconcile status across five tools, and you no longer lose a risk acceptance because a scanner ran again.

Two ideas explain almost everything about how the lifecycle behaves. Read the next two sections once and the rest of the model follows.

## Evidence and decisions are tracked separately

For every vulnerability on every asset, JupiterOne records two independent things:

-   **What scanners observe** — is at least one configured scanner currently reporting this vulnerability on this asset? This is evidence. It updates automatically as your integrations run, and nobody can edit it.
-   **What your team has decided** — the lifecycle state. This is a decision. It changes only through an explicit action by a person, a translated Jira ticket closure, or one of a small set of automatic rules described below.

Keeping the two apart is what makes the lifecycle trustworthy in both directions. A scanner that keeps reporting a vulnerability you marked as a false positive does not overturn your decision — the evidence is still recorded and visible, but the decision stands. Equally, a decision never erases evidence: the raw findings remain in the **Source** tab, exactly as reported.

When a state change surprises you, ask which of the two records moved. Almost every "why did this happen?" question about the lifecycle is answered by that distinction.

> **INFO**
> 
> The lifecycle state belongs to a (vulnerability, asset) pair, not to the CVE. The same CVE can be Fixed on one host, an accepted risk on a second, and still Open on a third — the state of one never bleeds into another. Bulk actions exist so that deciding per asset does not mean clicking per asset.

## The eight lifecycle states

The vocabulary is small, and it has a shape: one working state, one verification gate, one attention state, and five closed states that each answer "why is this closed?" differently.

| Role | State | Meaning |
| --- | --- | --- |
| Working | **Open** | A scanner reports it and no decision has been made yet. Every vulnerability starts here — and returns here if a decision is revoked or contradicted by evidence. |
| Verification gate | **Awaiting verification** | Someone claimed a fix, and JupiterOne is waiting for scanners to confirm it. Confirmed fixed when the scanner stops seeing it. Not closed yet. |
| Attention | **Review required** | An exemption expired. A person must re-affirm it, revoke it, or close the vulnerability another way. Never counted as closed. |
| Closed | **Fixed** | The vulnerability is gone from the asset. |
| Closed | **Mitigated** | The vulnerability is still present, but a compensating control contains it. |
| Closed | **Accepted risk** | The vulnerability is real, and the business accepts it for a defined period. |
| Closed | **Non-exploitable** | The vulnerability is present but cannot be exploited in this environment, for a defined period. |
| Closed | **False positive** | The scanner was wrong. |

Who moves it:

Scanner reports itMark remediatedRe-openConfirm fixed (Inbox)Mark fixedDetected again — reopensMark mitigatedControl failsMark false positiveAccept riskMark non-exploitableExpiresExpiresRe-affirmRe-openOpenAwaiting verificationFixedMitigatedFalse positiveAccepted riskNon-exploitableReview required

Action someone takes Happens automatically

Select any state to see what it asserts, its ways in and out, and what happens when a scanner detects it again.

Solid transitions are actions someone takes — you in JupiterOne, or a translated ticket closure. Dashed transitions happen automatically, and each one stays visible: automatic reopens are recorded as system actions on the vulnerability's lifecycle timeline, and expired exemptions wait in Review required rather than changing silently.

## Claim a fix, then let the scanner verify it

JupiterOne does not take anyone's word that a vulnerability is gone — including yours. Remediation is a claim, and scanner evidence is the verification:

1.  Apply the fix, then select **Mark remediated**. The state moves to Awaiting verification. This is a claim, not a close.
2.  Your scanners keep running on their normal schedule. As long as any scanner still reports the vulnerability, it stays in Awaiting verification.
3.  When every scanner has stopped reporting it for 14 days and the asset itself is still reporting in, the vulnerability appears in the Inbox under **No longer observed**. Confirming it there closes the vulnerability as Fixed with fix confidence **confirmed** — a claim that evidence validated.
4.  If scanners still report the vulnerability 14 days after the claim, it appears in the Inbox under **Claimed, still observed**, so you can reopen it or investigate the failed fix instead of believing a fix that did not work.

You can also select **Mark fixed** to close a vulnerability immediately. JupiterOne records fix confidence with every close: **confirmed** when a claim was standing (the vulnerability was Awaiting verification when it closed), **assumed** when nobody had claimed a fix. Either way, a fixed vulnerability that resurfaces after it had genuinely disappeared reopens automatically. The [executive dashboard](/features/vulnerability-management/executive-dashboard.md) reports reopens split by fix confidence, so verified remediation and optimistic closing never blur together.

> **TIP**
> 
> **Mark remediated** and **Awaiting verification** are about the fix, not the work. Claim a fix after you apply it — not when you pick up the task. Work-in-progress tracking belongs in the linked Jira ticket; JupiterOne reflects the ticket on the case.

## When a scanner detects a closed vulnerability again

Each closed state is a different kind of claim, and each answers to the referee that can actually test it:

-   **Fixed** claims the vulnerability is gone. A scanner can prove that wrong, so Fixed — and only Fixed — reopens on re-detection.
-   **Mitigated** claims a control contains it. Scanners are expected to keep seeing a mitigated vulnerability (the control limits exploitability; it does not remove the finding), so re-detection means nothing here. The health of the linked control is the referee instead.
-   **Accepted risk**, **Non-exploitable**, and **False positive** are human judgments. No scan result can prove a judgment wrong, so scanners never touch these states. Time and people are the referees: exemptions expire into review.

| Closed as | Scanner detects it again | Linked control fails | Exemption expires |
| --- | --- | --- | --- |
| **Fixed** | Reopens automatically | — | — |
| **Mitigated** | Stays mitigated (expected) | Reopens automatically | — |
| **Accepted risk** | Stays accepted | — | Moves to Review required |
| **Non-exploitable** | Stays non-exploitable | — | Moves to Review required |
| **False positive** | Stays false positive | — | — |

The automatic reopen is deliberately narrow: it fires only for Fixed, and only when the vulnerability had genuinely disappeared (quiet for at least 14 days) and then came back — a regression, not scanner noise. Reopens are evaluated several times a day and record a system-attributed entry, with a justification, on the vulnerability's lifecycle timeline.

## Exemptions expire to review, never to silence

Two states are exemptions, and both carry an expiry date:

-   **Accepted risk** — requires a justification; JupiterOne records the acting user as the approver. Default expiry: 90 days.
-   **Non-exploitable** — requires a justification. Default expiry: 90 days, with 180 days as a one-click preset. Non-exploitable closures arriving from a Jira ticket default to 180 days.

When an exemption expires, the vulnerability moves to **Review required**. It does not silently reopen, and it does not quietly stay closed — it waits, visibly, for a person. The lapsed exemption is preserved so the reviewer can see exactly what was approved, by whom, and why. From Review required you can:

-   **Re-affirm** — renew the same exemption with a fresh expiry date, defaulting to the original exemption's duration
-   **Re-open** — return the vulnerability to Open
-   Close it another way — Fixed, a different exemption, or False positive

Exemptions approaching expiry appear in the Inbox under **Expiring soon** before they lapse.

## Mitigations follow their control

**Mark mitigated** requires linking a [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md) control that is currently passing — you cannot mitigate against a control that is already failing. From then on, the vulnerability answers to that control:

-   If the control starts failing, is retired, or is deleted, the vulnerability reopens automatically, and the lifecycle timeline shows which control lapsed.
-   If the control recovers, the vulnerability does not re-mitigate automatically — a person re-asserts the mitigation.
-   **Switch control** relinks an existing mitigation to a different passing control without reopening it.

Because a mitigated vulnerability is still present by definition, scanner re-detection has no effect on it.

## Who changes state, and who wins

Three actors can change a lifecycle state, in strict order of authority — person, then ticket, then automation:

-   **People in JupiterOne** hold the highest authority. State transitions require graph-write permission and are recorded with the acting user. No ticket or automatic rule ever overrides a decision a person made in JupiterOne.
-   **Linked Jira tickets** propose transitions through the [resolution mapping](/features/vulnerability-management/cases-and-jira.md). A ticket closure that conflicts with a person's decision is refused and surfaces in the Inbox as a **Ticket disagreement**, where you choose **Adopt ticket** or **Keep J1**.
-   **Automation** — exemption expiry, control regression, and the re-detection reopen — acts only in the narrow cases described above and never overrides a person.

Every transition, from any actor, is recorded on the vulnerability's lifecycle timeline: who, when, from and to which state, and the justification. Bulk actions record one entry per vulnerability under a shared batch, so audits reconstruct exactly what happened. There is no undo for bulk actions — each one shows a confirmation with the exact count — and, for Mark fixed, the per-row confidence — before it applies, and every applied change can be reversed through a normal transition.

## Common questions

**I marked a vulnerability as a false positive, and the scanner still reports it. Why does JupiterOne still show my decision?** Because that is the design. Judgments answer to people, not scanners. The finding remains visible in the **Source** tab, and the observation is recorded on the pair, but your decision stands until a person changes it. If the scanner keeps reporting it, fix the detection at the scanner — JupiterOne will not churn your triage.

**Why did a Fixed vulnerability reopen on its own?** A scanner observed it again after it had been gone for at least 14 days. Fixed is the only state that reopens on re-detection, the reopen is recorded as a system action with a justification on the lifecycle timeline. If it reopens repeatedly, the fix is not holding — check the reopen history on the lifecycle timeline.

**My Jira ticket is Done, but the vulnerability shows Awaiting verification. Is the sync broken?** No — this is verification working. Ticket closures resolved as Patched or Done are treated as claims, exactly like **Mark remediated**, and once scanners stop seeing the vulnerability, the Inbox proposes the confirmed close. A closed ticket whose vulnerability keeps being detected appears under **Claimed, still observed** in the Inbox.

**Why can I not accept risk on a vulnerability that is Awaiting verification?** A pair either awaits fix verification or carries an exemption — never both. Select **Re-open** to withdraw the claim first, then raise the exemption from Open.

**A vulnerability disappeared from my scanners, but its state never changed. Why?** JupiterOne proposes; you decide. Vulnerabilities your team has acted on move to the Inbox under **No longer observed** for a bulk **Mark fixed** — they are not closed behind your back. Vulnerabilities nobody ever acted on simply leave the views when their findings disappear, because there was no decision to preserve.

**Two scanners report the same CVE on one asset. One of them stopped seeing it. Will the vulnerability verify as fixed?** No. Evidence is the union of all sources — a vulnerability counts as observed while any scanner still reports it. One source going quiet (or being removed) never closes anything on its own.

## Query lifecycle states with J1QL

Lifecycle states are graph entities, so everything above is queryable. For example, to list every accepted risk:

```text
FIND VulnerabilityState WITH resolution = 'RISK_ACCEPTED'
```

Internal values are uppercase (`OPEN`, `IN_PROGRESS`, `RESOLVED`, `REVIEW_REQUIRED` for `status`; `FIXED`, `MITIGATED`, `RISK_ACCEPTED`, `NOT_EXPLOITABLE`, `FALSE_POSITIVE` for `resolution`), while the UI shows the display labels described above — `IN_PROGRESS` displays as Awaiting verification. A vulnerability nobody has acted on has no state entity yet and is treated as Open.

## The Inbox

The **Inbox** is the decision queue for the vulnerability lifecycle. Scanner signals, expiring exemptions, and ticket conflicts all land here as proposals for a person to confirm — in bulk, with full context — rather than as silent state changes.

| Section | What lands here | The action |
| --- | --- | --- |
| **Needs decision today** | Exemptions at or past their expiry date | **Re-affirm** per row, or open the vulnerability to re-open it or close it another way |
| **Expiring soon** | Exemptions approaching expiry | Re-affirm early, or let them come due |
| **Ticket disagreements** | Jira closures that conflicted with a decision made in JupiterOne | **Adopt ticket** or **Keep J1** |
| **No longer observed** | Vulnerabilities your team has acted on that no scanner has reported for 14 days, on assets that are still reporting in | Bulk **Mark fixed** — each row shows whether the close will be confirmed or assumed |
| **Claimed, still observed** | Fixes claimed more than 14 days ago that scanners still detect | Bulk **Reopen**, or investigate the failed fix |
| **Asset not reporting** | Quiet vulnerabilities — open or claimed — whose asset has not been inventoried by any source for 7 days | Informational — verification cannot proceed until the asset reports again |

Bulk actions are atomic per batch and capped at 100 vulnerabilities per action, and every row records its own lifecycle timeline entry. The bulk **Mark fixed** button shows the confidence split before you commit — for example, "Mark fixed (4) — 1 confirmed · 3 assumed".

---

Source: /integrations

# Integrations Overview

With over 180 integrations, JupiterOne partners and integrates with industry leading technologies to bring you end-to-end cyber asset visibility, context, and automation across every dimension of your digital universe.

## Getting started with integrations

Start by connecting JupiterOne with other tools to populate relevant data within your JupiterOne workspace.

[

![](/icons/illustrations/cloud-upload.svg)![](/icons/illustrations/cloud-upload.svg)

Add an integration

Start visualizing your data by setting up your first integration with JupiterOne.





](/integrations/add-an-integration.md)[

![](/icons/illustrations/gear.svg)![](/icons/illustrations/gear.svg)

Integration settings

Explore universal integration settings for configuration within JupiterOne.





](/integrations/settings.md)[

![](/icons/illustrations/strategy.svg)![](/icons/illustrations/strategy.svg)

Instance Management

Learn how to manage existing integration instances in your JupiterOne workspace.





](/integrations/instance-management.md)[

![](/icons/illustrations/tree.svg)![](/icons/illustrations/tree.svg)

On-premise Collector

Understanding and deploying the Collector for behind-the-firewall integrations.





](/integrations/development/collector.md)[

![](/icons/illustrations/cloud-upload.svg)![](/icons/illustrations/cloud-upload.svg)

Data Out

Send JupiterOne findings, alerts, and failing CCM control tests to Jira and other external systems.





](/integrations/data-out/overview.md)

## Featured integrations

Explore our leading integrations and learn how to configure them within your workspace.

[

![](/icons/integration-svgs/aws3.svg)![](/icons/integration-svgs/aws3.svg)

AWS

Learn to configure the AWS integration and review its data model.





](/integrations/directory/aws.md)[

![](/icons/integration-svgs/azure.svg)![](/icons/integration-svgs/azure.svg)

Azure

Set up Azure within JupiterOne and view the Azure data model.





](/integrations/directory/azure.md)[

![](/icons/integration-svgs/github3.svg)![](/icons/integration-svgs/github3.svg)

GitHub

Integrate GitHub with JupiterOne and view the GitHub data model.





](/integrations/directory/github.md)[

![](/icons/integration-svgs/gsuite.svg)![](/icons/integration-svgs/gsuite.svg)

Google Workspace

Connect Google Workspace to JupiterOne and easily query your Google Workspace data.





](/integrations/directory/google.md)[

![](/icons/integration-svgs/microsoft-365.svg)![](/icons/integration-svgs/microsoft-365.svg)

Microsoft 365

Integrate Microsoft 365 and JupiterOne and view the Microsoft 365 data model.





](/integrations/directory/microsoft-365.md)[

![](/icons/integration-svgs/slack.svg)![](/icons/integration-svgs/slack.svg)

Slack

Add JupiterOne to your Slack workspace, and review the Slack data model.





](/integrations/directory/slack.md)

---

Source: /integrations/add-an-integration

# Add an integration

JupiterOne loves data, and the more data you provide, the more powerful JupiterOne's capabilities become. One of the main ways for JupiterOne to ingest data is by enabling integrations with your organizations tooling and infrastructure.

## Getting started

Configuring your integrations within JupiterOne will allow you regularly pull in relevant data points from the enabled integrations—allowing you to monitor, query, and review the data ingested by JupiterOne.

Integrations support the ability to have several instances of an integration configured simultaneously. This allows for segmenting data that is ingested from an integration between instance Ids.

> **INFO**
> 
> Aside from ingesting data from integrations, JupiterOne also support the ability to upload data directly (like via CSV or API). See our [nifty guide for importing your data into JupiterOne](https://community.askj1.com/kb/articles/1164-importing-your-data-into-jupiterone).

## Adding an integration instance

Once you're ready to begin integrating JupiterOne with your tools of choice, you will need to create an integration instance for whichever integration you wish to configure.

> **NOTE**
> 
> Along with pre-configured integration solutions, you have the ability to create custom integrations. You can [find more info about custom integrations here](/integrations/development/overview.md).

#### To create an integration instance:

1.  Navigate to the **Integrations** tab from the JupiterOne dashboard.
    
2.  Select your integration of choice.
    
3.  From within the integration-view, click to **Add instance**.
    
4.  Provide the necessary credentials for the integration.
    
    > **INFO**
    > 
    > All integrations share a set of common configuration fields in addition to integration-specific fields. [Read more about the shared configuration fields](/integrations/settings.md).
    > 
    > Alternatively, [refer to our integration-specific installation guides](/integrations.md) within the integration directory for more info on integration-specific fields.
    
5.  Click **Create** at the bottom of the page once all the necessary fields have been provided.
    

#### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

---

Source: /integrations/data-out/configure-jira-connection

# Configure a Jira connection

A **Connection** is the credential set Data Out uses to talk to your Jira workspace. Before you can create instances or fire **Create ticket** from CCM, you need at least one Connected Jira connection.

In 1.0, Jira connections authenticate using an **Atlassian API token**. You will:

1.  Mint an API token in your Atlassian account
2.  Open the Data Out Connections tab and start a new Jira connection
3.  Walk through the **Connect** and **Verify** steps in the wizard
4.  (Create flow only) continue into **Configure** and **Test** to stand up your first instance

## Prerequisite: mint an Atlassian API token

JupiterOne does not store your Atlassian password. Instead, you generate an API token scoped to the Atlassian account that owns the Jira projects you want to write to.

1.  Sign in to [id.atlassian.com](https://id.atlassian.com/manage-profile/security/api-tokens) with the Atlassian account you want JupiterOne to act as
    
2.  Click **Create API token**
    
3.  Give the token a recognisable **Name** (we suggest `JupiterOne Data Out Integration API Token`)
    
4.  Pick an **Expires on** date - Atlassian limits tokens to a maximum of one year
    
5.  Click **Create**, then immediately copy the token value - Atlassian only shows it once
    
    ![Atlassian Account Security: Create an API token dialog](/assets/images/atlassian-create-api-token-7ec2c4e498d5ba9a1df6035c1c5f2869.png)
    

> **TIP**
> 
> Set a calendar reminder one week before the **Expires on** date. When the token expires, Data Out will mark the connection as **Needs reauthorization** and instances backed by that connection will start failing. See [Re-authorize a connection](#re-authorize-a-connection) for the recovery flow.

## Open the Connection wizard

1.  In the JupiterOne left navigation, open **Integrations > Data out**
    
2.  The default tab is **Connections**
    
3.  Find the **Jira** card and click **Connect** (or **View ->** if you already have at least one Jira connection)
    
    ![Connections tab showing the Jira, ServiceNow, and Asana provider cards](/assets/images/connections-tab-providers-29dcfdbab6f6e86ef38f194c899b1a7a.png)
    
4.  The Jira provider page opens. Click **\+ Add a new Jira connection** (top-right) to open the wizard
    

## Step 1 - Connect

The Connect step captures four fields. You will paste the API token you minted above into the last one.

![Connection wizard: Connect step with Connection name, Host name, Email, and API Token fields](/assets/images/connection-wizard-connect-39b9d953fceea4528547c70af2fce043.png)

| Field | What to enter |
| --- | --- |
| **Connection name** | A friendly label that helps admins recognise this credential set, for example `Organization Jira Connection` or `ACME Cloud Jira`. The name appears wherever connections are referenced in Data Out. |
| **Host name** | Your Atlassian site URL **without** the `https://` prefix, for example `your-company.atlassian.net`. |
| **Email** | The email address of the Atlassian user who owns the API token. |
| **API Token** | The token value you copied from id.atlassian.com. Click the eye icon on the right to reveal the value and confirm you pasted the full string. |

Click **Next** (in create mode) or **Update connection** (when editing an existing connection).

## Step 2 - Verify

JupiterOne uses the credentials to confirm the API token is valid and to read a sample of Jira projects visible to that account. If you see "Your connection is working!" plus a list of project names, the token is good and the account has the read permissions Data Out needs.

![Connection wizard: Verify step with success message and a list of accessible projects](/assets/images/connection-wizard-verify-ec2378139b42051aa7c12384d57515b2.png)

-   If you are **editing** an existing connection, click **Finish** - your connection is saved
-   If you are **creating** a new connection, click **Next** to continue into the instance setup steps below

If verification fails, head to [Troubleshooting](/integrations/data-out/troubleshooting.md#connection-fails-to-verify) for common causes.

## Steps 3 and 4 - Configure and Test (create flow only)

When you create a brand-new connection, the wizard continues directly into the same **Configure** and **Test** steps that the [Add Jira instance](/integrations/data-out/create-instance.md) wizard uses, so you finish with a working connection **and** a first running instance in one pass.

These steps are documented in detail on the [Create an instance](/integrations/data-out/create-instance.md) page. Briefly:

-   **Configure** - name the workflow, optionally pick a **Data in Jira integration** to scope it to one project, and pick the **Issue type** to file under
-   **Test** - send a test payload to confirm the round-trip works, or click **Finish** to skip the test

Click **Finish** at the end of the Test step. The new connection appears on the Jira provider detail page with a green **Connected** badge, and the first instance shows up in the connection's instance table.

## Authorization status

Each connection carries an **Authorization status** badge that tells you whether the credentials are still good.

| Badge | What it means | What to do |
| --- | --- | --- |
| **Connected** (green dot) | Credentials are valid; instances backed by this connection can run | Nothing - you are good |
| **Needs reauthorization** | The most recent run failed authentication (token revoked, expired, or the Atlassian account lost project access) | Mint a new API token and follow [Re-authorize a connection](#re-authorize-a-connection) |
| **Failed** | Persistent authentication failure | Same recovery as **Needs reauthorization** - the difference is just the count of consecutive failures |

The badge is visible on the provider catalog card (Connections tab) and on the per-provider detail page next to each connection name.

## Edit an existing connection

1.  Open **Data out > Connections > Jira**
2.  Find the connection card and click the kebab menu (`...`) on the right of the connection header
3.  Click **Edit**
4.  The wizard opens directly on the **Connect** step with your existing values populated. The API Token field is masked - leave it as-is to keep the current token, or paste a fresh value to rotate it
5.  Step through **Verify** and click **Finish**

In edit mode, the wizard skips the **Configure** and **Test** steps because you are not creating a new instance - just updating credentials.

## Re-authorize a connection

When the badge says **Needs reauthorization**, the most common cause is an expired or revoked Atlassian API token. To recover:

1.  Mint a fresh API token at [id.atlassian.com](https://id.atlassian.com/manage-profile/security/api-tokens) using the same Atlassian account
2.  Open **Data out > Connections > Jira**
3.  Click the kebab menu next to the failing connection and choose **Edit**
4.  Paste the new token into the **API Token** field on the Connect step
5.  Click **Next**, confirm Verify is green, and click **Finish**

Existing instances backed by this connection will pick up the new credentials on their next run - you do not need to recreate them.

## Delete a connection

Deleting a connection deletes any instances that depend on it.

1.  Open **Data out > Connections > Jira**
2.  Click the kebab menu next to the connection and choose **Delete**
3.  Confirm the action

If the connection has dependent instances, JupiterOne will surface them in the confirmation dialog so you can decide whether to proceed. Deletion is irreversible. To stop a single instance without removing its connection, use **Stop** on the instance row instead - see [Manage instances](/integrations/data-out/manage-instances.md#row-actions).

---

Source: /integrations/data-out/create-instance

# Create an instance

An **Instance** (also called a **Workflow**) is the named delivery target that tells Data Out where to send a Jira ticket. Each instance ties together:

-   A **Connection** (which Atlassian site + which credentials)
-   A **Data in Jira integration** (optional - which Jira project the instance writes to)
-   An **Issue type** (the Jira issue type new tickets are filed under)

You can create as many instances per connection as you need - one per Jira project / issue-type pair is a common pattern.

## Prerequisites

-   At least one **Connected** Jira connection. See [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md) if you have not authorized one yet
-   (Recommended) A **Data in Jira** integration that already ingests the target project. This lets the wizard scope the instance to the project URL rather than asking you to type it. If you skip this, the field defaults to `None` and you can still create an instance

## Open the Add Jira instance wizard

You can start the wizard from two places:

-   **Provider detail page** - open **Data out > Connections > Jira** and click **\+ Add instance** on the connection card you want to attach to. This pre-selects the connection so the wizard skips Step 1
-   **Instances tab** - open **Data out > Instances**, find the Jira section, and click **\+ Add instance** on the right of the section header. This opens the wizard at Step 1 so you can choose which connection to use

The Add Jira instance wizard is a three-step Stepper modal: **Select Connection -> Configure -> Test**.

## Step 1 - Select Connection

Choose which Jira connection this instance should use. The step lists every Jira connection in your workspace with a green **Connected** badge.

![Add Jira instance: Select Connection step listing four available connections](/assets/images/add-instance-step1-select-connection-d21a0efb8403be67ce526fd95c93a8b7.png)

-   Click a card to select it - the selected card gets a blue outline
-   Click **Next** to advance

> **INFO**
> 
> If you started the wizard from a connection card's **\+ Add instance** button (rather than from the global Instances tab), the wizard auto-selects that connection and starts at Step 2 instead. You can always go back to Step 1 from the Stepper if you change your mind.

## Step 2 - Configure

Configure tells the instance which Jira project to write to and what issue type to use.

![Add Jira instance: Configure step with Workflow name, Data in Jira integration, and Issue type fields](/assets/images/add-instance-step2-configure-4300422dfe84c46c63c372728f52c403.png)

| Field | What to enter |
| --- | --- |
| **Workflow name** | A friendly label for this instance, for example `Jira Project: PROS Issue Type: Task`. The name is what admins see in the Instances tab and what producers (like the CCM Create ticket modal) use to identify the routing target. Pick something descriptive - both the project key and the issue type are useful. |
| **Data in Jira integration** | Optional. Dropdown of existing **Data in** Jira integrations in this workspace. Selecting one scopes the instance to that integration's Jira project so the **Issue type** dropdown can be populated from the project's real metadata, and so created tickets can be linked back to the data J1 already knows about. Defaults to `None`. |
| **Issue type** | The Jira issue type that this instance files tickets under. The dropdown is searchable - start typing to filter (for example, `pros` filters to issue types whose project key starts with `PROS`). The format `Project : Issue Type` indicates which Jira project each issue type belongs to (for example, `ProServe : Task`). |

> **TIP**
> 
> If you do not see the Jira project you expect in the **Data in Jira integration** dropdown, you have not yet ingested it via a Jira **data in** integration. See [Add an integration](/integrations/add-an-integration.md) for the steps to set one up. You can still create the instance without selecting a project here, but you will be choosing issue types from the union of all projects the Atlassian account can see.

When the three fields are filled in, click **Next** to continue to Test.

## Step 3 - Test

The Test step lets you fire a real Jira ticket at the project + issue-type combination you just configured, so you can confirm the round-trip works before relying on the integration. The instance is already created at this point - the test step is purely a validation gate.

![Add Jira instance: Test step with Summary and Description fields and Send test / Finish buttons](/assets/images/add-instance-step3-test-59e2ead3b0f88a29ef0b3aa585706f4f.png)

| Field | What to enter |
| --- | --- |
| **Summary** | The Jira issue **Summary** field. Defaults to a value like `Test PROS:Task ticket to be created` - safe to leave as-is for a smoke test, or edit to something distinctive so you can find it easily in Jira. |
| **Description** | The Jira issue **Description** field. Defaults to `testing ticket description`. |

You have two terminal actions:

-   **Send test** posts the test payload to the connected Jira project. A new ticket appears in Jira under the configured project and issue type. Use this for the first instance you stand up so you have a known-good baseline. **Remember to delete the test ticket from Jira afterward** to keep the project clean
-   **Finish** closes the wizard without sending a test payload. Use this if you have already validated this connection + project pair and just need a second instance pointing at the same place

Either way, the instance is now Active and visible on the Instances tab.

For a deeper walkthrough of how to interpret a successful or failing test, see [Test your instance](/integrations/data-out/test-instance.md).

## After Save: where to find the new instance

The new instance appears in three places:

-   **Provider detail page** (`Data out > Connections > Jira`) - in the connection card's instance table, with columns **Instance / Status / Last run / Successful / Failed jobs / Project issue type**
    
    ![Provider detail page with the new instance row](/assets/images/provider-detail-jira-42432efccc1466b7c4a360f3e31cee93.png)
    
-   **Instances tab** (`Data out > Instances`) - same table, grouped by provider with `N instances / N active` badges
    
-   **Instance detail page** - click the instance name in either of the above tables to open the per-instance detail view (Status, Last run, Lifetime tasks, Jobs succeeded, Jobs failed, plus the per-instance Jobs table). See [Manage instances](/integrations/data-out/manage-instances.md#instance-detail-page) for what you can do from there
    

## What is not configured on the instance in 1.0

In 1.0, the only fields stored on the instance itself are the three on the **Configure** step (Workflow name, Data in Jira integration, Issue type). Per-ticket fields like **Title**, **Description**, **Assignee**, and any custom Jira fields are entered at the moment a ticket is created - either by the producer (such as the [CCM Create ticket modal](/integrations/data-out/create-ticket-from-ccm.md)) or by the test payload above. There is no per-field mapping editor or templated defaults configuration on the instance in this release.

---

Source: /integrations/data-out/create-ticket-from-ccm

# Create a Jira ticket from a failing CCM control test

The flagship Data Out 1.0 producer experience is the **Create ticket** action on every failing CCM control. From the control detail panel, you pick an active Jira workflow (instance), review and edit the prefilled Title and Description, optionally assign someone, and click **Create ticket**. The ticket lands in Jira immediately and is linked back from the control detail panel for easy follow-through.

This page walks the entire round-trip in five steps, then covers what to do when nothing happens (no admin set up a workflow yet, or your role does not allow you to create one).

> **NOTE**
> 
> The label you see in the modal is **Workflow**, and the label you see on the Instances tab is **Instance**. They refer to the same object - they are interchangeable in 1.0.

## Prerequisites

-   At least one **Active** Jira instance. If none exist, see [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md) and [Create an instance](/integrations/data-out/create-instance.md) first
-   You can be a regular user to **see** existing tickets and Linked Jira issues, but you must be a **full admin** to create the underlying instance. The Create ticket modal itself is available to any user who can open the control detail panel; if no instance is configured, the modal shows a role-aware empty state (see [Empty states](#empty-states))
-   A control test in the **Failing** state to act on

## Step 1: Find a failing control

1.  From the JupiterOne left navigation, open **Compliance > Controls**
    
2.  The **Controls** view defaults to **All controls**. The header summary cards at the top show your overall health (`Overall controls status`, `Failing controls`, `High priority failing controls`, `Impacted frameworks`)
    
3.  Use the second filter dropdown to filter to **Fail**
    
4.  Click any row in the failing-controls table to open the control's detail panel on the right
    
    ![Compliance &gt; Controls Status filtered to Fail](/assets/images/ccm-controls-status-failing-2157863bdb42a04ea365813dd57d9d26.png)
    

## Step 2: Review the control and open the modal

The detail panel shows the control's summary, last-test metadata, framework mappings, and the **Linked Jira issues** section listing every prior ticket created from this control (each with its own **View in Jira** link). At the bottom of the panel is a prominent full-width **Create ticket** button.

![Failing control detail panel with Linked Jira issues section and Create ticket CTA](/assets/images/ccm-control-detail-create-ticket-button-5516143fb24e2cf177c413a11aeefb7b.png)

Click **Create ticket**. The Create ticket modal opens.

> **INFO**
> 
> Existing **Linked Jira issues** rows do **not** block creating another ticket. Tickets stack chronologically and each one is independently created in Jira. Use the existing rows as context (a colleague may have already filed it) before deciding to file again.

## Step 3: Fill the four fields

The Create ticket modal has exactly four fields in 1.0. Project, issue type, and any Jira-side custom fields are determined by the **Workflow** you select - they are not exposed in this modal in this release.

![Create ticket modal with Workflow, Title, Description, and Assignee fields](/assets/images/create-ticket-modal-d6303c087312c4cf37c3c67e61c8da53.png)

| # | Field | Behavior |
| --- | --- | --- |
| 1 | **Workflow** | Required. Dropdown of every **Active** Jira workflow (instance) in your workspace. If exactly one exists, it is preselected. The Workflow you pick determines the Jira project, issue type, and connection that will receive the ticket. |
| 2 | **Title** | Required. Single-line text input. Prefilled with `Control failure: {control name}` - for example, \`Control failure: 8.11a (AWS) |
| 3 | **Description** | Optional. Rich-markdown editor with a toolbar covering H1-H4, bold, italic, strike, inline code, code blocks, blockquotes, ordered and bullet lists, horizontal rules, links, and tables. Prefilled from the control's description text plus a list of failing tests. The markdown is converted to Jira wiki markup on submit so headings, lists, and links render natively in Jira. |
| 4 | **Assignee** | Optional. Searchable dropdown of Jira users resolved from the selected Workflow's connection. Until you pick a Workflow, the placeholder reads "Select a workflow to see list of assignees". Leave empty to file the ticket unassigned. |

## Step 4: Click Create ticket

When the four fields are filled in to your liking, click **Create ticket** at the bottom-right of the modal. JupiterOne POSTs the payload to the Workflow's underlying webhook and the modal closes when the call completes. A confirmation toast surfaces on success; on failure, the modal stays open with the error so you can correct and retry.

What is **not** in this modal in 1.0 - intentionally:

-   **Project** picker - determined by the Workflow's `Data in Jira integration` field
-   **Issue type** picker - determined by the Workflow's `Issue type` field
-   **Priority**, **Labels**, **Severity**, and other Jira fields - not exposed in 1.0

If you need to change which project or issue type a ticket files under, switch which Workflow you pick from the dropdown - or have an admin [create a new instance](/integrations/data-out/create-instance.md) targeting the project + issue type you need.

## Step 5: Confirm in CCM and jump to the Jira ticket

After Create ticket succeeds, two surfaces update.

### Linked Jira issues on the control detail panel

The control detail panel that originated the modal now lists the new ticket in the **Linked Jira issues** section, along with any prior tickets created for the same control. Each row shows the ticket title and a **View in Jira** external-link button.

![Linked Jira issues section on the control detail panel showing a created ticket](/assets/images/linked-jira-issues-section-cd736447432b6bc79fba10132067117d.png)

The list is reverse-chronological - the most recent ticket is at the top. Tickets are not deduplicated automatically; if your team only wants one open ticket per control at a time, encourage the team to check this section before clicking Create ticket again.

### View in Jira

Click **View in Jira** on any row to open that ticket directly in Atlassian. You should see:

-   **Title** prefixed with `Control failure:`
-   **Description** rendered with a **Failing control tests** heading and a bulleted list of the specific failing tests with entity counts (the markdown from the modal converts cleanly to Jira wiki markup)
-   **Reporter** set to the JupiterOne user who clicked Create ticket
-   **Assignee**, if you picked one in the modal
-   **Priority** and **Issue Type** populated from the Workflow's underlying configuration

![Resulting Jira ticket: Control failure title, Failing control tests description, Assignee and Reporter set](/assets/images/jira-ticket-created-7c6d2be5daca9b99f974115384bbe98a.png)

For the underlying outbound delivery record (status, timing, error message), open the originating Workflow's instance detail page (`Data out > Instances > {Workflow name}`) - the call you just made appears at the top of the per-instance Jobs table. See [Per-instance Jobs table](/integrations/data-out/manage-instances.md#per-instance-jobs-table).

## Empty states

If you click **Create ticket** but no Active Jira workflow exists, the modal renders an empty state instead of the four-field form. The message changes based on your role.

| Role | What you see | What to do |
| --- | --- | --- |
| **Full admin** | "No data-out ticketing workflow configured yet" + a **Go to connections** CTA pointing at `Data out > Connections` | Click the CTA. Follow [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md) end-to-end. Once a workflow is Active, return to the failing control and click Create ticket again. |
| **Non-admin** | "Ask an admin to set up a data-out ticketing workflow." | Notify a workspace admin. They can use the link above to set up the first workflow. |

The same empty state appears when every Jira workflow in the workspace has been **Stopped** - the Workflow dropdown only lists **Active** instances.

## Failure handling

If Jira rejects the ticket (for example, the project requires a custom field not provided, or the API token expired between when the workflow was created and when you clicked Create ticket), the modal surfaces the error inline and stays open. Your typed values are preserved. Common follow-ups:

-   **API token expired** - have an admin [re-authorize the connection](/integrations/data-out/configure-jira-connection.md#re-authorize-a-connection), then retry
-   **Required custom field missing** - put the missing context into the **Description** field and retry
-   **Project archived** - have an admin [edit the instance](/integrations/data-out/manage-instances.md#edit-an-instance) to point at a current project, or pick a different Workflow

For a fuller list, see [Troubleshooting](/integrations/data-out/troubleshooting.md).

---

Source: /integrations/data-out/manage-instances

# Manage instances

Once you have one or more instances configured, the **Instances** tab is your day-to-day operations view. From there you can scan health across providers, change the configuration of an instance, stop an instance temporarily, or remove one entirely. Clicking an instance name opens a per-instance detail page with deeper status and a focused Jobs table.

## The Instances tab

Open **Data out > Instances**. Instances are grouped by provider in collapsible sections. Each section header shows the provider's vendor brand and two badges: **N instances** (total in the group) and **N active** (currently running).

If you have not created any instances yet, the tab shows an empty state instead of provider groups:

![Instances tab empty state before any outbound destinations exist](/assets/images/instances-empty-state-31a5d9daf4bac20eefbbfec8fec1a06d.png)

Once at least one instance exists, the tab lists them under each provider:

![Instances tab grouped by provider with Jira instances](/assets/images/instances-tab-3b5c2f3ab86408aca7a5c6e44177ebc4.png)

Within each group, a table lists every instance with:

| Column | What it shows |
| --- | --- |
| **Instance** | The Workflow name configured on the instance. Click to open the [instance detail page](#instance-detail-page). |
| **Status** | **Active** when the instance is enabled; greys out when stopped. |
| **Last run** | Relative timestamp of the most recent job, for example `8 minutes ago` or `3 days ago`. |
| **Successful** | Count of jobs in the **Succeeded** terminal state. Lifetime count, not a rolling window. |
| **Failed jobs** | Count of jobs in the **Failed** terminal state. A red value here is a triage signal. |
| **Project issue type** | Compact label of the configured Jira project + issue type, for example `PROS--Task` (project key `PROS`, issue type `Task`). |

A **Status** filter dropdown above the table lets you narrow the list to **All**, **Active**, or **Stopped** instances. The **\+ Add instance** button on the right of the section header opens the [Add Jira instance wizard](/integrations/data-out/create-instance.md) for that provider.

## Row actions

Hover over a row to reveal three icons on the right edge: **Stop**, **Edit**, and **Delete**.

![Instance row hover state showing Stop, Edit, and Delete icons](/assets/images/instance-row-actions-df3816615bf0a2004c06f964c02bcdad.png)

| Icon | Action | Effect |
| --- | --- | --- |
| **Stop** (yellow octagon) | Pauses the instance. New CCM Create ticket calls and producer webhook events for this instance return immediately without creating a Jira ticket. The instance row Status flips to **Stopped**. | Reversible - hover again to see a **Start** action that re-enables it. |
| **Edit** (pencil) | Opens the [Edit workflow modal](#edit-an-instance) | Reversible - changes apply on save. |
| **Delete** (trash) | Permanently removes the instance | **Not reversible**. Confirm in the dialog. Existing Jobs records are retained for audit but no new jobs can be created against this instance. |

## Edit an instance

Clicking the **Edit** (pencil) icon on a row opens the **Edit workflow** modal.

![Edit workflow modal with Workflow name, Data in Jira integration, and Issue type fields](/assets/images/instance-edit-workflow-4a37fd728288016f8ac0c4d66eb492dc.png)

The fields match Step 2 of the [Add Jira instance wizard](/integrations/data-out/create-instance.md#step-2---configure):

| Field | What you can change |
| --- | --- |
| **Workflow name** | Update the friendly label. The new name appears immediately in the Instances tab and in the CCM Create ticket modal's Workflow dropdown. |
| **Data in Jira integration** | Re-target the instance to a different Jira project URL. Useful when a project key is renamed in Jira, or when you want to re-point an existing instance at a different project. |
| **Issue type** | Change the Jira issue type new tickets are filed under. The dropdown is searchable - start typing the project key (for example, `pros`) to narrow the list. |

Click **Save changes** to apply. The next CCM Create ticket call against this instance will use the new configuration.

> **INFO**
> 
> Editing an instance does **not** change the underlying Connection. To rotate credentials or repoint an instance to a different Atlassian site, edit the **Connection** instead via [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md#edit-an-existing-connection).

## Stop versus Delete

Use **Stop** when you want to temporarily disable an instance - for example, while you investigate a string of failures, or when the target Jira project is undergoing maintenance. Stop is reversible and preserves the instance's history.

Use **Delete** only when the instance is no longer needed. Deletion is irreversible. If a producer (such as the CCM Create ticket modal) has been pointed at the deleted instance, the next call will fall back to the workflow picker - admins will need to choose a different instance.

## Instance detail page

Click any instance name to open its detail page. The breadcrumb shows the path: `Data out > Instances > {Workflow name}`.

![Instance detail page with summary header and per-instance jobs table](/assets/images/instance-detail-page-1e9050638080568892d8dcfbc44a7fa7.png)

### Summary header

The header surfaces eight metrics at a glance:

| Metric | What it means |
| --- | --- |
| **Status** | **Active** or **Stopped**. |
| **Last run** | Timestamp of the most recent job. |
| **Last updated** | When the instance configuration was last edited (Workflow name, project, issue type). |
| **Lifetime tasks** | Total number of jobs this instance has produced over its lifetime. |
| **Jobs succeeded** | Lifetime count of jobs in **Succeeded** state. |
| **Jobs failed** | Lifetime count of jobs in **Failed** state. |
| **Data in integration** | The Jira project URL the instance is scoped to (`https://{site}/jira/software/projects/{KEY}`). |
| **Issue type** | The compact `Project--IssueType` identifier the instance writes under. |

### Per-instance Jobs table

Below the header is a Jobs table scoped to this instance only. Use it as the first stop when triaging a single instance's recent activity.

| Column | What it shows |
| --- | --- |
| **Job ID** | Unique identifier of the outbound delivery, for example `j-AaD9zzYn-DBYwFH-CD`. Useful for cross-referencing in support tickets. |
| **Status** | Terminal state: **Succeeded** or **Failed**. |
| **Started** | Relative timestamp when the job began. |
| **Completed** | Relative timestamp when the job reached its terminal state. |
| **Error message** | Short failure reason for jobs in the **Failed** state, for example `Webhooks: new ...`. Empty for **Succeeded** jobs. |

A search box and an **All statuses** filter let you narrow the table when an instance has many jobs.

For triage tips on common error messages and stuck jobs, see [Troubleshooting](/integrations/data-out/troubleshooting.md).

### Top-right kebab menu

The kebab (three-dot) menu in the top right of the detail page offers the same actions as the row hover: **Stop**, **Edit**, **Delete**. Use this when you have already drilled into the instance and want to take an action without going back to the list.

## Permission model

In 1.0, every action on the Instances tab and instance detail page (view, create, edit, stop, delete) requires the **full admin** role. Non-admins do not see the Data Out left-nav entry. See [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md#prerequisite-mint-an-atlassian-api-token) for the upstream prerequisite.

---

Source: /integrations/data-out/overview

# Data Out overview

**Data Out** is the JupiterOne surface that pushes events out of J1 and into the systems where your security and engineering teams already work. In the 1.0 release, Data Out powers automated and on-demand Jira ticket creation - including a one-click **Create ticket** action on every failing Continuous Control Monitoring (CCM) control test.

Data Out lives under **Integrations** in the J1 left navigation and is organized into two tabs.

![Data out tabs - Connections and Instances](/assets/images/data-out-tabs-overview-53e3ff3531c872543aae8edfbe501e29.png)

## What you can do with Data Out 1.0

-   Authorize one or more **Jira** connections using an Atlassian API token
-   Stand up named **instances** that route J1 events to a specific Jira project + issue type
-   Send a real test ticket from the wizard to confirm the round-trip before you rely on the integration
-   Click **Create ticket** on any failing CCM control test to file a Jira ticket with a prefilled title and description, then jump straight to the ticket via **View in Jira**
-   Watch every outbound delivery on each instance's detail page and drill in on failures via the **Error message** column

> **NOTE**
> 
> In 1.0 the **Workflow** label you see in the Create ticket modal and the **Instance** label you see on the Instances tab refer to the same object. The two terms are used interchangeably across the product and these docs.

## How Data Out is organized

Data Out is laid out as two top-level tabs. The default landing tab is **Connections**.

![Connections tab - provider catalog with Jira (Connected), ServiceNow and Asana (Coming soon)](/assets/images/connections-tab-providers-29dcfdbab6f6e86ef38f194c899b1a7a.png)

| Tab | What it does |
| --- | --- |
| **Connections** | Catalog of outbound providers. Add or edit the credentials Data Out uses to authenticate to an external system. Jira is live in 1.0; ServiceNow and Asana are surfaced as **Coming soon**. |
| **Instances** | Lists every named instance (workflow) you have running, grouped by provider, with status, last-run time, success and failure counts, and project / issue-type metadata. Click any instance to open its detail page and see the per-instance Jobs table that lists every outbound delivery for that instance. |

## Glossary

| Term | Meaning |
| --- | --- |
| **Connection** | A set of credentials that authorize JupiterOne to talk to an external system (for example, an Atlassian site + email + API token for a Jira workspace). One Jira workspace usually needs one Connection. |
| **Instance** (also called **Workflow**) | A named delivery target that combines a Connection with a target context. For Jira, the target context is a **Data in Jira integration** (which scopes you to a Jira project) and an **Issue type**. You can have many instances per connection. |
| **Job** | The record of a single outbound delivery for an instance - one row per outbound POST to the target system, including the resulting external ticket key on success or the error on failure. Jobs surface in the per-instance Jobs table on each instance's detail page. |
| **Provider** | The external system that Data Out talks to. 1.0 ships **Jira** as the live provider. ServiceNow and Asana are coming soon. |

## Prerequisites

Before you can configure Data Out:

-   You must be a **full admin** in the JupiterOne workspace. Connections and Instances are admin-only surfaces in 1.0
-   You need an Atlassian account with permission to create issues in at least one Jira project on your target site
-   You need to be able to mint an Atlassian **API token** for that account at [id.atlassian.com](https://id.atlassian.com/manage-profile/security/api-tokens)

> **INFO**
> 
> The Jira **Data in** integration is a separate, optional input. If you have it configured, the Instance wizard can scope an instance to a specific Jira project URL it has already discovered. You can still create instances without a Data in Jira integration. See [Add an integration](/integrations/add-an-integration.md) for setting up data ingestion.

## Get started

The fastest path to your first ticket is the four-step quick start below. Follow them in order; each page picks up where the previous one left off.

1.  **[Configure a Jira connection](/integrations/data-out/configure-jira-connection.md)** - mint an Atlassian API token and authorize J1 to talk to your Jira site
2.  **[Create an instance](/integrations/data-out/create-instance.md)** - pick the connection, choose a Jira project + issue type, and (optionally) send a test payload
3.  **[Test your instance](/integrations/data-out/test-instance.md)** - send a real `[TEST]` ticket and confirm it lands in Jira
4.  **[Create a ticket from a failing CCM control test](/integrations/data-out/create-ticket-from-ccm.md)** - the flagship 1.0 use case: turn any failing control into a tracked Jira ticket in three clicks

After you have a working instance, the reference pages cover ongoing operations:

-   **[Manage instances](/integrations/data-out/manage-instances.md)** - edit, stop, delete, and inspect instance details (including the per-instance Jobs table that records every outbound delivery)
-   **[Troubleshooting](/integrations/data-out/troubleshooting.md)** - common failure modes and how to fix them

---

Source: /integrations/data-out/test-instance

# Test your instance

Sending a test payload through a new instance is the fastest way to confirm everything is wired correctly: the connection has the right token, the configured Jira project exists and accepts the issue type, and JupiterOne can write to it. We strongly recommend running a test on every instance before you let it serve real CCM tickets.

## When to test

-   **Right after creating an instance** - the [Add Jira instance wizard](/integrations/data-out/create-instance.md) ends on a Test step for exactly this reason
-   **After re-authorizing a connection** - to confirm the new API token still has write access to the project
-   **After changing a Jira project's permissions or issue-type configuration** - to catch breakage before a real CCM ticket fails

## Test from the wizard

The cleanest test path is the **Test** step of the [Add Jira instance wizard](/integrations/data-out/create-instance.md#step-3---test). It walks you through Summary and Description, posts a real ticket, and lets you confirm in Jira immediately.

![Add Jira instance: Test step with Summary, Description, Send test, and Finish](/assets/images/add-instance-step3-test-59e2ead3b0f88a29ef0b3aa585706f4f.png)

| Field | Default | What to do |
| --- | --- | --- |
| **Summary** | `Test PROS:Task ticket to be created` (varies by configured issue type) | Edit to something distinctive so the ticket is easy to find in Jira, for example `[J1 Data Out test - 2026-05-18]`. |
| **Description** | `testing ticket description` | Optional. Add any context you want included in the test ticket body. |

Click **Send test** to fire the payload at the configured Jira project + issue type. After Send:

-   A new ticket appears in Jira against the project the instance is scoped to, with the issue type the instance is configured for
-   Open the ticket in Jira and confirm the Summary and Description landed as expected
-   **Delete the test ticket** in Jira once you have verified - test tickets count toward project clutter and can confuse downstream automation

If you do not need to send a test (for example, you just verified an identical instance pointing at the same project), click **Finish** to close the wizard without sending.

## What success looks like

When the test succeeds, two surfaces update:

-   The instance row's **Successful** count on the Instances tab (and on the connection card's instance table on the provider detail page) increments by 1
-   The instance's **Last run** timestamp updates to "just now"

![Provider detail page showing instance with success and failure counts](/assets/images/provider-detail-jira-42432efccc1466b7c4a360f3e31cee93.png)

You can also open the instance detail page and find the test job at the top of the per-instance Jobs table with status **Succeeded**. See [Manage instances](/integrations/data-out/manage-instances.md#instance-detail-page).

## What failure looks like

If the test payload fails, the **Failed jobs** count on the instance row increments by 1 and the **Last run** timestamp shows the failure time. The instance Status remains **Active** - a single failed job does not deactivate the instance.

To see the error message:

1.  Click the instance name to open the instance detail page
    
2.  The most recent job appears at the top of the Jobs table with status **Failed** and an **Error message** column
    
    ![Instance detail page with two failed jobs and Webhooks: new ... error messages](/assets/images/instance-detail-page-1e9050638080568892d8dcfbc44a7fa7.png)
    
3.  Common causes:
    
    -   **Authentication failure** - the API token expired, was revoked, or the Atlassian account lost project access. Connection-level recovery is documented at [Re-authorize a connection](/integrations/data-out/configure-jira-connection.md#re-authorize-a-connection)
    -   **Issue type not present in the project** - the configured issue type is not enabled in the target Jira project. Edit the instance and pick an issue type that is enabled for the project, or have your Jira admin enable the issue type in the project's issue scheme
    -   **Project archived or moved** - the Jira project was archived in Atlassian or its key changed. Update the **Data in Jira integration** field to point at the new project
    -   **Required custom field missing** - the project requires a custom field that the test payload does not provide. In 1.0, the test payload is fixed to Summary + Description; if the project requires more, file a normal ticket through the [CCM Create ticket flow](/integrations/data-out/create-ticket-from-ccm.md) where you can fill the description with the missing context

For a fuller list of failure modes, see [Troubleshooting](/integrations/data-out/troubleshooting.md).

## Re-running a test on an existing instance

In 1.0, the wizard's **Test** step is the only test surface. To re-test an existing instance:

1.  Open **Data out > Instances** (or the provider detail page)
2.  Find the instance row, hover, and click the **Edit** (pencil) icon
3.  The [Edit workflow modal](/integrations/data-out/manage-instances.md#edit-an-instance) opens. Change nothing if you just want to re-test, or update fields as needed
4.  Save - the next CCM Create ticket call (or webhook event) is the next live exercise of the instance. Watch the **Successful** and **Failed jobs** counts on the row, or open the instance detail page to see the per-job result

A Send-test button on the existing-instance edit modal is on the roadmap; for now, the wizard's Test step is the simplest dedicated way to send a synthetic payload.

---

Source: /integrations/data-out/troubleshooting

# Troubleshooting Data Out

Use this page as a symptom-first index. Find the line that matches what you are seeing, follow the link, and you should be back to a working state in a few minutes.

## Connection problems

### Connection fails to verify

**Symptom**: You filled in Connection name, Host name, Email, and API Token on the [Connect step](/integrations/data-out/configure-jira-connection.md#step-1---connect), clicked **Next**, and the Verify step shows an error instead of "Your connection is working!".

**Most likely causes**:

-   **Wrong Host name format** - the field expects the bare Atlassian site (`your-company.atlassian.net`), not a full URL. Strip any `https://` prefix or trailing path
-   **Email/token mismatch** - the token belongs to a different Atlassian account than the email you entered. Mint a fresh token from the [exact account](https://id.atlassian.com/manage-profile/security/api-tokens) whose email you typed in
-   **Token revoked** - check `id.atlassian.com/manage-profile/security/api-tokens`. If the token name does not appear, it has been revoked
-   **Atlassian site is on the wrong region or has SSO-only access** - confirm in Atlassian admin that API token authentication is allowed for your site

Mint a new token, edit the connection, paste the new value into **API Token**, and re-step through Verify.

### Authorization status reads "Needs reauthorization"

**Symptom**: The connection card on **Data out > Connections > Jira** shows a yellow **Needs reauthorization** badge.

**Cause**: The most recent run failed authentication. Almost always an expired or revoked API token, or the underlying Atlassian account losing access to all configured Jira projects.

**Fix**: Follow [Re-authorize a connection](/integrations/data-out/configure-jira-connection.md#re-authorize-a-connection). If a fresh token still fails Verify, the Atlassian account itself has lost project access - have a Jira admin restore it.

### "I cannot find the kebab menu to edit a connection"

The kebab menu (`...`) sits at the right end of the connection header on the per-provider detail page (`Data out > Connections > Jira`), not on the provider catalog card. If you are on the catalog page (the one with Jira / ServiceNow / Asana cards) and want to edit, click the Jira card's **View ->** button first.

## Instance problems

### Test ticket does not appear in Jira

**Symptom**: You clicked **Send test** on the [Test step](/integrations/data-out/test-instance.md#test-from-the-wizard) of the Add Jira instance wizard. The wizard reports success, but no ticket appears in the configured project.

**Diagnosis**:

1.  Open **Data out > Instances**, find the new instance, and check the **Successful** count. If it incremented to 1, Jira accepted the payload - the ticket exists somewhere
2.  Confirm which project the instance writes to by clicking the instance name and reading the **Data in integration** field on the detail page
3.  In Jira, navigate to that project and search for the test Summary text. Test tickets often land in the project's default backlog rather than its Active sprint

If **Successful** stayed at 0 and **Failed jobs** incremented, the payload was rejected - see [A job failed](#a-job-failed) below.

### Issue type is missing from the dropdown

**Symptom**: On the Configure step, the **Issue type** dropdown does not contain the issue type you expect for the project you picked.

**Cause**: The Jira project's **Issue scheme** does not include that issue type. Issue types in Jira are scoped to schemes, and a project only sees the issue types its scheme allows.

**Fix**: Have a Jira admin add the issue type to the project's issue scheme in Atlassian, then reopen the wizard. The dropdown re-fetches when you re-open Configure.

### Instance is Active but no tickets are being created

**Symptom**: Status reads **Active**, **Last run** is hours or days ago, and **Successful** + **Failed jobs** counts are not changing.

**Diagnosis**:

-   Confirm a producer is calling the instance. In 1.0, the primary producer is the [CCM Create ticket](/integrations/data-out/create-ticket-from-ccm.md) modal - if no one has clicked Create ticket on a failing control, the instance has nothing to do
-   Check that the instance is **Active**, not **Stopped**. Stopped instances accept calls but return immediately without creating a Jira ticket
-   Confirm CCM users see your instance in the Workflow dropdown of the Create ticket modal. If they do not, the instance may have been stopped, or they may be looking at a different workspace

## Job problems

### A job failed

**Symptom**: A job in the [per-instance Jobs table](/integrations/data-out/manage-instances.md#per-instance-jobs-table) on an instance's detail page shows status **Failed** with an **Error message** like `Webhooks: new ...`, `401`, `403`, or a Jira validation message.

**Fix**: Decode the **Error message** column using the table below.

| Message starts with | Likely cause | Where to fix |
| --- | --- | --- |
| `Webhooks: new ...` | The outbound webhook that backs the instance failed to execute. Almost always a transient issue or an upstream Jira project mis-configuration. | Re-check the configured **Data in integration** + **Issue type** in the [Edit workflow modal](/integrations/data-out/manage-instances.md#edit-an-instance). If both are valid, retry the original CCM Create ticket call. |
| `401` / `Unauthorized` | The connection's API token is invalid (revoked or expired). | [Re-authorize the connection](/integrations/data-out/configure-jira-connection.md#re-authorize-a-connection). |
| `403` / `Forbidden` | The Atlassian account lost permission to write to the configured Jira project. | Have a Jira admin restore project permissions for the account, or repoint the instance via [Edit](/integrations/data-out/manage-instances.md#edit-an-instance). |
| `404` / `not found` | The configured project or issue type no longer exists. | [Edit the instance](/integrations/data-out/manage-instances.md#edit-an-instance) and pick a current project + issue type. |
| Validation error referencing a field name | The Jira project requires a field that the producer did not supply. | Re-fire the CCM Create ticket call, including any required information in the **Description** field. |

### A job is stuck

**Symptom**: A job has been **Started** for several minutes without reaching a terminal state.

**Diagnosis**:

-   Refresh the instance detail page - the row may have already completed and the UI is stale
-   Check the connection status (`Data out > Connections > Jira`). If the connection flipped to **Needs reauthorization** while the job was in flight, the job will move to **Failed** as soon as the retry exhausts

If a job remains stuck for more than 15 minutes, contact JupiterOne support with the **Job ID** (the `j-...` value from the per-instance Jobs table) - the underlying outbound delivery may need to be cancelled manually.

## CCM Create ticket problems

### The Workflow dropdown is empty

**Symptom**: You clicked **Create ticket** on a failing control. The modal opens but the Workflow dropdown shows no options.

**Cause**: There are no **Active** Jira instances in the workspace. Either none have been created, or every existing instance has been **Stopped**.

**Fix (admin)**: Click the **Go to connections** CTA in the modal's empty state, follow [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md), and create at least one instance.

**Fix (non-admin)**: The modal's empty state reads "Ask an admin to set up a data-out ticketing workflow." - flag a workspace admin.

### "I do not see the Create ticket button on a control"

**Symptom**: A control is failing but the bottom of its detail panel does not show a Create ticket CTA.

**Causes**:

-   The control's status is **Passing** rather than **Failing**. The Create ticket CTA is only shown on failing controls
-   Your role does not allow ticket creation. Contact an admin
-   The Data Out feature is not enabled on your workspace. Contact JupiterOne support

### "The Linked Jira issues section is empty after I clicked Create ticket"

**Symptom**: You clicked Create ticket and the modal closed without an error, but the Linked Jira issues section on the control detail panel is still empty.

**Diagnosis**:

1.  Refresh the control detail panel - the Linked Jira issues list updates after the call completes
2.  Open the originating Workflow's instance detail page (`Data out > Instances > {Workflow name}`) and look for the most recent row in the per-instance Jobs table. If it is **Succeeded**, the ticket was created in Jira - the control panel may simply be stale; refresh it
3.  If the most recent job is **Failed**, the ticket never made it into Jira. Read the **Error message** column and follow [A job failed](#a-job-failed)

### Created tickets land in the wrong Jira project

**Symptom**: Tickets are landing in a Jira project, but not the one you expected.

**Cause**: The Workflow you picked in the dropdown is configured against a different project than you assumed.

**Fix**: Open **Data out > Instances**, click the Workflow name, and confirm the **Data in integration** and **Issue type** fields. To repoint:

-   For a one-off correction, pick a different Workflow on the Create ticket modal next time
-   For a permanent change, [edit the instance](/integrations/data-out/manage-instances.md#edit-an-instance) - update **Data in Jira integration** and **Issue type** as needed, then save

## Still stuck?

If none of the above resolves your issue, gather the following information before contacting [JupiterOne Support](https://support.jupiterone.io):

-   The Job ID of the failing job (from the per-instance Jobs table on the instance detail page)
-   A copy of the **Error message** column value for that job
-   The Workflow name of the affected instance
-   The control identifier (if the symptom is on the CCM side)
-   A screenshot of the **Authorization status** badge on the connection card

Support can correlate the Job ID with the underlying outbound delivery to pinpoint where the call dropped.

---

Source: /integrations/data-sources

# Data Source Configuration

## Overview

Each JupiterOne integration ingests multiple data sets. Each data set we call a Data Source. This feature allows users to define which **Data Sources** are **enabled** or **disabled** at multiple levels, providing flexibility while maintaining control. The configuration follows a structured hierarchy:

1.  **Integration Defaults** – Prescribed by the integration itself.
2.  **Organization Overrides** – Organization-wide settings that modify the defaults for an integration (**applied only during instance creation**).
3.  **Instance-Specific Overrides** – Final configuration at the individual instance level.

---

## Defaults and Overrides in Detail

### 1\. Integration Defaults

-   Each integration defines a set of **Data Sources**. Some **Data Sources** may be **enabled by default**, while others are **disabled**.
-   These defaults are applied when a new integration instance is created.
-   New **Data Sources** that are added to an existing integration will be **disabled by default**.

### 2\. Organization Overrides (Applied at Instance Creation)

-   Integration admins can configure **Data Sources** defaults to override the integration level defaults.
    
-   Look for the cog icon in the top left corner next to the Integration name to set these Organization level defaults.
    
    ![Org level overrides](/assets/images/data-sources-3-9c9036314a9fab0728bf8af29aaba6de.png)
    
-   These overrides **only take effect when a new instance is created**.
    
-   After creation, organization settings **do not** affect existing instances.
    

### 3\. Parent Instance Overrides (Applied at Child Instance Creation)

-   Some integrations, like **AWS**, _**GCP**_, or **Azure**, support **parent-child instances**.
-   A parent instance can specify its own **Data Source** configuration.
-   These parent instance settings **are copied to the children when they are created**.
-   Once a child instance is created, changes to the parent do **not** affect it.

### 4\. Instance-Specific Overrides

-   After an instance is created, the user can modify **Data Source** settings as desired.

---

## Example Scenarios

| Layer | Data Source: `AWS Glacier Service` | Data Source: `AWS EC2 Instances` |
| --- | --- | --- |
| **Integration Default** | Disabled | Enabled |
| **Organization Override** _(applied at creation)_ | Enabled | No Change |
| **Parent Instance Override** _(applied at creation, if applicable)_ | Disabled | No Change |
| **Instance-Specific** | Not Changed | Disabled |
| **Final Result** | **Enabled** | **Disabled** |

---

## Key Notes

-   **Organization Overrides and Parent Instance Overrides are only applied when an instance is created.**
-   **Instance-specific settings are always adjustable within the inherited constraints.**

---

Source: /integrations/development/collector

# Overview

The JupiterOne Collector enables you to ingest data from on-premise and self-hosted applications within your network, providing secure and flexible integration options. Collectors are deployed within your infrastructure and registered to JupiterOne, allowing you to control what resources are accessed and how data is transmitted.

## Collector Overview

JupiterOne Collectors can be deployed in two primary ways:

-   **Docker-based Collector**: Best for dedicated VMs or single-host deployments.
-   **Kubernetes-based Collector**: Best for organizations already using Kubernetes.

Each collector instance is capable of running multiple integrations and can be managed centrally from the JupiterOne console.

## Choosing a Deployment Option

| Feature | Docker-based Collector | Kubernetes-based Collector |
| --- | --- | --- |
| **Environment** | Dedicated VM/host | Kubernetes cluster |
| **Installation** | Docker commands | Helm chart |
| **Scalability** | Single instance | Multiple pods/replicas |
| **Management** | Direct container management | Kubernetes-native (CRDs, operators) |
| **Best for** | Simple deployments, legacy systems | Cloud-native environments, multi-tenant |
| **High Availability** | Limited | Native Kubernetes HA features |

-   If you want a simple, VM-based deployment, choose the **[Docker-based Collector](/integrations/development/collector/docker.md)**.
-   If you are running in a Kubernetes environment, choose the **[Kubernetes-based Collector](/integrations/development/collector/kubernetes.md)**.

## Next Steps

-   [Deploy with Docker](/integrations/development/collector/docker.md)
-   [Deploy with Kubernetes](/integrations/development/collector/kubernetes.md)

For more information on architecture, security, and frequently asked questions, see the sections below.

## Architecture Notes

The JupiterOne Collector is built as an extension of the JupiterOne platform, with configuration all managed from within the JupiterOne application. The Collector registers itself in your environment and will communicate with the JupiterOne platform to pull its configuration and job queue. There is no requirement for the JupiterOne cloud service to have access into your network, allowing for secure data collection.

### Docker-based Architecture

The Docker-based collector orchestrates a container runtime environment for the workloads, with very straightforward installation requirements. It is a lightweight custom container orchestration tool, running the same integration workloads as in the JupiterOne cloud service.

### Kubernetes-based Architecture

The Kubernetes Integration Operator leverages native Kubernetes features, using Custom Resource Definitions (CRDs) to manage integration workloads as standard Kubernetes pods. This approach provides better scalability and integrates seamlessly with existing Kubernetes tooling and practices.

In normal operation the JupiterOne collector will be:

-   Sending regular heartbeats to the JupiterOne platform
-   Reading from its dedicated job queue

Once an integration task is scheduled for a Collector to run it will appear on the Collectors job queue. This job will provide the collector with all the details required to configure and launch the integration task. This task will be created as a one-time container that will run the integration workload.

## Security Considerations

By running JupiterOne Collectors in your own infrastructure, you are entering into a shared responsibility model for the security of that infrastructure. Whilst we at JupiterOne do everything we can to protect your data and configurations, it is the customer's responsibility to ensure that the collector host machine is secure.

The following recommendations should be reviewed and considered:

-   Ensure that the host OS and container runtime are kept up to date.
-   Ensure that access to the collector host machine is properly managed.

The collector stores the private key used for encryption of the job configs in `/etc/.j1config/`. This directory is set to be readable only by root, but depending on how you operate the container runtime these permissions should be reviewed.

> **CAUTION**
> 
> If this key is accessed the integration jobs for the collector can be decrypted, potentially allowing the credentials used for the integrations to be read. It's important that all integration accounts are minimal read-only accounts where possible.

## FAQ

#### Q: Can I run the Collector using EKS, ECS, or OpenShift?

Yes! The JupiterOne Integration Operator now supports running collectors in Kubernetes environments including EKS, ECS, and OpenShift. There are two deployment options:

1.  **Kubernetes Integration Operator**: Use the Helm chart to deploy the operator in your Kubernetes cluster. This is the recommended approach for Kubernetes environments.
2.  **Docker-based Collector**: For non-Kubernetes environments, use the traditional Docker-based collector on a dedicated VM.

#### Q: Does J1 Collector do network scanning?

No, the JupiterOne collector does not do any additional scanning in your environment. The JupiterOne Collector can only run integration jobs that already exist.

What the Collector does give is the ability for JupiterOne and the community to build new integration types that would not have been possible from a saas-only integration workload.

#### Q: The integration I want to configure doesn't have a collector option

Not all integrations are compatible with collectors, either because of the way they're built (e.g., the AWS integration and its use of AWS roles for authentication), or because the integration has not been packaged and tested yet.

If there is an integration that you would want to run on a collector that isn't currently compatible, please [contact us](mailto:support@jupiterone.com).

#### Q: What network connectivity is required?

The collector needs to be able to reach the following domains:

-   `ghcr.io`, `pkg-containers.githubusercontent.com` and `github.com`. The GitHub package registry where the collector and integration images are hosted.
-   `*.jupiterone.io`, where the collector registers, sends it heartbeats, reads the integration job queue, and finally sends the data collected by the integration jobs. This can be optionally restricted to the region specific instance, such as `*.us.jupiterone.io` or `*.eu.jupiterone.io`.
-   Whatever domains the integration itself needs to connect to, for example your local vSphere instance.

#### Q: Do all features of all integration work?

No, there are some limitations when the integration is running on a JupiterOne collector, but generally these limitations don't impact real use cases. For example, you may find that some integrations offer the ability to "Test Credentials", this operation will only work if the integration target is reachable from the JupiterOne Cloud infrastructure, in which case you're probably not going to run that integration in a collector.

There may also be issues with some of the authentication methods, for example where the integration authenticates based on a shared trust between JupiterOne infrastructure and the target of the integration.

#### Q: Can I run the JIRA integration (e.g., create tickets)

No, the JupiterOne Collector only runs ingest based integration workloads, it does not include any action/alert based integrations at this time.

#### Q: I installed a J1 Collector but I don’t see it registered in my JupiterOne console

This indicates that the JupiterOne Collector was unable to start or register with JupiterOne. The first step is to review the logs produced by the JupiterOne collector components.

Running the command `docker ps --all` will show which containers ran (or are running). You can expect to find references to an "installer", "runner" and "daemon" containers. Please use `docker logs <CONTAINER_ID>` to retrieve the logs associated with the containers and review, attaching the logs to a support case, if required.

> **CAUTION**
> 
> Please be sure to redact any sensitive details prior to sending.

---

Source: /integrations/development/collector/docker

# Docker based Collector

The Docker-based JupiterOne Collector is designed for deployment on a dedicated Linux VM or host using Docker Engine. This guide covers requirements, installation, and management.

## System Requirements

|  |  |
| --- | --- |
| **Operating System** | Any modern 64-bit systemd linux distribution should work. The JupiterOne Collector has been specifically tested against the following Operating Systems using the official Docker Engine:
-   Ubuntu Server 22.04 LTS
-   Ubuntu Server 23.04
-   RedHat Enterprise Linux 9.4
-   RedHat Enterprise Linux 8.9

 |
| **Container Runtime** | Whilst any docker compatible container runtime should work (e.g., podman), only the official Docker engine has been tested and certified to work. See [Docker installation instructions here](https://docs.docker.com/engine/install/). There are specific notes later in this document if you wish to use `podman` instead of Docker, see [Podman Container Runtime](#podman-container-runtime). |
| **Docker Engine Version** | **Minimum:** Docker Engine 24.0. **Recommended:** 28.x or 29.x.  
  
Any release at or above the minimum is supported. JupiterOne's own testing covers Docker Engine 24.0, 26.1, 27.5, 28.5, 29.0, 29.1, and 29.8.  
  
Docker Engine 29 and later also require Collector images `daemon-v1.5.0` and `runner-v1.6.2` or later. If your Collector is older than that, update the Collector **before** you upgrade Docker Engine, because an older Collector cannot update itself once Docker Engine 29 is installed. See [Upgrading Docker Engine](#upgrading-docker-engine). |
| **CPU** | 4 vCPU  
  
The CPU requirement is dependent on the integration workload, but 4 vCPU is a good starting point. |
| **RAM** | 2 GB minimum, 8 - 12 GB recommended.  
  
Most integration jobs operate with <1GB of RAM but the memory requirement will depend on the number of entities being handled. Some very large integration instances, those handling millions of entities, may require 10GB+ of available memory. |
| **Networking** | The Collector needs to be able to connect to JupiterOne's services at `*.us.jupiterone.io` or `*.eu.jupiterone.io` over `HTTPS/443`.  
  
The JupiterOne Collector host also needs connectivity to the integration target; e.g., if running an Active Directory integration, it will need connectivity to your local LDAP port of your AD servers.  
  
The container images are pulled from the GitHub package registry at `ghcr.io`. The container images are all signed by JupiterOne, this requires connectivity to the cosign signing service also hosted at github. |
| **Storage** | 50 GB available local storage.  
  
JupiterOne integrations running on the Collector do not themselves need persistent storage. Only the JupiterOne Collector itself requires persistent storage to maintain a configuration file.  
The Collector host should have sufficient local storage to hold logs for the various services. |

## Container Runtime

We recommend using the official Docker Engine. The installation instructions depend on the host OS, and can be found here: [https://docs.docker.com/engine/install/](https://docs.docker.com/engine/install/)

> **NOTE**
> 
> You do not need to install Docker Desktop features. For Ubuntu you would use these instructions: [https://docs.docker.com/engine/install/ubuntu/](https://docs.docker.com/engine/install/ubuntu/)

You can confirm you have a working container runtime environment on your host machine using a test command:

```text
sudo docker run hello-world
```

Which should produce the following output: ![Example docker run result](/assets/images/docker-example-cbe20b17c73ab4d888c0b8b906f08fab.png)

This confirms that the docker engine is running and able to pull and launch containers. At this point you are ready to deploy a collector.

## Deploying a Collector

To set up a collector, you will need a JupiterOne account.

1.  Navigate to **Integrations > Collectors**, choose **New collector**. Provide a name for the new collector and select **Create**:

![Creating a collector in JupiterOne](/assets/images/create-collector-4aab5e3106ac5e90bf6ab786543485f4.png)

2.  Take the terminal command and run it in your new collector instance.

> **NOTE**
> 
> You may need to prefix the command with `sudo` depending on how your permissions are configured and your current user.

![Kicking off the collector setup process in JupiterOne](/assets/images/collector-config-984cb17ea178f4182d47cf59ceb1c916.png)

Example command:

```text
docker run -e JUPITERONE_AUTH_TOKEN='...' -e JUPITERONE_COLLECTOR_ID='...' -e JUPITERONE_ACCOUNT_ID='...' -e JUPITERONE_API_BASE_URL='...' -v /etc/.j1config:/etc/.j1config -v /var/run/docker.sock:/var/run/docker.sock ghcr.io/jupiterone/collector-scripts/installer:latest
```

-   `docker run` is the command to run the installer container.
-   `-e` are environment variables for authentication and configuration.
-   `-v` are volume mounts for configuration and Docker socket access.

Running this command on your Collector host will kick off the process to setup the collector.

3.  Confirm the collector is running using `docker ps`. You should see two containers running (daemon and runner):

![Using the docker ps command to confirm collector is running](/assets/images/docker-confirm-2b1702cb1a83ed3af26c8597dadc0adf.png)

-   **Daemon**: Manages local state, upgrades, and health checks.
-   **Runner**: Manages the job queue and launches integration jobs.

To check which versions these are running later, see [Upgrading the Collector](#upgrading-the-collector).

4.  Examine the logs of the runner to ensure it's successfully connecting to JupiterOne:

![Examining runner logs to ensure success in connecting to JupiterOne](/assets/images/docker-log-ffc908ea84163b1bea2099f143536b1a.png)

At this point the collector is set up and running. You will see the collector as "Active" in the collector overview after a few minutes:

> **NOTE**
> 
> The collector containers are running with a restart policy of "unless-stopped", so they will restart automatically on failure, and will start automatically when the container runtime (re)starts, i.e. at system reboot time.

![JupiterOne Collecter status Active in the JupiterOne dashboard](/assets/images/collector-success-5be149749e24bb8224a7107d06bacc8d.png)

## Assigning an Integration

Assigning an integration job to a collector first requires that there are collectors registered and available. Once collectors are available, the process for defining an integration job and assigning it to a collector is straightforward.

For integrations that are collector compatible, complete the integration configuration as normal. During configuration, you'll notice there's an additional option to choose where the integration should run.

Select **Collector** on the integration instance, and choose the corresponding collector for which you'd like the integration to run.

![Choosing run on Collector within the JupiterOne integration instance configuration](/assets/images/integration-location-caff09d6752d5364027ed190220e03c0.png)

## Upgrading the Collector

The Collector keeps itself up to date. The daemon checks for new Collector versions every few minutes and replaces the daemon and runner containers automatically, so no action is normally required.

### Checking which version is running

Run:

```text
sudo docker ps
```

In the **IMAGE** column, the part after the final `:` is the version. For example, `ghcr.io/jupiterone/collector-scripts/runner:runner-v1.6.6` is running `runner-v1.6.6`.

The daemon and the runner are versioned separately, so check both. Version numbers increase over time and are compared from left to right: `runner-v1.6.6` is newer than `runner-v1.6.2`, and `runner-v1.10.0` would be newer than either.

> **NOTE**
> 
> After the Collector has updated itself, the daemon container is named `daemon-` followed by a unique identifier rather than simply `daemon`. This is expected.

### Reinstalling the Collector

If the Collector is not running, or its version is not updating, reinstall it by re-running the installer command from **Integrations > Collectors**. Reinstalling brings both the daemon and the runner to the current version.

Before you reinstall, remove the existing containers so that their names are free.

First list the Collector's containers. They are the ones whose image name contains `collector-scripts`:

```text
sudo docker ps -a --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}' | grep collector-scripts
```

Then remove them by the names shown in the first column, for example:

```text
sudo docker rm -f runner daemon
```

> **CAUTION**
> 
> Remove only the container names that the command above listed. Do not match on the words "runner" or "daemon" on their own, because your own containers may have names that contain them.

## Upgrading Docker Engine

> **CAUTION**
> 
> **Check the Collector version before you upgrade Docker, not after.**
> 
> To run Docker Engine 29 or later, the Collector must already be running `daemon-v1.5.0` and `runner-v1.6.2` or later. An older Collector cannot communicate with Docker Engine 29 at all, and because it needs Docker in order to update itself, it cannot recover on its own. You would have to reinstall it by hand.
> 
> Check the versions first, as described in [Checking which version is running](#checking-which-version-is-running).

Docker Engine and the tools that drive it agree on an API version when they connect. Newer Docker Engine releases stop supporting older API versions, which is why a Collector older than your Docker Engine can lose the ability to talk to it.

Once the Collector is up to date, upgrading Docker Engine in place is supported. The daemon and runner containers restart automatically afterwards.

1.  **Confirm the Collector is up to date.** Check that the daemon and runner are running `daemon-v1.5.0` and `runner-v1.6.2` or later. If either is older, reinstall the Collector before you continue.
    
2.  **Check that `DOCKER_API_VERSION` is not set.** This variable pins the Collector to one specific Docker API version. If it is set, the Collector cannot adapt to the upgraded engine and will fail to start. Check both the running container and the host configuration:
    
    ```text
    sudo docker inspect runner --format '{{range .Config.Env}}{{println .}}{{end}}' | grep DOCKER_API_VERSION
    sudo grep -r DOCKER_API_VERSION /etc/environment /etc/profile.d/ /etc/systemd/system/docker.service.d/ 2>/dev/null
    ```
    
    No output from either command means the variable is not set, and you can continue. If either command prints a line, remove `DOCKER_API_VERSION` from the file it names and from the installer command, then reinstall the Collector.
    
3.  **Upgrade Docker Engine** using the [instructions for your host OS](https://docs.docker.com/engine/install/).
    
4.  **Confirm the Collector recovered.** After the Docker service restarts, check that both containers are running again:
    
    ```text
    sudo docker ps
    ```
    
    The Collector returns to "Active" in **Integrations > Collectors** within a few minutes.
    

> **NOTE**
> 
> Restarting the Docker service stops any integration job that is running at that moment, and that job is reported as failed. The job runs again normally at its next scheduled interval. To avoid a failed job, upgrade Docker Engine between scheduled integration runs.

## Podman Container Runtime

If you prefer to use `podman` instead of Docker, follow these steps:

1.  Install the `podman-docker` and `podman-remote` packages:

```text
sudo dnf install -y podman-docker podman-remote
```

2.  Enable the podman socket:

```text
sudo systemctl enable --now podman.socket
```

3.  Create the JupiterOne configuration directory:

```text
sudo mkdir -p /etc/.j1config/
```

4.  Use the installer command, replacing `docker` with `podman` and adding the `--privileged` flag:

```text
sudo podman run --privileged -e JUPITERONE_AUTH_TOKEN='...' -e JUPITERONE_COLLECTOR_ID='...' -e JUPITERONE_ACCOUNT_ID='...' -e JUPITERONE_API_BASE_URL='...' -v /etc/.j1config:/etc/.j1config -v /var/run/docker.sock:/var/run/docker.sock ghcr.io/jupiterone/collector-scripts/installer:latest
```

> **CAUTION**
> 
> The `--privileged` flag is required to allow the collector to manage the container runtime when using `podman`. Review the security implications of running the collector with these privileges.

## Removing a Collector

1.  Remove the collector from the JupiterOne console using the "Delete Collector" option.
2.  On the collector host machine, stop and remove the collector daemon and runner containers. See [Reinstalling the Collector](#reinstalling-the-collector) for the commands.

If you try deleting a collector that has integrations configured you will see a message like the following:

![Removing a JupiterOne Collector](/assets/images/remove-collector-63d06a577a5a9cefa985a57abbb23e43.png)

## Troubleshooting

### The Collector stops working after a Docker Engine upgrade

If integration jobs start failing and the Collector no longer shows as Active in **Integrations > Collectors** after Docker Engine has been upgraded, this usually means Docker was upgraded before the Collector was. Reinstalling the Collector resolves it.

To confirm, check the runner logs:

```text
sudo docker logs runner
```

If that reports `No such container`, the container has a different name on this host. List the Collector's containers and use the name shown:

```text
sudo docker ps -a --format 'table {{.Names}}\t{{.Image}}' | grep collector-scripts
```

An error similar to the following means the Collector is older than the Docker Engine now installed on this host:

```text
Error response from daemon: client version 1.41 is too old.
Minimum supported API version is 1.44, please upgrade your client to a newer version
```

The Collector cannot update itself in this state, so reinstall it manually.

First list the Collector's containers. They are the ones whose image name contains `collector-scripts`:

```text
sudo docker ps -a --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}' | grep collector-scripts
```

Then remove them by the names shown in the first column, for example:

```text
sudo docker rm -f runner daemon
```

> **CAUTION**
> 
> Remove only the container names that the command above listed. Do not match on the words "runner" or "daemon" on their own, because your own containers may have names that contain them.

Then re-run the installer command from **Integrations > Collectors**.

If the error persists, confirm that `DOCKER_API_VERSION` is not set, as described in [Upgrading Docker Engine](#upgrading-docker-engine).

### The runner or daemon container does not start

If a stopped `daemon` or `runner` container is left on the host, a new container cannot be created with the same name, and you will see an error similar to:

```text
Conflict. The container name "/runner" is already in use
```

Remove the stopped containers, then re-run the installer command from **Integrations > Collectors**.

First list the Collector's containers. They are the ones whose image name contains `collector-scripts`:

```text
sudo docker ps -a --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}' | grep collector-scripts
```

Then remove them by the names shown in the first column, for example:

```text
sudo docker rm -f runner daemon
```

> **CAUTION**
> 
> Remove only the container names that the command above listed. Do not match on the words "runner" or "daemon" on their own, because your own containers may have names that contain them.

## Known Limitations

-   Unable to migrate integration jobs between collectors.
-   Integration jobs may run in parallel if multiple jobs are assigned.
-   Limited high availability (single node).

---

Source: /integrations/development/collector/kubernetes

# Kubernetes based Collector

The JupiterOne Integration Operator is a Kubernetes-native solution for running JupiterOne integrations within your Kubernetes cluster. It manages Custom Resource Definitions (CRDs) for integration management and provides a scalable approach for organizations already using Kubernetes.

## Prerequisites

### Cluster Requirements

-   Kubernetes 1.16+
-   Helm 3+

### JupiterOne Requirements

-   **Account ID** — found at `/settings/account-management`
-   **API Token** — create one at `/settings/account-api-tokens` or `/settings/api-tokens` with the following permissions. If using a personal token (`/settings/api-tokens`), your user account must have these permissions assigned.

| Permission | Required | When |
| --- | --- | --- |
| **Collector** Create/Read/Update/Delete | Yes | Always |
| **Shared: Graph Data** Read/Write | Yes | Always |
| **Integration** Create/Read/Update/Delete | No | Only if creating Integrations via Helm |

Permission screenshots

![Set kubernetes collector permissions](/assets/images/kubernetes-collector-perm-f039c69a98394bba48d331d94d147993.png)

![Set kubernetes data graph permissions](/assets/images/kubernetes-data-graph-perm-5a90a547e0a719e3d9a681b976013d83.png)

![Set kubernetes integration permissions](/assets/images/kubernetes-integration-perm-756800c96ba053678b5add727c2ef30a.png)

## Installation

Installation is handled by two helm charts

1.  **Kubernetes Operator** This chart installs the controllers that manage the CRDs. This chart can be upgraded independently of the Integration Runner.
2.  **Integration Runner** This chart installs a Custom Resource `integrationrunner` that tells the operator to create a new collector and register with JupiterOne.

### Kubernetes Operator

First, we need to install the operator which manages all the CRDs.

1.  **Add the JupiterOne Helm Repository**:
    
    ```bash
    helm repo add jupiterone https://jupiterone.github.io/helm-charts
    helm repo update
    ```
    
2.  **Create a Namespace**:
    
    ```bash
    kubectl create namespace jupiterone
    ```
    
3.  **Install the Integration Operator**:
    
    ```bash
    helm install integration-operator jupiterone/jupiterone-integration-operator --namespace jupiterone
    ```
    

### Integration Runner

To install the Integration runner, you need to provide your API token. You can choose from two options for managing the API token secret:

> **NOTE**
> 
> The runner will create a Collector with the same name.

This is the simplest method. The Helm chart will automatically create a Kubernetes Secret in the same namespace with your API token.

**Parameters:**

-   `runnerName`: The name of the Runner.
-   `apiToken`: Your API token. This will be created as a Secret in Kubernetes.
-   `accountID`: Your JupiterOne Account ID.
-   `jupiterOneEnvironment` (_optional_): The JupiterOne environment. This defaults to `us`. This can be found by inspecting the URL when accessing the UI such as `<environment>.jupiterone.io`.

**Installation command:**

```bash
helm install <runnerName> jupiterone/jupiterone-integration-runner --namespace jupiterone --set apiToken=<apiToken> --set accountID=<accountID>
```

This method references an existing Kubernetes Secret instead of creating one. Use this option if you manage secrets using external processes such as Sealed Secrets, External Secrets Operator, or other secret management tools.

> **NOTE**
> 
> The Secret _must_ have a key of `token` in order to work properly.

**Parameters:**

-   `runnerName`: The name of the Runner.
-   `secretAPITokenName`: The name of the existing Kubernetes Secret.
-   `accountID`: Your JupiterOne Account ID.
-   `createSecret`: Must be set to `false` so the Helm chart does not attempt to create the Secret.
-   `jupiterOneEnvironment` (_optional_): The JupiterOne environment. This defaults to `us`. This can be found by inspecting the URL when accessing the UI such as `<environment>.jupiterone.io`.

**Installation command:**

```bash
helm install <runnerName> jupiterone/jupiterone-integration-runner --namespace jupiterone --set createSecret=false --set secretAPITokenName=<tokenName> --set accountID=<accountID>
```

## Verification

After installation, the runner should register with JupiterOne within 30 seconds.

```bash
kubectl get integrationrunner -n jupiterone
```

Expected output:

```bash
NAME     STATE     DETAIL   REGISTRATION   AGE
runner   running            registered     2m38s
```

## Reading Secrets from AWS Secrets Manager

By default, the runner API token and integration configuration are read from Kubernetes Secrets. If you run on AWS, you can instead source them from **AWS Secrets Manager** so that credentials never live in the cluster or in Git.

Two credentials support this:

-   **Runner API token** — set `apiTokenSource` on the `IntegrationRunner`.
-   **Integration configuration** — set `secretSource` on the `IntegrationInstance`.

Both are backward compatible with the existing `secretAPITokenName` / `secretRef` fields, which continue to reference Kubernetes Secrets. The new fields take precedence when both are set, so existing installations are unaffected.

### Secret format

The value stored in AWS Secrets Manager must be a JSON object.

-   For the **API token**, include a `token` key:
    
    ```json
    { "token": "<your-jupiterone-api-token>" }
    ```
    
-   For **integration configuration**, each key/value is merged into the integration config (overriding matching keys in `config`):
    
    ```json
    { "clientId": "abc", "clientSecret": "s3cret" }
    ```
    

### Granting the operator access

The operator loads AWS credentials from the default credential chain. On EKS, the recommended approach is [IRSA](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html): associate the operator's ServiceAccount with an IAM role by adding an annotation.

```bash
kubectl annotate serviceaccount -n jupiterone <operator-service-account> \
  eks.amazonaws.com/role-arn=arn:aws:iam::<account-id>:role/<role-name>
```

The role needs, at minimum, `secretsmanager:GetSecretValue` on the referenced secrets (and `kms:Decrypt` on the KMS key if the secret is encrypted with a customer-managed key):

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "secretsmanager:GetSecretValue",
      "Resource": "arn:aws:secretsmanager:*:<account-id>:secret:jupiterone/*"
    }
  ]
}
```

### Example: runner API token

```yaml
apiVersion: integrations.jupiterone.io/v1
kind: IntegrationRunner
metadata:
  name: runner
  namespace: jupiterone
spec:
  accountId: <account-id>
  syncIntervalSeconds: 30
  apiTokenSource:
    provider: awsSecretsManager
    awsSecretsManager:
      secretId: arn:aws:secretsmanager:us-east-1:123456789012:secret:jupiterone/api-token
```

### Example: integration configuration

```yaml
apiVersion: integrations.jupiterone.io/v1
kind: IntegrationInstance
metadata:
  name: my-integration
  namespace: jupiterone
spec:
  collectorName: runner
  integrationDefinitionName: <integration>
  config:
    nonSensitiveValue: "example"
  secretSource:
    provider: awsSecretsManager
    awsSecretsManager:
      secretId: jupiterone/my-integration-creds
```

### Fields

Both `apiTokenSource` and `secretSource` share the same shape:

| Field | Required | Description |
| --- | --- | --- |
| `provider` | Yes | `awsSecretsManager` or `kubernetes`. |
| `awsSecretsManager.secretId` | Yes (for `awsSecretsManager`) | ARN or name of the secret. |
| `awsSecretsManager.region` | No | AWS region of the secret. Defaults to the operator's region. |
| `awsSecretsManager.versionStage` | No | Version stage to retrieve. Defaults to `AWSCURRENT`. |
| `kubernetes.name` | Yes (for `kubernetes`) | Name of the Kubernetes Secret, in the same namespace. |

> **NOTE**
> 
> Resolved values are cached in-memory to avoid calling AWS Secrets Manager on every reconcile. The cache duration is controlled by the operator's `ASM_CACHE_TTL_SECONDS` environment variable (default `60`; set to `0` to disable caching).

> **NOTE**
> 
> For an `IntegrationInstance`, the resolved configuration is sent to JupiterOne when the integration instance is created, so it is also stored server-side. AWS Secrets Manager keeps the secret out of your cluster and Git; it is not end-to-end encryption.

## Private Registry Configuration

If your organization uses a private registry proxy, runs an air-gapped environment, or requires all container images to pass through security-scanned registries that mirror images from `ghcr.io`, you can configure the JupiterOne Integration Operator to pull integration job images from your private registry.

### Prerequisites

Before configuring the operator for private registry support, create a Docker registry secret in the `jupiterone` namespace so that pods can authenticate against your private registry.

```bash
# Create a Docker registry secret in the jupiterone namespace
kubectl create secret docker-registry my-registry-secret \
  --namespace jupiterone \
  --docker-server=myregistry.example.com \
  --docker-username=<username> \
  --docker-password=<password>
```

```bash
# Verify the secret was created
kubectl get secret my-registry-secret -n jupiterone
```

> **NOTE**
> 
> The secret must exist in the `jupiterone` namespace where the operator runs. If you use external secret management tools (such as Sealed Secrets or External Secrets Operator), ensure the secret is synced to the `jupiterone` namespace.

### Configuration

You can configure private registry support using `--set` flags:

```bash
helm install integration-operator jupiterone/jupiterone-integration-operator \
  --namespace jupiterone \
  --set controllerManager.imageRegistry=myregistry.example.com \
  --set 'controllerManager.imagePullSecrets[0].name=my-registry-secret'
```

Or via a values file:

```yaml
controllerManager:
  imageRegistry: "myregistry.example.com"
  imagePullSecrets:
    - name: my-registry-secret
```

**What these values do:**

-   **`controllerManager.imageRegistry`** — Overrides the default `ghcr.io` registry for integration job images. Images are pulled as `<registry>/jupiterone/graph-<integration>:latest`.
-   **`controllerManager.imagePullSecrets`** — Applied to both the operator pod and all spawned integration job pods so they can authenticate against the private registry.
-   **`controllerManager.disableImageSignatureCheck`** — Disables cosign image signature verification entirely. See [Image Signature Verification](#image-signature-verification) below for when this is needed.

### Image Signature Verification

The operator verifies the cosign signature of each integration image before running it. When a private registry is configured, the operator uses the following verification strategy:

1.  **Try the configured registry first** — if your private registry mirrors cosign signatures, verification succeeds immediately.
2.  **Fall back to `ghcr.io`** — if signature verification fails against the private registry (for example, because cosign signatures are not replicated), the operator automatically retries verification against the original `ghcr.io` image reference where signatures are published.
3.  **Fail only if both checks fail** — the image is rejected only when neither the private registry nor `ghcr.io` can provide a valid signature.

This means you do **not** need to mirror cosign signatures to your private registry, as long as the operator has network access to `ghcr.io` for signature verification.

#### Disabling signature verification

If your environment does not allow egress to `ghcr.io` and you do not mirror cosign signatures to your private registry, you can disable signature verification:

```bash
helm install integration-operator jupiterone/jupiterone-integration-operator \
  --namespace jupiterone \
  --set controllerManager.imageRegistry=myregistry.example.com \
  --set 'controllerManager.imagePullSecrets[0].name=my-registry-secret' \
  --set controllerManager.disableImageSignatureCheck=true
```

Or via a values file:

```yaml
controllerManager:
  imageRegistry: "myregistry.example.com"
  imagePullSecrets:
    - name: my-registry-secret
  disableImageSignatureCheck: true
```

### Verify Private Registry Configuration

After installation, check that the operator pod is running and pulling images from the correct registry:

```bash
kubectl get pods -n jupiterone
kubectl describe pod -n jupiterone -l control-plane=controller-manager | grep Image
```

## Resource Requests and Limits for Integration Jobs

Many enterprise Kubernetes clusters enforce resource policies using [Kyverno](https://kyverno.io/), [OPA/Gatekeeper](https://open-policy-agent.github.io/gatekeeper/), or similar admission controllers. These policies often require all containers to declare CPU and memory requests and limits. By default, integration job containers created by the operator do not include resource requirements, which may cause job creation to be blocked by such policies.

### Configuration

Configure resource requests and limits for integration job containers using `--set` flags:

```bash
helm install integration-operator jupiterone/jupiterone-integration-operator \
  --namespace jupiterone \
  --set controllerManager.jobResources.requests.cpu=100m \
  --set controllerManager.jobResources.requests.memory=256Mi \
  --set controllerManager.jobResources.limits.cpu=1 \
  --set controllerManager.jobResources.limits.memory=1Gi
```

Or via a values file:

```yaml
controllerManager:
  jobResources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: "1"
      memory: 1Gi
```

When `jobResources` is not set, no resource requirements are applied to integration job containers (the default behavior).

### Verifying

After configuring job resources, trigger an integration run and inspect the created Job:

```bash
kubectl get jobs -n jupiterone -o yaml | grep -A 10 resources
```

### Troubleshooting Job Creation Failures

If integration jobs are not being created, check the `IntegrationInstanceJob` status:

```bash
kubectl get integrationinstancejobs -n jupiterone
```

The `JobCreated` column shows whether the Kubernetes Job was created. If it shows `FAILED`, inspect the full status for the error:

```bash
kubectl get integrationinstancejob <name> -n jupiterone -o jsonpath='{.status}'
```

Common causes:

-   **Admission webhook rejection** — configure `jobResources` to satisfy cluster resource policies.
-   **Image pull failures** — check `imagePullSecrets` configuration.

## Assigning an Integration

Assigning an integration job to a collector first requires that there are collectors registered and available. Once collectors are available, the process for defining an integration job and assigning it to a collector is straightforward.

For integrations that are collector compatible, complete the integration configuration as normal. During configuration, you'll notice there's an additional option to choose where the integration should run.

Select **Collector** on the integration instance, and choose the corresponding collector for which you'd like the integration to run.

![Choosing run on Collector within the JupiterOne integration instance configuration](/assets/images/integration-location-caff09d6752d5364027ed190220e03c0.png)

You may also choose to setup an integration by using a helm chart. This is supported through the Custom Resource Definition `integrationinstance` which is installed as part of the Kubernetes Operator.

Integrations that support this method will have documentation on how to set this up. See the [Kubernetes Managed integration](/integrations/directory/kubernetes-managed.md) for an example.

## Updating the Operator

To update to the latest version:

```bash
helm repo update
helm upgrade integration-operator jupiterone/jupiterone-integration-operator --namespace jupiterone
```

## Uninstalling

To remove the operator:

```bash
helm uninstall <runnerName> --namespace jupiterone
helm uninstall integration-operator --namespace jupiterone
kubectl delete namespace jupiterone
```

## Multiple Clusters

Multiple Kubernetes clusters are supported by installing the JupiterOne Integration Operator and Integration Runner Helm charts on each cluster. Each cluster is managed independently by the operator running within that cluster.

To set up multiple clusters:

-   Repeat the installation steps for each cluster where you want to run collectors.
-   Each cluster will have its own Integration Runner and Integration(s) managed separately.

You may use automation tools such as **ArgoCD**, **Flux**, or other GitOps solutions to automate and manage Helm chart deployments across your clusters. This allows you to keep your collector deployments consistent and up to date in all environments.

> **NOTE**
> 
> Each collector is registered independently with JupiterOne, and integration jobs can be assigned to collectors in any cluster as needed.

## ArgoCD

You may use ArgoCD to automate Helm chart deployments in your clusters. The following are example ArgoCD Applications setting up the Integration Operator and Integration Runner.

> **NOTE**
> 
> You may find the current version of the Integration Operator and the Integration Runner by searching the helm repository.
> 
> ```bash
> helm repo update
> helm repo search jupiterone
> ```

### Integration Operator

Replace `<version>` with the version you would like to install.

```yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: jupiterone-integration-operator
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://jupiterone.github.io/helm-charts
    chart: jupiterone-integration-operator
    targetRevision: <version>
  destination:
    namespace: jupiterone
    server: https://kubernetes.default.svc
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
```

### Integration Runner

Replace the `<version>`, `<account-id>` and `<environment>` with your own values.

```yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: jupiterone-integration-runner
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://jupiterone.github.io/helm-charts
    chart: jupiterone-integration-runner
    targetRevision: <version>
    helm:
      values: |
        secretAPITokenName: j1token
        createSecret: false
        accountID: <account-id>
        jupiterOneEnvironment: <environment>
  destination:
    namespace: jupiterone
    server: https://kubernetes.default.svc
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
```

### Integration Instance

You may also setup certain Integrations with Helm charts which are then supported in ArgoCD. Here is an example of setting up the Kubernetes Managed Integration. Replace `<version>` with the value from the latest chart.

```yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: kubernetes-managed
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://jupiterone.github.io/helm-charts
    chart: kubernetes-managed
    targetRevision: <version>
    helm:
      values: |
        collectorName: runner
        pollingInterval: ONE_WEEK
  destination:
    namespace: jupiterone
    server: https://kubernetes.default.svc
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
```

## Troubleshooting

If pods are not starting or integrations are not running:

-   Check pod logs: `kubectl logs -n jupiterone <pod-name>`
-   Verify CRDs are present: `kubectl get crd | grep jupiterone`
-   Double-check authentication credentials
-   Ensure network connectivity to JupiterOne services

## Known Limitations

-   Unable to migrate integration jobs between collectors.
-   Integration job distribution across multiple pods is still being enhanced.
-   Some integrations may not be compatible with collectors.

---

Source: /integrations/development/custom-definitions

# Custom Definitions

A **custom definition** lets you describe an integration that JupiterOne doesn't ship out of the box and run it against your own data — a SaaS provider with no managed integration, an on-premise application, or a proprietary internal tool. You define the metadata once, then create one or more instances that execute on a schedule or push data on demand.

## Definition, instance, and job

These three terms appear throughout the rest of this section. They describe the same integration at three different layers:

-   **Definition** — the _template_. Holds metadata describing the integration: name, type, class, the configuration fields a user must fill in (`configFields`), the authentication fields (`authSections`), the ingestion sources it produces, and the platform features it relies on. A definition is created once and reused.
-   **Instance** — a configured _deployment_ of a definition. An instance binds a definition to specific credentials, a polling interval, an account name, and (optionally) a Collector. One definition can have many instances.
-   **Job** — a single _execution_ of an instance. Each scheduled run, or each manual trigger, is a job. Jobs produce the entities and relationships you see in JupiterOne.

## When to use a custom definition

Reach for a custom definition when:

-   The provider has no JupiterOne managed integration and you need recurring data ingestion.
-   The system is on-premise or behind a firewall and the runner must live inside your network.
-   You're integrating a proprietary or internally-built tool whose API only your team can access.

## Ingestion options

A custom definition supports two ingestion paths. You pick one when you create the definition; you can change later without re-authoring.

| Option | Use when | Continue with |
| --- | --- | --- |
| **Custom File Transfer (CFT)** | Your data is already exported to CSV. Upload files directly; no runner, no API calls. | [Custom File Transfer](/integrations/development/custom-file-transfer.md) |
| **Custom instance** | You'll write code that pushes data to JupiterOne via the Sync API, using the instance's API key. Run that code wherever you want — CI, cron, event handler, on-prem host. | [Custom integration: Code + Sync API](/integrations/development/custom-instance.md) |

## Author a custom definition

To create a custom definition in the JupiterOne app:

1.  Navigate to **Custom Definitions**.
2.  Click **New Custom Definition**.
3.  Fill in the form:
    -   **Icon** — pick or upload an icon shown in the integrations list.
    -   **Integration Name** — display name for this custom integration.
    -   **Integration Type** — autofills from the Integration Name with your account alias appended as a suffix (for example `my-integration-acme`). This is the type string queries and downstream tools see.
    -   **Documentation URL** _(optional)_ — link to your team's docs or the upstream vendor's docs for the data source.
    -   **Description** _(optional)_.
    -   **Category** _(optional)_ — choose from the dropdown.
    -   **Type of custom definition** — pick one:
        -   **CFT** — the definition is set up for [Custom File Transfer](/integrations/development/custom-file-transfer.md). Follow the CFT upload flow after creating.
        -   **Custom instance** — JupiterOne creates a new instance and a new API key. Use the API key + instance ID from your code to push data via the Sync API. See [Custom integration: Code + Sync API](/integrations/development/custom-instance.md).
4.  Click **Create**.

## What's next

[

![](/icons/illustrations/cloud-upload.svg)![](/icons/illustrations/cloud-upload.svg)

Custom File Transfer (CFT)

Upload assets and relationships as CSV files; JupiterOne tracks each upload as an instance of your custom definition.





](/integrations/development/custom-file-transfer.md)[

![](/icons/illustrations/gear.svg)![](/icons/illustrations/gear.svg)

Custom integration: Code + Sync API

Write code that pushes entities and relationships to JupiterOne via the Sync API, using the API key generated for your custom instance.





](/integrations/development/custom-instance.md)

---

Source: /integrations/development/custom-file-transfer

# Custom File Transfer (CFT)

Custom File Transfer is one of the ingestion options you can choose **after** creating a [Custom definition](/integrations/development/custom-definitions.md). Use it when your data is already exported to CSV — JupiterOne ingests the file directly and manages that data via an instance of your Custom definition.

Leverage JupiterOne's Custom File Transfer to ingest assets into JupiterOne and designate the asset's relationships prior to uploading. This integration allows you to import a batch of assets and relationships via CSV file and track and manage each upload within the integration's instances.

You will need to have your assets and relationships in CSV format, and there is a size limitation of 100MB per file. For larger uploads, see our [API documentation](/reference.md).

## CSV File Requirements

To ensure data is correctly ingested, please consider the following:

-   The first row in the CSV must be headers. These headers will be used as the property values for the final entity.
-   We encourage the use of **camelCasing** for headers for consistency with other data in your graph.
-   We encourage the use of **Data Type Tokens** to improve query-ability of your data (see below for more details).
-   If a blank or whitespace header is provided, it will be replaced by `idxN` where N is the numerical index of that column.
-   The number of values in each row must match the number of headers provided on the first row. A mismatch will result in an error.
-   All empty (`,,`) and blank (`,"",`) values will be replaced with `undefined` to improve query-ability of your data.
-   Whitespace (`" "` or `, ,`) values will be maintained.

### Data Type Tokens (optional)

In order for the integration to successfully identify different types of data, the column headers can optionally include a token to identify the columns data type. By providing these data type tokens, JupiterOne will store the data in the correct format allowing for advanced J1QL queries to be written.

#### Supported Data Type Tokens:

-   **\[datetime\]**: With the `[datetime]` token present in the header, **all valid ISO** dates will be parsed and stored ready for queries as a date. To ensure dates are displayed correctly in the JupiterOne app, column header names should end in `On`. Parsed dates will allow queries such as `FIND approvals WITH approvedOn < Date.now - 30days`
-   **\[boolean\]**: With the `[boolean]` token present in the header, the following values will be parsed as true: `true`, `1`, `on`, `yes`. **All other values will be considered** `false`. Parsed booleans will allow for queries such as `FIND approvals WITH approved = true`
-   **\[number\]**: With the `[number]` token present in the header, all valid numbers (int, decimal, negative) will be parsed as a number. If a value is not a number, the value will remain unparsed. Parsed numbers will allow queries such as `FIND approvals WITH count > 50`
-   **\[stringList\]**: When the `[stringList]` token is included in a column header, the corresponding cell value will be split into an array of strings using a comma (`,`) as the delimiter. If no commas are found, the result will be a single-element array containing the entire string.
    -   It is recommended to enclose the full list of comma-separated values in double quotes (`"`). This ensures the list is interpreted as a single CSV field and parsed correctly.
        
    -   For example, if you have an entity property named `webUrls[stringList]`, you can specify the values in the CSV like this:
        
        -   ✅ **Correct:** `"https://www.j1.com,https://www.j1.io"`
        -   ❌ **Incorrect:** `"https://www.j1.com","https://www.j1.io"`

> **NOTE**
> 
> Adding a Data Type Token to the column header name that uniquely identifies each row is **not** supported. The value entered as the **Entity Key Property** should exactly match the value found in the CSV.

##### Example walkthrough

Starting CSV:

```plaintext
id,createDate,description,approvedOn,approved,count,weekdays
1,01/01/2024,Granted access to fix the issue,01/01/2024,true,100,"monday,tuesday"
2,02/11/2014,Test access granted,02/11/2014,testBool,100,"tuesday,wednesday"
```

In this example, `createDate` and `approvedOn` are both dates. `id` and `count` are both numbers. `approved` is a boolean. `id` will not be considered a number, it will be used as the **Entity Key Property** which is explained later in this document.

For the integration to identify them as their appropriate data type, add the data type tokens to the applicable header. For example, `createDate` becomes `createDate[datetime]`.

Tips: Add the data type token after the column header name. For timestamps, renaming the column to end with `On` is preferable for best display support in the JupiterOne app and more consistent with the JupiterOne data model. So for example, `createDate` becomes `createdOn`.

Example with Data Type Tokens:

```plaintext
id,createdOn[datetime],description,approvedOn[datetime],approved[boolean],count[number],weekdays[stringList]
1,02/11/2014,Granted access to fix the issue,02/11/2014 11:30:30,true,100,"monday,tuesday"
2,02/11/2014,Test access granted,02/11/2014,testBool,100,"tuesday,wednesday"
```

Ensure that the date time values are in a valid ISO 8601 format:

```plaintext
id,createdOn[datetime],description,approvedOn[datetime],approved[boolean],count[number],weekdays[stringList]
1,2014-02-11Z,Granted access to fix the issue,2014-02-11T11:30:30Z,true,100,"monday,,tuesday"
2,2014-02-11Z,Test access granted,2014-02-11Z,testBool,100xx,"tuesday,wednesday,"
```

Below is an example of the resulting entities post-processing. If a value is not successfully parsed for the given data type, the value will remain in its original format. The data type token will be removed prior to use as a property name.

```json5
[
  {
    "id": 1,
    "createdOn": 1392076800000, // unix epoch timestamp, will be displayed correctly as ISO timestamp in JupiterOne.
    "description": "Granted access to fix the issue",
    "approvedOn": 1392118230000,
    "approved": true,
    "count": 100,
    "weekdays": ['monday', 'tuesday']
  },
  {
    "id": 2,
    "createdOn": 1392076800000, // unix epoch timestamp, will be displayed correctly as ISO timestamp in JupiterOne.
    "description": "Test access granted",
    "approvedOn": 1392118230000,
    "approved": false, // testBool was parsed as false
    "count": "100xx", // was not parsed
    "weekdays": ['tuesday', 'wednesday']
  }
]
```

## Configuring the integration

Navigate to the **Integrations** tab in JupiterOne and select Custom File Transfer. Click **New Instance** to begin configuring the integration.

For this integration, you will need to have your CSV dataset ready to imported.

### Creating a Custom File Transfer instance

Provide the following when creating an instance for your custom file transfer:

-   The **Account Name** used to identify the account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   Enter the **Dataset Name**. For the first example data set, use: EuropaUsers
    
-   Define the **Entity Key Property**. This is found in the data file. For CSVs, it is the column header. This value should be unique across the entire dataset. Adding a Data Type Token to this column header is not supported.
    
-   Add the **Entity Type**. This will identify the specific type of entity to be created.
    
-   Select the **Entity Class**. This value represents the class of data found in the dataset.
    

> **INFO**
> 
> For more information about JupiterOne `_type` and `_class` values, see our [JupiterOne data model](/data-model/jupiterone-data-model.md).

At this point, the integration is able to upload and ingest the defined dataset into your account. Press **Create** to create the instance and upload your CSV file.

If you wish to add additional datasets, press the **Add Dataset** button.

Additionally, you can add **Direct** and **Mapped Relationships** by selecting the respective **Add relationship** button. You can find additional information on adding relationships below.

#### Adding another data set:

-   Enter the **Dataset Name**, the **Entity Key Property**, and **Entity Type**.
    
-   Select the **Entity Class**.
    

### Defining Relationships

When uploading your file, you can define two kinds of relationships for each dataset:

-   **Direct relationships** connect entities from **datasets in the same Custom File Transfer instance**. Both the source and the target are created from CSV files you upload to this integration — for example, linking Europa Users to Europa User Groups by matching `GroupId` to `Id`.
    
-   **Mapped relationships** connect entities from your CSV upload to entities that **already exist in your JupiterOne account from a different integration**. You do not need to know the target entity's internal key; you describe how to find it by matching a property value — for example, linking Europa Users (from your HR CSV) to ServiceNow CMDB objects (already ingested by the ServiceNow integration) by matching on a manager email property.
    

Common mapped relationship examples elsewhere in JupiterOne include `(Host | Device) -HAS-> Finding`.

#### To define direct relationships:

Press **Add Relationship** under **Direct Relationships** and provide the following:

-   The **Source Property**. The source property indicates what value in the dataset references the target dataset.
-   The **Relationship Class**
-   The **Target Dataset Name**. **This needs to exactly match the inputted value for the target Dataset Name**.
-   The **Target Property**. The target property indicates what value in the dataset that should be referenced by the source dataset.

#### Define Mapped Relationships

A **mapped relationship** is a relationship between two entities that are **not created from the same integration**. Use mapped relationships when your CSV defines one side of the link and the other side already lives in the graph from another data source.

Mapped relationships can have a **FORWARD** or **REVERSE** direction. The direction determines which entity is the **source** and which is the **target** — the relationship arrow always points **from the source to the target**. Both a FORWARD and a REVERSE relationship can exist between the same two entity types when the use case calls for it.

| Direction | Meaning |
| --- | --- |
| **FORWARD** | Source → target |
| **REVERSE** | Target → source (the entity from your CSV is treated as the target) |

When querying mapped relationships in J1QL, use direction arrows to specify which direction you want:

```j1ql
FIND europa_user AS u THAT MANAGES >> service_now_cmdb_object AS c RETURN u.email, c.name LIMIT 10
FIND europa_user AS u THAT MANAGES << service_now_cmdb_object AS c RETURN u.email, c.name LIMIT 10
```

The `>>` syntax returns data for the **FORWARD** direction; `<<` returns data for the **REVERSE** direction.

Using the correct direction when defining mapped relationships in your data **and** when querying them in J1QL can improve query performance by reducing the number of relationship traversals the query engine must evaluate.

##### To define the mapped relationships:

-   Select the **Relationship Class**.
-   Specify the **Direction** (**FORWARD** or **REVERSE**).
-   Enter the **Target Entity Type**.
    
    > **NOTE**
    > 
    > To see what \_types are available in your account, consider running this J1QL query in your account: `FIND * AS e RETURN count(e), e._type`. For this tutorial, use: `service_now_cmdb_object`
    

#### Add Field Mappings

Enter the **Source Property** (a column from your CSV) and **Target Property** (a property on the target entity type in JupiterOne). JupiterOne creates the relationship when the values match.

#### Finalize the integration instance

Click **Create** once all values are provided to finalize the integration. You will then be prompted to upload your CSV files.

## Custom file transfer example

To understand how to set up this integration, the following dataset will be used for a tutorial.

Imagine you want to add **User** and **User Group** data from your HR software, called _Europa_, into JupiterOne.

Here are the two example datasets:

1.  Europa Users (europaUsers.csv)

```text
    Id	Name	Username	Email	GroupId
    1	Jane	jane.c	jane.c@company.com	A
    2	Juan	juan.d	juan.d@company.com	B
    3	Julie	julie.e	julie.e@company.com	C
```

2.  Europa User Groups (europaUserGroups.csv)

```text

    Id	Name
    A	Marketing
    B	Sales
    C	Engineering
```

We can represent both the Europa Users and Europa Groups as assets in the JupiterOne graph.

Further, we can use the native relationship between the Europa Users GroupId property and the Europa Groups Id property to define a direct relationship between the two datasets in this integration.

Finally, we can use the Europa Users `Email` property to define a **mapped relationship** to ServiceNow CMDB objects that already exist in your JupiterOne account from the ServiceNow integration.

#### Define Datasets

-   Enter the Dataset Name as: `EuropaUsers`
-   Enter the **Entity Key Property**. For this tutorial the first column header of the Europa Users dataset we'll use is: `Id`
-   Enter the Entity Type as: `europa_user`.
-   Set the Entity Class as: `User`.

At this point the integration is able to upload and ingest the Europa Users dataset into your account. With the goal of adding Users Groups and relationships, let's keep going:

-   Press the **Add Dataset** button
-   Enter the **Dataset Name**. For the second dataset: `EuropaUserGroups`
-   Enter the **Entity Key Property**. For this tutorial we will use the `Id` column which represents a unique id for each entity.
-   Enter the **Entity Type**. For the second dataset: `europa_user_group`
-   Select the **Entity Class**. For the second: `UserGroup`

Excellent! Both datasets are now defined.

#### Define the direct relationship

The following steps will define the relationship to be built between Users (the source dataset) and User Groups (the target dataset).

User (source) ←HAS→ User Group (target) EuropaUsers.GroupId == EuropaUserGroups.Id

The following steps will build the above relationship:

-   Press **Add Relationship** under **Direct Relationships** and
-   Enter the **Source Property**. For this tutorial, use`GroupId` as the source property. It is found in **EuropaUsers** and references the _Europa User Groups_ dataset.
-   Select the **Relationship Class**. For this tutorial: `Has`
-   Select the **Direction**. For this tutorial: `REVERSE`
-   Enter the **Target Dataset Name**. For this tutorial: `EuropaUserGroups`
-   Enter the **Target Property**. For this tutorial, `Id` is the target property, found in **EuropaUserGroups**. Enter `Id` for this field.

#### Define Mapped Relationship

The following steps define a mapped relationship between `europa_user` entities (from your CSV) and `service_now_cmdb_object` entities (already in JupiterOne from the ServiceNow integration).

**Before — CSV input (EuropaUsers dataset):**

```text
Id  Name  Username  Email                  GroupId
1   Jane  jane.c    jane.c@company.com     A
2   Juan  juan.d    juan.d@company.com     B
```

**Configuration:**

-   Select the **Relationship Class**. For this tutorial, use: `Manages`
-   Select the **Direction**. For this tutorial, use: `FORWARD` (each Europa User is the source; the matched CMDB object is the target)
-   Enter the **Target Entity Type**. For this tutorial, use: `service_now_cmdb_object`

**Add Field Mappings:**

-   **Source Property**: `Email` (column from your Europa Users CSV)
-   **Target Property**: `managerEmail` (property on existing ServiceNow CMDB objects that stores the manager's email address)

**After — resulting relationship in the graph:**

For each Europa User row, JupiterOne looks up an existing `service_now_cmdb_object` whose `managerEmail` matches the CSV `Email` value and creates a relationship:

```text
europa_user (Jane, jane.c@company.com) -MANAGES-> service_now_cmdb_object (Production Server, managerEmail: jane.c@company.com)
europa_user (Juan, juan.d@company.com) -MANAGES-> service_now_cmdb_object (Staging Database, managerEmail: juan.d@company.com)
```

If no matching ServiceNow CMDB object exists for a given email, no relationship is created for that row.

You can verify the results with J1QL:

```j1ql
FIND europa_user AS u THAT MANAGES >> service_now_cmdb_object AS c RETURN u.name, u.email, c.name LIMIT 10
```

And that's it! Click **Create** to finalize the integration instance and upload the CSV files.

### Using `stringList` for Mapped Relationships

In cases where your **Source Property** contains a **comma-separated list of values**, you can enable **multiple mapped relationships** by using the `[stringList]` data type token.

When the **Source Property** includes the `[stringList]` token in its header (e.g., `owners[stringList]`), the integration will automatically create **one mapped relationship per item** in the list.

#### Example

If your dataset contains a field like this:

```csv
owners[stringList]
id-123,id-456,id-789
```

And you've mapped it to a **Target Property** like `ownerId`, JupiterOne will create three mapped relationships, one for each value (`id-123`, `id-456`, `id-789`).

This will result in relationships like:

-   **Entity A HAS → ownerId: id-123**
-   **Entity A HAS → ownerId: id-456**
-   **Entity A HAS → ownerId: id-789**

This is useful when an entity is related to multiple targets and you want each relationship represented individually in your graph.

#### ⚠️ Important Clarification

When defining **Mapped Relationships** in the integration UI, ensure that the **Source Property** field matches **exactly** the name used in your CSV header, including the data type token.

For example:

-   If your CSV header is `owners[stringList]`, you **must** enter `owners[stringList]` as the **Source Property** when creating the mapped relationship in the UI.
    
-   If it doesn't appear in the dropdown list, make sure to select `Add custom option` and manually enter the source property name with the `[stringList]` suffix exactly as it appears in the CSV header.
    
-   Omitting the `[stringList]` suffix in the UI (e.g., using just `owners`) will prevent the system from correctly identifying the data type, which may cause issues.
    

This ensures that the integration correctly interprets the data type and processes the relationships as expected.

### Next steps

Now that your integration instance has been configured, it will begin running the transfer, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

---

Source: /integrations/development/custom-instance

# Custom integration: Code + Sync API

Pick **Custom instance** when you create a [Custom Definition](/integrations/development/custom-definitions.md) and want to feed data into JupiterOne with code you own. JupiterOne creates the instance and a fresh API key — your code pushes entities and relationships against that instance via the [Sync API](/api/sync-jobs/api-reference.md). The runner can live anywhere with outbound HTTPS to JupiterOne: a CI job, a cron'd container, an event handler, an on-prem host.

## What you get from JupiterOne

After you save the definition with **Custom instance** selected, JupiterOne issues:

-   **Instance ID** — a UUID identifying this instance. Pass as `integrationInstanceId` on every Sync API call.
-   **API key** — used to authenticate Sync API calls. Treat as a secret; rotate from the instance page if it leaks.

## The ingestion contract

Every ingestion run follows the same three-step flow against the [Sync API](/api/sync-jobs/api-reference.md):

1.  **Start a job** — `POST /persister/synchronization/jobs` with `source: "integration-external"` and `integrationInstanceId: "<your instance id>"`. JupiterOne returns a `jobId`.
2.  **Upload entities and relationships** — `POST .../upload`, `.../entities`, or `.../relationships` against that `jobId`. Repeat as needed for large datasets.
3.  **Finalize** — `POST .../finalize` to commit. JupiterOne reconciles the dataset against the previous run according to the chosen `syncMode`.

A job left un-finalized stays in `AWAITING_UPLOADS` and never reaches your graph. Always finalize.

## Authentication

Send the API key as a bearer token on every Sync API request:

```http
Authorization: Bearer <YOUR_API_KEY>
```

The instance ID is not secret. Rotate the API key from the instance page if it leaks.

## Sync modes

Pick a `syncMode` per job based on what the data represents:

-   **`DIFF`** _(default)_ — replaces the full dataset in scope. Anything you don't re-upload in this job is deleted on finalize. Use for full polls (snapshot of all current resources).
-   **`PATCH`** — updates existing entities only; never creates or deletes. Use for event-driven pushes where you only know about property deltas on entities that already exist.
-   **`CROSS_SCOPE`** — for relationships whose endpoints live in different scopes/instances.
-   **`OVERRIDE`** — pin properties on entities created by another integration.

See the [Sync API reference](/api/sync-jobs/api-reference.md) for the full mode reference.

---

## Entity construction

An **entity** is a node in the JupiterOne graph. Every resource you ingest — a user, a host, an application, a finding — becomes one entity. Get the shape right and your data is queryable next to managed integrations; get it wrong and queries miss it.

### Required fields

Every entity must include these five fields. JupiterOne rejects uploads missing any of them.

| Field | Type | Description |
| --- | --- | --- |
| `_key` | string | Unique identifier within your custom integration. Use the source resource's stable unique ID (UUID, ARN, numeric ID). Keep it minimal — no extra prefixes. Max 7000 characters. |
| `_type` | string | The integration-specific type. Combines a resource name with the integration type from your definition: `<resource>_<integration-type>` (for example `invoice_my-billing-acme`). |
| `_class` | string | string\[\] | One or more standard JupiterOne entity classes (`User`, `Device`, `Application`, `Account`, `Finding`, `Vulnerability`, etc.). Pick the closest match from the [data model](/data-model/jupiterone-data-model.md). |
| `name` | string | Required. Even when redundant with class defaults. |
| `displayName` | string | Required. Human-readable label shown in the UI. |

### Property rules

The platform enforces a small set of rules on the rest of the properties.

-   **Primitives only.** Property values must be `boolean`, `string`, `number`, or arrays of those. No nested objects (except `_rawData`). Flatten nested API objects: if your source has `device.os.name`, push `osName: "..."`, not `os: { name: "..." }`.
-   **No mixed-type arrays.** `["a", 1, true]` is rejected.
-   **No properties starting with `_`** other than the platform-reserved ones (`_key`, `_type`, `_class`, `_rawData`, `_fromEntityKey`, `_toEntityKey`, `_mapping`).
-   **No `undefined`.** Omit the property or use `null` instead.
-   **Strings ≤ 4096 characters.** Truncate descriptions, notes, error messages, file paths.
-   **Boolean fields use `is{CamelCase}`** — `isEnabled`, `isAdmin`, `isMfaEnabled`. Never `enabled` or `mfa`.
-   **Date fields use `{action}On`** as **epoch milliseconds** — `createdOn`, `updatedOn`, `lastSeenOn`, `lastLoginOn`. Convert ISO strings to epoch ms before push. Never push ISO strings.
-   **Don't redefine class-inherited properties.** A `Device`\-class entity already has `hostname`, `osType`, `ipAddresses`, `macAddresses`. A `User` entity already has `email`, `firstName`, `lastName`, `username`. Don't add custom-named duplicates. The full list per class is in the [data model](/data-model/jupiterone-data-model.md).
-   **Defaults.** Never default missing strings to `""` — use `null` or omit. Empty strings break filters that test for presence.

### What to include

Pick the **minimum set of properties that offer query value** for security, compliance, or asset inventory. Be selective.

Always include when available:

-   Identifiers — unique ID, name, displayName.
-   Ownership — owner, createdBy, assignedTo.
-   Status — active / enabled / lifecycle state.
-   Timestamps — `createdOn`, `updatedOn`, `lastSeenOn`, `lastLoginOn`.
-   Security-relevant — permissions, roles, MFA status, encryption status, severity, compliance status.
-   Classification — category, type, tags / labels.
-   Network identity (devices/hosts) — hostname, IP addresses, MAC addresses, OS type.

### What to exclude

Always exclude:

-   Secrets — passwords, API keys, tokens, certificates, private keys. Never push as properties or in raw data.
-   Sensitive PII beyond what is needed for identity (SSN, home addresses, phone numbers).
-   Request/response bodies, full stack traces, raw logs.
-   Internal platform IDs with no security meaning (sequence numbers, render hints, template IDs).
-   UI/display-only metadata (locale, timezone, theme).

When in doubt, leave it out. Adding a property later is cheap; removing one is a breaking change for queries, alerts, and compliance mappings.

### JSON example

This is a literal upload payload — exactly what `POST /upload` accepts. The `Application` entity describes a third-party SaaS app discovered in your billing system.

```json
{
  "entities": [
    {
      "_key": "billing-acme:app:00f4a812-1c4f-4d79-9c3c-aaa2efad8e1f",
      "_type": "application_my-billing-acme",
      "_class": "Application",
      "name": "slack",
      "displayName": "Slack",
      "category": "communication",
      "vendor": "Slack Technologies",
      "isSso": true,
      "isMfaEnforced": true,
      "userCount": 142,
      "monthlyCostUsd": 1420.50,
      "createdOn": 1730419200000,
      "lastSeenOn": 1736294400000,
      "owner": "platform-team@example.com",
      "tags": ["sanctioned", "tier-1"]
    }
  ]
}
```

Notes on this payload:

-   `_key` uses the source system's stable UUID (no prefixes other than the integration namespace).
-   `_type` follows the `<resource>_<integration-type>` pattern.
-   `_class: "Application"` is a standard JupiterOne class — properties like `category` and `vendor` are inherited from the class.
-   Booleans use `is{CamelCase}` (`isSso`, `isMfaEnforced`).
-   Dates are epoch ms (`createdOn`, `lastSeenOn`).
-   `userCount` and `monthlyCostUsd` are flat primitives; no nested billing object.

---

## Relationship construction

A **relationship** is an edge between two entities — "team A _owns_ application B," "user X _has assigned_ role Y," "finding F _exploits_ vulnerability V." Relationships are how JupiterOne answers "what does X depend on / connect to" without joins. Without them, your entities are isolated nodes.

### When to use a relationship vs a property

If two entities are linked, push a **relationship**, not a flat foreign-key property. A child entity should not carry a `parentId` field when the relationship already encodes the link.

```text
BAD:    Application { _key: "app1", teamId: "team-42" }
GOOD:   Team --OWNS--> Application
```

The exception: `cveId` on a Finding/Vulnerability. JupiterOne correlates CVEs automatically via that property — do not create a mapped relationship to a `cve` entity.

### Required fields

| Field | Type | Description |
| --- | --- | --- |
| `_key` | string | Unique identifier for this relationship. A common pattern: `<fromKey>|<class>|<toKey>`. |
| `_type` | string | Naming pattern: `<from-type>_<verb>_<to-type>` (for example `team_my-billing-acme_owns_application_my-billing-acme`). |
| `_class` | string | One of the standard JupiterOne relationship classes (see below). Uppercase. |
| `_fromEntityKey` | string | The `_key` of the source entity. Must already exist or be uploaded in the same job. |
| `_toEntityKey` | string | The `_key` of the target entity. Must already exist or be uploaded in the same job. |

### Standard relationship classes

Pick the verb that best matches the real-world relationship. Common options:

| Class | Use for |
| --- | --- |
| `HAS` | Containment / membership (Team HAS User, Account HAS Application). |
| `OWNS` | Ownership (Team OWNS Application). |
| `ASSIGNED` | Assignment (User ASSIGNED Role). |
| `USES` | Use / consumption (Application USES DataStore). |
| `MANAGES` | Management (User MANAGES Team). |
| `IS` | Identity / mapping (User IS Person — typically mapped relationship). |
| `ALLOWS` / `DENIES` | Policy (Role ALLOWS Action). |
| `PROTECTS` | Security control (Service PROTECTS Host). |
| `EXPLOITS` | Findings (Finding EXPLOITS Vulnerability). |

The full list lives in the [data model](/data-model/jupiterone-data-model.md).

### JSON example

This payload connects the `Application` entity from the entity example to a `Team` entity owning it. Both endpoints exist in this same custom integration — a simple direct relationship.

```json
{
  "entities": [
    {
      "_key": "billing-acme:team:engineering",
      "_type": "team_my-billing-acme",
      "_class": "Team",
      "name": "engineering",
      "displayName": "Engineering",
      "memberCount": 42
    },
    {
      "_key": "billing-acme:app:00f4a812-1c4f-4d79-9c3c-aaa2efad8e1f",
      "_type": "application_my-billing-acme",
      "_class": "Application",
      "name": "slack",
      "displayName": "Slack"
    }
  ],
  "relationships": [
    {
      "_key": "billing-acme:team:engineering|owns|billing-acme:app:00f4a812-1c4f-4d79-9c3c-aaa2efad8e1f",
      "_type": "team_my-billing-acme_owns_application_my-billing-acme",
      "_class": "OWNS",
      "_fromEntityKey": "billing-acme:team:engineering",
      "_toEntityKey": "billing-acme:app:00f4a812-1c4f-4d79-9c3c-aaa2efad8e1f"
    }
  ]
}
```

### Mapped relationships (cross-integration)

Use a **mapped relationship** when one endpoint is owned by a different integration — for example, your custom integration creates an `Application` and you want to link it to an `aws_iam_role` already ingested by the AWS integration. You don't know the target's `_key`; you describe how to find it.

```json
{
  "relationships": [
    {
      "_key": "billing-acme:app:slack|uses|aws-iam-role-1",
      "_type": "application_my-billing-acme_uses_aws_iam_role",
      "_class": "USES",
      "_mapping": {
        "sourceEntityKey": "billing-acme:app:00f4a812-1c4f-4d79-9c3c-aaa2efad8e1f",
        "relationshipDirection": "FORWARD",
        "targetFilterKeys": [["_type", "_key"]],
        "targetEntity": {
          "_type": "aws_iam_role",
          "_key": "arn:aws:iam::123456789012:role/SlackProvisioner"
        },
        "skipTargetCreation": true
      }
    }
  ]
}
```

Set `skipTargetCreation: true` when you expect the target to already exist (most common). Set it to `false` only for shared entities like `cve` where JupiterOne should create them on demand.

See [Creating relationships between entities](/features/assets/relationships-across-scopes.md) for the full mapped-relationship reference.

---

## Step-by-step build guide

The end-to-end shape of a custom integration is the same regardless of language: pull data from your vendor, transform it into JupiterOne's entity/relationship JSON, push it through the Sync API in batches, finalize. This guide walks the pieces. Code samples are TypeScript for illustration; any HTTP-capable runtime works.

### 1\. Project setup

Make the JupiterOne credentials available as environment variables on whatever runs your code:

```sh
export JUPITERONE_API_KEY=<your-api-key>
export JUPITERONE_INTEGRATION_INSTANCE_ID=<your-instance-id>
export JUPITERONE_API_BASE=https://api.us.jupiterone.io
```

Add an HTTP client and your vendor API's SDK (or just a fetch library). Keep credentials out of source control.

### 2\. Build a vendor API client

Encapsulate vendor calls behind a small client class. Three things matter:

-   **Authentication** — read the vendor docs. Don't default to `Bearer` — vendors use many patterns: `X-Api-Key`, `Authorization: Basic`, custom headers, OAuth.
-   **Pagination** — handle every page. Common patterns: cursor / `next_page_token`, offset+limit, `Link` header. Stop when the cursor or `hasMore` flag indicates the end.
-   **Typed responses** — define interfaces matching what the API returns. Don't carry `any` types into your converters.

Sketch:

```ts
class VendorClient {
  constructor(private apiKey: string, private baseUrl: string) {}

  async *iterateApplications(): AsyncGenerator<VendorApp> {
    let cursor: string | undefined;
    do {
      const url = new URL(`${this.baseUrl}/v1/apps`);
      url.searchParams.set("limit", "100");
      if (cursor) url.searchParams.set("cursor", cursor);

      const res = await fetch(url, {
        headers: { "X-Api-Key": this.apiKey },
      });
      if (!res.ok) throw new Error(`vendor api ${res.status}`);

      const body: { apps: VendorApp[]; next_cursor?: string } = await res.json();
      for (const app of body.apps ?? []) yield app;
      cursor = body.next_cursor;
    } while (cursor);
  }
}
```

Note the `?? []` guard before iterating — APIs lie about whether arrays are present.

### 3\. Map vendor responses to entities and relationships

Write a small pure function per resource that turns one API object into one JupiterOne entity. Keep these functions free of HTTP, logging, or upload concerns — just data shape transformation.

```ts
const INTEGRATION_TYPE = "my-billing-acme"; // matches your custom definition's Integration Type

function toApplicationEntity(app: VendorApp): JupiterOneEntity {
  return {
    _key: `${INTEGRATION_TYPE}:app:${app.id}`,
    _type: `application_${INTEGRATION_TYPE}`,
    _class: "Application",
    name: app.slug,
    displayName: app.display_name ?? app.slug,
    category: app.category ?? null,
    vendor: app.publisher ?? null,
    isSso: app.sso_enabled === true,
    isMfaEnforced: app.mfa_required === true,
    userCount: app.user_count,
    monthlyCostUsd: app.cost_monthly_usd,
    createdOn: app.created_at ? Date.parse(app.created_at) : undefined,
    lastSeenOn: app.last_active_at ? Date.parse(app.last_active_at) : undefined,
    owner: app.owner_email ?? null,
    tags: app.tags ?? null,
  };
}

function toTeamOwnsAppRelationship(
  team: VendorTeam,
  app: VendorApp,
): JupiterOneRelationship {
  const fromKey = `${INTEGRATION_TYPE}:team:${team.slug}`;
  const toKey = `${INTEGRATION_TYPE}:app:${app.id}`;
  return {
    _key: `${fromKey}|owns|${toKey}`,
    _type: `team_${INTEGRATION_TYPE}_owns_application_${INTEGRATION_TYPE}`,
    _class: "OWNS",
    _fromEntityKey: fromKey,
    _toEntityKey: toKey,
  };
}
```

Validate before transforming. If a record is missing `id` or `slug`, log and skip — don't push partial entities.

### 4\. Push to JupiterOne via the Sync API

Three endpoints, one job lifecycle. Wrap them in a small client.

```ts
class JupiterOneSync {
  constructor(
    private apiBase: string,
    private apiKey: string,
    private instanceId: string,
  ) {}

  private async post<T>(path: string, body: unknown): Promise<T> {
    const res = await fetch(`${this.apiBase}${path}`, {
      method: "POST",
      headers: {
        Authorization: `Bearer ${this.apiKey}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify(body),
    });
    if (!res.ok) throw new Error(`j1 sync ${res.status}: ${await res.text()}`);
    return (await res.json()) as T;
  }

  async startJob(syncMode = "DIFF"): Promise<string> {
    const { job } = await this.post<{ job: { id: string } }>(
      "/persister/synchronization/jobs",
      {
        source: "integration-external",
        integrationInstanceId: this.instanceId,
        syncMode,
      },
    );
    return job.id;
  }

  async upload(
    jobId: string,
    payload: { entities?: object[]; relationships?: object[] },
  ): Promise<void> {
    await this.post(`/persister/synchronization/jobs/${jobId}/upload`, payload);
  }

  async finalize(jobId: string): Promise<void> {
    await this.post(`/persister/synchronization/jobs/${jobId}/finalize`, {});
  }
}
```

### 5\. Wire it together

Pull, transform, batch, upload, finalize:

```ts
const vendor = new VendorClient(
  process.env.VENDOR_API_KEY!,
  "https://api.vendor.com",
);
const j1 = new JupiterOneSync(
  process.env.JUPITERONE_API_BASE!,
  process.env.JUPITERONE_API_KEY!,
  process.env.JUPITERONE_INTEGRATION_INSTANCE_ID!,
);

const jobId = await j1.startJob("DIFF");

const BATCH = 250;
let entities: object[] = [];
let relationships: object[] = [];

async function flush() {
  if (!entities.length && !relationships.length) return;
  await j1.upload(jobId, { entities, relationships });
  entities = [];
  relationships = [];
}

for await (const app of vendor.iterateApplications()) {
  if (!app.id || !app.slug) continue; // skip records missing required fields
  entities.push(toApplicationEntity(app));
  if (app.owner_team) {
    relationships.push(toTeamOwnsAppRelationship(app.owner_team, app));
  }
  if (entities.length >= BATCH || relationships.length >= BATCH) {
    await flush();
  }
}

await flush();
await j1.finalize(jobId);
```

Batch sizes around 250 keep request bodies modest while minimizing round-trips. Compression (`Content-Encoding: gzip`) is supported if you push much larger batches.

### 6\. Run and verify

Run the script. Then in the JupiterOne app:

1.  Open your custom instance — the **Jobs** tab should show the run with `status: FINISHED` and entity / relationship counts.
    
2.  Run a J1QL query to confirm the data is present:
    
    ```text
    FIND * with _integrationInstanceId = "<your-instance-id>"
    ```
    
3.  Open one of the entities and verify the property names match what you intended (boolean fields prefixed `is`, dates as numbers, no nested objects).
    

If `numEntitiesUploaded` is non-zero but the query returns nothing, the job didn't finalize — check that your finalize call returned 200.

---

## Operational tips

-   **Idempotency** — a `DIFF` finalize is the source of truth. If a job fails partway, start a fresh job; don't try to resume.
-   **Validate small, then scale up** — push a handful of entities first, query for them, verify shape. Then loop the full dataset.
-   **Schema drift** — if your source adds new fields, decide deliberately whether to ingest them. Don't blindly forward every API field.
-   **Never delete properties** that you previously pushed without confirming downstream queries are updated. Removed properties are a breaking change.
-   **Concurrency** — when fetching detail-per-entity from a list endpoint, parallelize but respect the vendor's rate limits. Read response headers (`x-ratelimit-*`, `retry-after`) before raising concurrency.
-   **Defensive guards on API arrays** — always `?? []` before iterating arrays from API responses, and `?? ''` (or `?? null`) before interpolating into `_key` strings. The literal text `"undefined"` in a key is always a bug.

## Related references

-   [Sync API reference](/api/sync-jobs/api-reference.md) — full endpoint reference, payload shapes, validation rules.
-   [JupiterOne data model](/data-model/jupiterone-data-model.md) — entity classes, relationship classes, base properties.
-   [Creating relationships between entities](/features/assets/relationships-across-scopes.md) — mapped-relationship deep dive.
-   [Open-source JupiterOne SDK](https://github.com/JupiterOne/sdk) — TypeScript helpers used by JupiterOne's own integrations. Optional; the Sync API is the contract.

---

Source: /integrations/development/j1-collector

# JupiterOne Collector

This page has moved [here](/integrations/development/collector.md).

---

Source: /integrations/development/overview

# Integration Development

Build your own integrations with JupiterOne when no managed integration exists for your data source, or when you need to ingest data from a proprietary or on-prem system.

The high-level flow:

1.  **Author a [Custom Definition](/integrations/development/custom-definitions.md)** — describe the integration in the JupiterOne app: name, type, category, and which ingestion path it uses.
2.  **Pick an ingestion path** — choose how data flows into the instance:
    -   **[Custom File Transfer](/integrations/development/custom-file-transfer.md)** — upload CSV files directly. No code, no runner.
    -   **[Custom integration: Code + Sync API](/integrations/development/custom-instance.md)** — write code that pushes data via the Sync API using the instance's API key.
3.  **Run, query, iterate** — JupiterOne tracks each ingestion as a job on the instance. Data appears in your workspace alongside managed integrations.

[

![](/icons/illustrations/cloud-upload.svg)![](/icons/illustrations/cloud-upload.svg)

Custom Definitions

The concept hub. What a definition is, how instances and jobs relate, and how to author one in the JupiterOne app.





](/integrations/development/custom-definitions.md)[

![](/icons/illustrations/strategy.svg)![](/icons/illustrations/strategy.svg)

Custom File Transfer (CFT)

Upload assets and relationships as CSV files. Use this when your data is already in tabular form.





](/integrations/development/custom-file-transfer.md)[

![](/icons/illustrations/gear.svg)![](/icons/illustrations/gear.svg)

Custom integration: Code + Sync API

Push data via the Sync API from your own runner. Includes guiding principles for entity modeling, naming, and schema design.





](/integrations/development/custom-instance.md)

---

Source: /integrations/development/self-managing

# Self-manage Integrations

---

Source: /integrations/directory/1password

# 1password

Visualize 1Password audit logs, vaults, and user activities in the JupiterOne graph. Track audit events, item usage, sign-in attempts, and secrets, and map users to their associated actions and vaults. Monitor changes and unusual behavior through custom queries and alerts.

# 1Password Integration Installation in JupiterOne

## Overview

This guide walks you through how to connect your 1Password Business or Enterprise account with JupiterOne to monitor and manage your security data.

The integration pulls data from 1Password using two components:

1.  **Events API** — retrieves security-related activity (sign-ins, item access, audit events) and sends it to JupiterOne.
2.  **Connect Server** — allows JupiterOne to read vault and item information from your 1Password account.

### Prerequisites

-   A 1Password Business account.
-   Owner or Administrator access in 1Password (required to generate tokens).
-   Access to JupiterOne with permission to configure integrations.

## Set Up in 1Password

You will generate two tokens: one for the Events API and one for the Connect Server.

### Generate an Events API Token

This token lets JupiterOne collect audit events, item usage events, and sign-in attempt events.

1.  Sign in to your account at 1password.com.
2.  Check the URL to identify your region. For example, if your account is at `https://my.1password.com`, your region is `1password.com`.
3.  In the sidebar, select **Integrations**.
4.  On the Integrations page, select the **Directory** tab.
5.  In the **Events Reporting** section, choose your SIEM connector. If JupiterOne is not listed, select **Other**.
6.  Enter a name for the integration and select **Add Integration**.
7.  Configure the bearer token:
    -   **Token Name**: enter a name (for example, "JupiterOne Events").
    -   **Expires After**: optionally set an expiry.
    -   **Events to Report**: enable all three event types — sign-in attempts, item usage events, and audit events.
8.  Select **Issue Token**. Copy the token and save it securely — you will need it in JupiterOne.

Based on your region, use the corresponding **Events API Base URL**:

| Region | Base URL |
| --- | --- |
| `1password.com` | `https://events.1password.com` |
| `ent.1password.com` | `https://events.ent.1password.com` |
| `1password.ca` | `https://events.1password.ca` |
| `1password.eu` | `https://events.1password.eu` |

### Generate a Connect Server Token

The Connect Server lets JupiterOne access vaults and items. You must deploy a 1Password Connect Server in your own infrastructure first.

#### What is a Connect Server?

A lightweight 1Password service you run in your own infrastructure. It exposes a REST API that JupiterOne calls to read vault contents.

1.  Sign in to your account at 1password.com.
2.  Go to **Developer** in the left navigation.
3.  Open the **Connect Servers** tab and select **New Connect Server**.
4.  Enter a name for the server (for example, "JupiterOne").
5.  Select **Add Vaults** and choose the vaults this server should be able to read.
6.  Select **Add Environment**.
7.  Configure the access token:
    -   **Token Name**: enter a name (for example, "JupiterOne Connect").
    -   **Expires After**: optionally set an expiry.
    -   Select the vaults this token should access.
8.  Select **Issue Token**. Copy the token and save it securely.
9.  Follow the [1Password Connect Server deployment guide](https://www.1password.dev/connect/get-started) to deploy the Connect Server in your infrastructure and obtain its **Base URL**.

## Data Volume Configuration

Control how much historical data is ingested from 1Password.

### Ingestion Windows

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Reporting Event Historical days** | Number of days of past event data to ingest. Increasing this value ingests more events and increases data volume in JupiterOne. | 30 | 30, 60, 90, 120 |

## Configure Integration in JupiterOne

1.  In JupiterOne, go to **Integrations** in the left navigation.
    
2.  Find and select the **1Password** integration tile.
    
3.  Select **Add Configuration** and complete the fields:
    
    | Field | Description |
    | --- | --- |
    | **Reporting Event Access Token** | The Events API bearer token you generated above. |
    | **Reporting Event Base Url** | The Events API base URL for your region (see table above). |
    | **Connect Server Base Url** | The URL where your Connect Server is running. Optional — omit if you are not using the Connect Server. |
    | **Connect Server Access Token** | The Connect Server bearer token you generated above. Optional — required only if you provide a Connect Server Base Url. |
    
4.  Select **Create Configuration** to save.
    

JupiterOne will begin pulling data from 1Password on the polling interval you configure.

## Next Steps

Now that your integration instance is configured, it will run on the polling interval you set, populating data in JupiterOne. See the [Instance management guide](/integrations/instance-management.md) to learn more about working with integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (3)

-   `auditevents`
-   `itemusages`
-   `signinattempts`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (14)

-   `https://events.1password.ca/api/v2/auditevents`
-   `https://events.1password.ca/api/v2/itemusages`
-   `https://events.1password.ca/api/v2/signinattempts`
-   `https://events.1password.com/api/v2/auditevents`
-   `https://events.1password.com/api/v2/itemusages`
-   `https://events.1password.com/api/v2/signinattempts`
-   `https://events.1password.eu/api/v2/auditevents`
-   `https://events.1password.eu/api/v2/itemusages`
-   `https://events.1password.eu/api/v2/signinattempts`
-   `https://events.ent.1password.com/api/v2/auditevents`
-   `https://events.ent.1password.com/api/v2/itemusages`
-   `https://events.ent.1password.com/api/v2/signinattempts`
-   `{onePasswordConnectServerBaseUrl}/v1/vaults`
-   `{onePasswordConnectServerBaseUrl}/v1/vaults/{vaultId}/items`

### Licenses

Product licenses or SKUs required in the target environment.

Show Licenses (1)

-   `1Password Business`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (4)

-   [https://www.1password.dev/connect/api-reference](https://www.1password.dev/connect/api-reference)
-   [https://www.1password.dev/connect/get-started](https://www.1password.dev/connect/get-started)
-   [https://www.1password.dev/events-api/get-started](https://www.1password.dev/events-api/get-started)
-   [https://www.1password.dev/events-api/reference](https://www.1password.dev/events-api/reference)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (6)

| Step | Endpoints | Licenses |
| --- | --- | --- |
| Fetch Audit Event Actor Details | \- | \- |
| Fetch Audit Event Aux Details | \- | \- |
| Fetch Audit Event Object Details | \- | \- |
| Fetch Item Usage Users | \- | \- |
| Fetch Secrets | `{onePasswordConnectServerBaseUrl}/v1/vaults/{vaultId}/items` | `1Password Business` |
| Fetch Signin Attempt Target Users | \- | \- |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Audit Event | `one_password_audit_event` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Audit Event Actor Details | `one_password_audit_event_actor_details` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Audit Event Aux Details | `one_password_audit_event_aux_details` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Audit Event Object Details | `one_password_audit_event_object_details` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Item Usage Event | `one_password_item_usage_event` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Item Usage User | `one_password_item_usage_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Secret | `one_password_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Signin Attempt Event | `one_password_signin_attempt_event` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Signin Attempt Target User | `one_password_signin_attempt_target_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vault | `one_password_vault` | [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `one_password_audit_event` | **UPDATED** | `one_password_audit_event_aux_details` |
| `one_password_audit_event` | **UPDATED** | `one_password_audit_event_object_details` |
| `one_password_audit_event_actor_details` | **PERFORMED** | `one_password_audit_event` |
| `one_password_audit_event_actor_details` | **PERFORMED** | `one_password_vault` |
| `one_password_item_usage_user` | **PERFORMED** | `one_password_item_usage_event` |
| `one_password_signin_attempt_target_user` | **PERFORMED** | `one_password_item_usage_event` |
| `one_password_vault` | **HAS** | `one_password_secret` |

### One Password Audit Event

`one_password_audit_event` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountUUID` | `string` |  |  |
| `action` | `string` |  |  |
| `actorAccountUUID` | `string` |  |  |
| `actorType` | `string` |  |  |
| `actorUUID` | `string` |  |  |
| `auxId` | `string` |  |  |
| `auxInfo` | `string` |  |  |
| `auxUUID` | `string` |  |  |
| `city` | `string` |  |  |
| `country` | `string` |  |  |
| `latitude` | `number` |  |  |
| `longitude` | `number` |  |  |
| `objectType` | `string` |  |  |
| `objectUUID` | `string` |  |  |
| `region` | `string` |  |  |
| `sessionDeviceUUID` | `string` |  |  |
| `sessionIP` | `string` |  |  |
| `sessionLoginOn` | `number` |  |  |
| `sessionUUID` | `string` |  |  |

---

### One Password Audit Event Actor Details

`one_password_audit_event_actor_details` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `mspUserAccountId` | `string` |  |  |
| `mspUserType` | `string` |  |  |

---

### One Password Audit Event Aux Details

`one_password_audit_event_aux_details` inherits from [User](/data-model/schemas/User.md)

---

### One Password Audit Event Object Details

`one_password_audit_event_object_details` inherits from [User](/data-model/schemas/User.md)

---

### One Password Item Usage Event

`one_password_item_usage_event` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `action` | `string` |  |  |
| `appName` | `string` |  |  |
| `appVersion` | `string` |  |  |
| `city` | `string` |  |  |
| `country` | `string` |  |  |
| `ipAddress` | `string` |  |  |
| `itemUUID` | `string` |  |  |
| `latitude` | `number` |  |  |
| `longitude` | `number` |  |  |
| `mspAccountUUID` | `string` |  |  |
| `osName` | `string` |  |  |
| `osVersion` | `string` |  |  |
| `platformName` | `string` |  |  |
| `platformVersion` | `string` |  |  |
| `region` | `string` |  |  |
| `usedVersion` | `number` |  |  |
| `userUUID` | `string` |  |  |
| `vaultUUID` | `string` |  |  |

---

### One Password Item Usage User

`one_password_item_usage_user` inherits from [User](/data-model/schemas/User.md)

---

### One Password Secret

`one_password_secret` inherits from [Secret](/data-model/schemas/Secret.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `favorite` | `boolean` |  |  |
| `fileNames` | `array` of `string`s |  |  |
| `lastEditedBy` | `string` |  |  |
| `sectionLabels` | `array` of `string`s |  |  |
| `vaultId` | `string` |  |  |
| `vaultName` | `string` |  |  |
| `version` | `number` |  |  |

---

### One Password Signin Attempt Event

`one_password_signin_attempt_event` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appName` | `string` |  |  |
| `appVersion` | `string` |  |  |
| `category` | `string` |  |  |
| `city` | `string` |  |  |
| `country` | `string` |  |  |
| `details` | `string` |  |  |
| `ipAddress` | `string` |  |  |
| `latitude` | `number` |  |  |
| `longitude` | `number` |  |  |
| `mspAccountUUID` | `string` |  |  |
| `osName` | `string` |  |  |
| `osVersion` | `string` |  |  |
| `platformName` | `string` |  |  |
| `platformVersion` | `string` |  |  |
| `region` | `string` |  |  |
| `sessionUUID` | `string` |  |  |
| `targetUserUUID` | `string` |  |  |
| `type` | `string` |  |  |

---

### One Password Signin Attempt Target User

`one_password_signin_attempt_target_user` inherits from [User](/data-model/schemas/User.md)

---

### One Password Vault

`one_password_vault` inherits from [Vault](/data-model/schemas/Vault.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `attributeVersion` | `number` |  |  |
| `contentVersion` | `number` |  |  |
| `description` | `string` |  |  |
| `itemsCount` | `number` |  |  |
| `type` | `string` |  |  |

---

## Release Notes

-   **2025-10-01** — Added relationships linking audit event actors to the vaults they performed actions on, enabling vault access activity queries.
-   **2025-09-09** — New 1Password integration: ingests audit events, sign-in attempts, and item usage events with actor user relationships; optionally ingests vaults and secrets via the Connect Server API.

---

Source: /integrations/directory/addigy

# Addigy

Visualize Addigy users and policies in the JupiterOne graph, map Addigy users to employees, and monitor changes through queries and alerts.

## Installation

Addigy supports two authentication methods. Choose the one that matches your setup:

-   **Basic** — authenticate with an Addigy admin username and password, plus a generated client ID and secret. Ingests devices and policies.
-   **API Key** — authenticate with an organization ID and an API key generated in the Addigy UI. Ingests devices, policies, and users.

> **NOTE**
> 
> User data (`addigy_user` entities) is only available when using **API Key** authentication.

### Prerequisites

#### Basic authentication

1.  Log in to the [Addigy portal](https://app.addigy.com) as a user with the **Owner** role.
2.  Generate a `client_id` and `client_secret` for the integration. See [Addigy's API documentation](https://support.addigy.com/hc/en-us/articles/4403542544275) for instructions.
3.  Note the username and password of the Addigy admin account you will use.

#### API Key authentication

1.  Log in to the [Addigy portal](https://app.addigy.com).
2.  Locate your **Organization ID** from the organization settings.
3.  Generate an **API Key** in the Addigy UI. See [Addigy's API documentation](https://support.addigy.com/hc/en-us/articles/4403542544275) for instructions.

### Configuration in JupiterOne

To install the Addigy integration in JupiterOne, navigate to the **Integrations** tab and select **Addigy**. Click **New Instance** to begin.

Provide the following:

-   **Account Name** — identifies this Addigy account in JupiterOne. Ingested entities store this value in `tag.AccountName` when the `AccountName` toggle is enabled.
-   **Description** — optional label to help identify the instance.
-   **Polling Interval** — how often the integration runs. Set to `DISABLED` to run manually.

Then select an authentication method and supply the corresponding credentials:

**Basic**

| Field | Description |
| --- | --- |
| **Addigy Username** | Username of the Addigy admin account used to authenticate. |
| **Addigy Password** | Password of the Addigy admin account. |
| **Addigy Client ID** | The `client_id` generated through the Addigy UI. |
| **Addigy Client Secret** | The `client_secret` generated through the Addigy UI. |

**API Key**

| Field | Description |
| --- | --- |
| **Organization ID** | Your Addigy organization ID. |
| **API Key** | The API key generated through the Addigy UI. |

Click **Create** once all values are provided.

### Next steps

Once the instance is created, the integration runs on the polling interval you set, populating JupiterOne with Addigy devices, policies, and (for API Key auth) users. Continue to our [Instance management guide](/integrations/instance-management.md) to learn more about managing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Addigy Device | `addigy_hostagent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Addigy Policy | `addigy_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Addigy User | `addigy_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Host | `addigy_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `addigy_host` | **HAS** | `addigy_hostagent` |
| `addigy_hostagent` | **HAS** | `addigy_policy` |
| `addigy_policy` | **CONTAINS** | `addigy_policy` |
| `addigy_user` | **HAS** | `addigy_policy` |

### Addigy Host

`addigy_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `encrypted` | `boolean` |  |  |
| `fileVaultEnabled` | `boolean` |  |  |
| `firewallEnabled` | `boolean` |  |  |
| `isAppleSilicon` | `boolean` |  |  |
| `lastOnline` | `number` |  |  |
| `platform` | `string` |  |  |
| `policyId` | `string` |  |  |
| `systemVersion` | `string` |  |  |
| `totalDiskSpace` | `number` |  |  |
| `totalMemory` | `number` |  |  |
| `user` | `string` |  |  |

---

### Addigy Hostagent

`addigy_hostagent` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `category` | `string` |  |  |
| `encrypted` | `boolean` |  |  |
| 
`ethernetMacAddress` \*

 | `string` **|** `null` |  |  |
| `fileVaultEnabled` | `boolean` |  |  |
| `firewallEnabled` | `boolean` |  |  |
| `hostname` | `string` |  |  |
| `isAppleSilicon` | `boolean` |  |  |
| `lastOnline` | `number` |  |  |
| `macAddress` | `array` of `string`s |  |  |
| `make` | `string` |  |  |
| `model` | `string` |  |  |
| `platform` | `string` |  |  |
| `policyId` | `string` |  |  |
| `serial` | `string` |  |  |
| `serialNumber` | `string` |  |  |
| `systemVersion` | `string` |  |  |
| `totalDiskSpace` | `number` |  |  |
| `totalMemory` | `number` |  |  |
| 

`user` \*

 | `string` **|** `null` |  |  |
| `wifiMacAddress` | `string` |  |  |

---

### Addigy Policy

`addigy_policy` inherits from [Policy](/data-model/schemas/Policy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `downloadPath` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| `orgid` | `string` |  |  |
| `parent` | `string` |  |  |

---

### Addigy User

`addigy_user` inherits from [User](/data-model/schemas/User.md)

---

## Release Notes

-   **2026-04-08** — Improved OS details display for Addigy device entities, combining OS platform and system version.
-   **2025-04-14** — Added new device properties to Addigy entities including firewall status, FileVault encryption, Apple Silicon detection, total memory, and total disk space.

---

Source: /integrations/directory/adp-workforce-now

# ADP Workforce Now

Visualize ADP Workforce Now workers and departments in the JupiterOne graph, map the employee reporting hierarchy, correlate workers to their user accounts, and monitor changes through queries and alerts.

## Installation

### Prerequisites

-   An **ADP Workforce Now** account with access to the ADP HR APIs.
-   ADP-issued API credentials for a registered API application: an OAuth **Client ID** and **Client Secret**, plus a client **SSL certificate** and its **private key** (PEM).
-   Access to **JupiterOne** with permission to configure integrations.

### Obtain ADP API credentials

The integration authenticates to the ADP Workforce Now APIs using **OAuth 2.0 (client credentials)** together with **mutual TLS** — every request presents a client SSL certificate in addition to a bearer token. ADP issues the required credentials to a registered API application:

-   a **Client ID** and **Client Secret** (the OAuth client credentials), and
-   a client **SSL certificate** and its **private key** (PEM), registered with ADP for the mutual-TLS handshake.

These credentials are provisioned by ADP through the [ADP developer program](https://developers.adp.com/). Work with your ADP representative or ADP's developer documentation to register an API application, obtain the Client ID and Client Secret, and generate the client certificate and key. The application must be granted access to the worker and department data this integration reads — see the [Authorization](/integrations/directory/adp-workforce-now.md?integration-docs=authorization) tab for the specific permissions and endpoints.

The integration issues read-only requests.

### Configure the integration in JupiterOne

To install the ADP Workforce Now integration in JupiterOne, navigate to the **Integrations** tab and select **ADP Workforce Now**. Click **New Instance** to begin configuring your integration.

Creating an ADP Workforce Now instance requires the following:

-   The **Account Name** used to identify the ADP Workforce Now account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
-   **Description** to assist in identifying the integration instance, if desired.
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **Client ID** | Yes | The ADP OAuth client ID for your registered API application. |
| **Client Secret** | Yes | The ADP OAuth client secret for your registered API application. |
| **Client Certificate (PEM)** | Yes | The PEM-encoded client SSL certificate registered with ADP for mutual TLS. Paste the entire file contents, including the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines. |
| **Client Key (PEM)** | Yes | The PEM-encoded private key paired with the client certificate, for mutual TLS. Paste the entire file contents, including the `-----BEGIN ... PRIVATE KEY-----` header and footer lines. |

#### Advanced

These fields are optional and only needed to override the default ADP endpoints.

| Field | Default | Description |
| --- | --- | --- |
| **API Base URL** | `https://api.adp.com` | Override the ADP API base URL. Leave blank to use the default. |
| **OAuth Token URL** | `https://accounts.adp.com/auth/oauth/v2/token` | Override the ADP OAuth token endpoint. Leave blank to use the default. |

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (2)

-   `Organization/Department Read`
-   `Worker Read`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (2)

-   `/hr/v1/validation-tables/departments`
-   `/hr/v2/workers`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://developers.adp.com/apis/api-explorer/hcm-offrg-wfn](https://developers.adp.com/apis/api-explorer/hcm-offrg-wfn)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `adp_wfn_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Department | `adp_wfn_department` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Worker | `adp_wfn_worker` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `adp_wfn_department` | **HAS** | `adp_wfn_worker` |
| `adp_wfn_worker` | **MANAGES** | `adp_wfn_worker` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `adp_wfn_worker` | **IS** | `User` | FORWARD |

### Adp Wfn Account

`adp_wfn_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`clientId` \*

 | `string` | The ADP OAuth client identifier used to authenticate this integration instance. |  |

---

### Adp Wfn Department

`adp_wfn_department` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The ADP client (tenant) id this department belongs to (ADR-015 flat account reference). |  |
| 

`code` \*

 | `string` | The ADP department code (unique within the client). |  |

---

### Adp Wfn Worker

`adp_wfn_worker` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The ADP client (tenant) id this worker belongs to (ADR-015 flat account reference). |  |
| 

`associateOID` \*

 | `string` | The ADP Associate OID — globally unique worker identifier across all of ADP. |  |
| 

`businessEmail` \*

 | `string` **|** `null` | The worker business (work) email address. |  |
| 

`costCenterName` \*

 | `string` **|** `null` | The cost-center name of the primary work assignment. |  |
| 

`departmentCode` \*

 | `string` **|** `null` | The home department code of the primary work assignment; the carrier the department→worker relationship builder resolves against (ADR-004/005). |  |
| 

`departmentName` \*

 | `string` **|** `null` | The home department name of the primary work assignment (flat, for filtering). |  |
| 

`hiredOn` \*

 | `number` **|** `null` | Epoch milliseconds of the original hire date. |  |
| 

`isManager` \*

 | `boolean` **|** `null` | Whether the worker holds a management position (from the primary work assignment managementPositionIndicator). |  |
| 

`jobCode` \*

 | `string` **|** `null` | The job code of the primary work assignment. |  |
| 

`jobTitle` \*

 | `string` **|** `null` | The business/job title of the primary work assignment. |  |
| 

`managerAssociateOID` \*

 | `string` **|** `null` | The ADP Associate OID of the worker's manager (from reportsTo). The manager hierarchy itself is expressed by the MANAGES relationship (ADR-005); this is the graph-key basis that relationship builder resolves against. |  |
| 

`positionId` \*

 | `string` **|** `null` | The position id of the primary work assignment. |  |
| 

`rehiredOn` \*

 | `number` **|** `null` | Epoch milliseconds of the most recent rehire date. |  |
| 

`terminatedOn` \*

 | `number` **|** `null` | Epoch milliseconds of the termination date, if terminated. |  |
| 

`wageLawCoverage` \*

 | `string` **|** `null` | The wage-law coverage code of the primary work assignment (e.g. exempt/non-exempt). |  |

---

---

Source: /integrations/directory/airwatch

# AirWatch

Visualize the VMWare AirWatch admins, users, groups, and devices, map AirWatch users to employees, and monitor changes through queries and alerts.

## Installation

To install this integration, you will need to configure settings both within AirWatch and on JupiterOne. Before enabling in JupiterOne, ensure that you have completed the setup within your AirWatch account.

### Configuration on AirWatch

Log into VMWare AirWatch (Workspace ONE™️ UEM) and create an Administrator user account for the integration to authenticate with the REST API:

1.  Select **Accounts** > **Administrators** > **List View**.
    
2.  Press the **Add** > **Add Admin**" button and provide required details.
    
    > **NOTE**
    > 
    > We _recommend_ setting values that represent JupiterOne as a `system` user account. Ensure that you set **Title** on the **Details** tab to `system` so that JupiterOne understands this is a user for automation (so it does not attempt to map to a Person entity).
    
3.  **Assign the necessary read-only permissions** to the administrator account. The integration requires read access to:
    
    -   **Devices** (`/mdm/devices/search`, `/mdm/devices/security`)
    -   **Administrators** (`/system/admins/search`)
    -   **Organization Groups** (`/system/groups/search`, `/system/groups/{id}/children`)
    -   **Profiles** (`/mdm/profiles/search`, `/mdm/profiles/{id}`, `/mdm/profiles/{id}/devices`)
4.  Once the account is created, you will need to [create a new AirWatch API key](https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/2212/System_Settings_On_Prem/GUID-AWT-SYSTEM-ADVANCED-API-REST.html?hWord=N4IghgNiBc4A4EsAEBrApgTxAXyA).
    

### Configuration in JupiterOne

To install the AirWatch integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select AirWatch. Click **New Instance** to begin configuring the integration.

Creating an AirWatch instance requires the following:

-   The **Account Name** used to identify the AirWatch account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Hostname**, **Admin Username**, and **Admin Password** of your AirWatch account.
    
-   **Rest API Key** (or Tenant Code) used to authenticate with Airwatch.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `airwatch_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Admin | `airwatch_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Device | `user_endpoint` | [Host](https://docs.jupiterone.io/data-model/schemas/Host), [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Device User | `device_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Organization Group | `airwatch_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group), [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Profile | `airwatch_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `airwatch_account` | **HAS** | `airwatch_group` |
| `airwatch_account` | **MANAGES** | `user_endpoint` |
| `airwatch_group` | **HAS** | `airwatch_group` |
| `airwatch_group` | **HAS** | `airwatch_user` |
| `user_endpoint` | **OWNS** | `device_user` |
| `user_endpoint` | **INSTALLED** | `airwatch_profile` |

### Airwatch Account

`airwatch_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`name` \*

 | `string` |  |  |

---

### Airwatch Group

`airwatch_group` inherits from [Group](/data-model/schemas/Group.md), [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admins` | `number` | Number of console admin users in the organization group |  |
| `country` | `string` |  |  |
| `devices` | `number` | Number of enrolled/unenrolled devices present in the organization group |  |
| `groupId` | `string` |  |  |
| `locale` | `string` |  |  |
| `locationGroupType` | `string` | Type of organization group  
  
**Examples**: Global, Customer, Partner |  |
| `users` | `number` | Number of enrollment users in the organization group |  |
| `uuid` | `string` |  |  |

---

### Airwatch Profile

`airwatch_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `managedBy` | `string` |  |  |
| `payloads` | `array` of `string`s |  |  |
| `platform` | `string` |  |  |

---

### Airwatch User

`airwatch_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `initialLandingPage` | `string` |  |  |
| `lastLoginTimeStamp` | `number` |  |  |
| `locale` | `string` |  |  |
| `locationGroup` | `string` |  |  |
| `locationGroupId` | `string` |  |  |
| `messageTemplateId` | `string` |  |  |
| `messageTemplateUuid` | `string` |  |  |
| `organizationGroupUuid` | `string` |  |  |
| `timeZone` | `string` |  |  |
| `uuid` | `string` |  |  |

---

### Device User

`device_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `uuid` | `string` |  |  |

---

### User Endpoint

`user_endpoint` inherits from [Host](/data-model/schemas/Host.md), [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `airwatchPlatform` | `string` |  |  |
| `assetNumber` | `string` |  |  |
| `deviceFriendlyName` | `string` |  |  |
| `email` | `string` |  |  |
| `hostName` | `string` |  |  |
| `imei` | `string` |  |  |
| `isSupervised` | `boolean` |  |  |
| `operatingSystem` | `string` |  |  |
| `ownerId` | `string` |  |  |
| `serialNumber` | `string` |  |  |
| `userEmailAddress` | `string` |  |  |
| `username` | `string` |  |  |
| `uuid` | `string` |  |  |
| `wifiSsid` | `string` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name accuracy for AirWatch device entities, deriving human-readable OS names from the device platform and model fields.
-   **2025-04-22** — Updated AirWatch admin user entities to align with the latest data model, adding email domain and short login ID properties.
-   **2025-04-17** — Added location group name and ID to AirWatch device entities.
-   **2025-04-17** — Added email address to AirWatch device user entities.

---

Source: /integrations/directory/alibaba-cloud

# Alibaba Cloud

Visualize Alibaba Cloud resources and monitor changes through queries and alerts.

## Installation

To install this integration, you will need to configure settings both within Alibaba Cloud and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your Alibaba account.

### Configuration on Alibaba Cloud

An **Access Key ID** and **Access Key Secret** are required for the JupiterOne integration to interact with Alibaba Cloud's API.

In order to obtain an Access Key ID/Secret combination for the integration, an administrator of the Alibaba Cloud account will need to create a new RAM user the integration can use. Additionally, the user will need to have `Read Only` access to the account.

To do so, the administrator can:

1.  Navigate to the RAM page in the Alibaba Cloud console.
2.  Select **Create User**. We suggest the name of the user include `JupiterOne`.
3.  Check the **Open API Access** option while creating the new user.
4.  Obtain the Access Key ID/Secret combination that is generated.
5.  Grant the new user the `ReadOnlyAccess` permission.

> **INFO**
> 
> For more information, refer to Alibaba Cloud's documentation for [creating a RAM user](https://www.alibabacloud.com/help/en/resource-access-management/latest/getting-started-create-a-ram-user) or for generating the [Access Key ID and Access Key Secret](https://www.alibabacloud.com/help/en/resource-access-management/latest/accesskey-pairs-create-an-accesskey-pair-for-a-ram-user).

### Ingesting multiple accounts with a Resource Directory (optional)

If your accounts are organized in an [Alibaba Cloud Resource Directory](https://www.alibabacloud.com/help/en/resource-management/resource-directory/product-overview/what-is-a-resource-directory), you can point a single JupiterOne integration instance at the **management account** and have JupiterOne automatically create and maintain a separate integration instance for each member account. There is no need to create a RAM user or an integration instance in every account.

This works by having the management account's RAM user assume a role in each member account:

-   When an account is created in or invited to a Resource Directory, Alibaba Cloud automatically creates a RAM role named `ResourceDirectoryAccountAccessRole` in that member account and grants the management account permission to assume it. This is the role JupiterOne assumes by default. See Alibaba Cloud's [RAM roles in a resource directory](https://www.alibabacloud.com/help/en/resource-management/security-and-compliance/ram-roles-in-a-resource-directory) for details.
-   Create the RAM user and AccessKey (as described above) **in the management account**. In addition to `ReadOnlyAccess`, this user needs permission to view the Resource Directory (for example, `AliyunResourceDirectoryReadOnlyAccess`) and permission to assume the member-account role via STS `AssumeRole`.

To exclude a specific member account from ingestion, add a tag with the key `JupiterOne` and the value `SKIP` to that account in the Resource Directory. JupiterOne skips tagged accounts and does not create an instance for them.

### Configuration in JupiterOne

To install the Alibaba Cloud integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Alibaba Cloud. Click **New Instance** to begin configuring the integration.

Creating an Alibaba Cloud instance requires the following:

-   The **Account Name** used to identify the Alibaba Cloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Enter the Alibaba Cloud **Access Key ID** and **Access Key Secret** generated for use by JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

#### Resource Directory settings (optional)

To ingest every account in a Resource Directory from this instance (see [Ingesting multiple accounts with a Resource Directory](#ingesting-multiple-accounts-with-a-resource-directory-optional) above), configure the following on the management account's instance:

-   **Configure Resource Directory Accounts** — When enabled, JupiterOne enumerates the accounts in the Resource Directory reachable from this instance's credentials and automatically creates a child integration instance for each account (except those tagged `JupiterOne:SKIP`). Child instances inherit their configuration from this instance. Do not enable this setting together with **Account ID** — the Resource Directory parent must run without an Account ID.
    
-   **Resource Directory ID** — Optionally pin the expected Resource Directory ID. If the ID does not match the directory reachable from this instance's credentials, JupiterOne stops instead of configuring instances against the wrong directory.
    
-   **Auto-delete Removed Accounts** — When enabled, JupiterOne automatically deletes the child instances it created for accounts that have since been removed from the Resource Directory. Defaults to disabled.
    
-   **Role Name to Assume in Member Accounts** — The name of the RAM role JupiterOne assumes in each member account. Defaults to `ResourceDirectoryAccountAccessRole`, which Alibaba Cloud creates automatically in each member account. Override this only if you use a custom role.
    

> **NOTE**
> 
> The **Account ID** field is set automatically on the child instances that the parent creates; you do not need to set it yourself. Child instances are managed automatically — avoid editing them manually.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (23)

-   `alb:DescribeRegions`
-   `alb:ListLoadBalancers`
-   `ecs:DescribeInstances`
-   `ecs:DescribeRegions`
-   `ess:DescribeRegions`
-   `ess:DescribeScalingGroups`
-   `oss:GetBucketInfo`
-   `oss:ListBuckets`
-   `ram:GetAccountAlias`
-   `ram:ListEntitiesForPolicy`
-   `ram:ListGroups`
-   `ram:ListPoliciesForGroup`
-   `ram:ListPoliciesForRole`
-   `ram:ListPoliciesForUser`
-   `ram:ListRoles`
-   `ram:ListUsers`
-   `ram:ListUsersForGroup`
-   `sts:GetCallerIdentity`
-   `vpc:DescribeNatGateways`
-   `vpc:DescribeRegions`
-   `vpc:DescribeVpcAttribute`
-   `vpc:DescribeVpcs`
-   `vpc:DescribeVpnGateways`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (23)

-   `https://alb.aliyuncs.com?Action=DescribeRegions`
-   `https://alb.aliyuncs.com?Action=ListLoadBalancers`
-   `https://ecs.aliyuncs.com?Action=DescribeInstances`
-   `https://ecs.aliyuncs.com?Action=DescribeRegions`
-   `https://ess.aliyuncs.com?Action=DescribeRegions`
-   `https://ess.aliyuncs.com?Action=DescribeScalingGroups`
-   `https://oss.aliyuncs.com/?Action=GetBucketInfo`
-   `https://oss.aliyuncs.com/?Action=ListBuckets`
-   `https://ram.aliyuncs.com?Action=GetAccountAlias`
-   `https://ram.aliyuncs.com?Action=ListEntitiesForPolicy`
-   `https://ram.aliyuncs.com?Action=ListGroups`
-   `https://ram.aliyuncs.com?Action=ListPoliciesForGroup`
-   `https://ram.aliyuncs.com?Action=ListPoliciesForRole`
-   `https://ram.aliyuncs.com?Action=ListPoliciesForUser`
-   `https://ram.aliyuncs.com?Action=ListRoles`
-   `https://ram.aliyuncs.com?Action=ListUsers`
-   `https://ram.aliyuncs.com?Action=ListUsersForGroup`
-   `https://sts.aliyuncs.com?Action=GetCallerIdentity`
-   `https://vpc.aliyuncs.com?Action=DescribeNatGateways`
-   `https://vpc.aliyuncs.com?Action=DescribeRegions`
-   `https://vpc.aliyuncs.com?Action=DescribeVpcAttribute`
-   `https://vpc.aliyuncs.com?Action=DescribeVpcs`
-   `https://vpc.aliyuncs.com?Action=DescribeVpnGateways`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (23)

-   [https://www.alibabacloud.com/help/en/auto-scaling/developer-reference/api-ess-2014-08-28-describescalinggroups](https://www.alibabacloud.com/help/en/auto-scaling/developer-reference/api-ess-2014-08-28-describescalinggroups)
-   [https://www.alibabacloud.com/help/en/auto-scaling/developer-reference/api-overview](https://www.alibabacloud.com/help/en/auto-scaling/developer-reference/api-overview)
-   [https://www.alibabacloud.com/help/en/ecs/developer-reference/api-ecs-2014-05-26-describeinstances](https://www.alibabacloud.com/help/en/ecs/developer-reference/api-ecs-2014-05-26-describeinstances)
-   [https://www.alibabacloud.com/help/en/ecs/developer-reference/api-ecs-2014-05-26-describeregions](https://www.alibabacloud.com/help/en/ecs/developer-reference/api-ecs-2014-05-26-describeregions)
-   [https://www.alibabacloud.com/help/en/nat-gateway/developer-reference/api-vpc-2016-04-28-describenatgateways-natgws](https://www.alibabacloud.com/help/en/nat-gateway/developer-reference/api-vpc-2016-04-28-describenatgateways-natgws)
-   [https://www.alibabacloud.com/help/en/oss/developer-reference/getbucketinfo](https://www.alibabacloud.com/help/en/oss/developer-reference/getbucketinfo)
-   [https://www.alibabacloud.com/help/en/oss/developer-reference/listbuckets](https://www.alibabacloud.com/help/en/oss/developer-reference/listbuckets)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-getaccountalias](https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-getaccountalias)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listentitiesforpolicy](https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listentitiesforpolicy)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listgroups](https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listgroups)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listpoliciesforgroup](https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listpoliciesforgroup)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listpoliciesforrole](https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listpoliciesforrole)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listpoliciesforuser](https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listpoliciesforuser)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listroles](https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listroles)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listusers](https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listusers)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listusersforgroup](https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listusersforgroup)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-sts-2015-04-01-getcalleridentity](https://www.alibabacloud.com/help/en/ram/developer-reference/api-sts-2015-04-01-getcalleridentity)
-   [https://www.alibabacloud.com/help/en/slb/application-load-balancer/developer-reference/api-alb-2020-06-16-listloadbalancers](https://www.alibabacloud.com/help/en/slb/application-load-balancer/developer-reference/api-alb-2020-06-16-listloadbalancers)
-   [https://www.alibabacloud.com/help/en/slb/application-load-balancer/developer-reference/api-overview](https://www.alibabacloud.com/help/en/slb/application-load-balancer/developer-reference/api-overview)
-   [https://www.alibabacloud.com/help/en/vpc/developer-reference/api-vpc-2016-04-28-describeregions](https://www.alibabacloud.com/help/en/vpc/developer-reference/api-vpc-2016-04-28-describeregions)
-   [https://www.alibabacloud.com/help/en/vpc/developer-reference/api-vpc-2016-04-28-describevpcattribute](https://www.alibabacloud.com/help/en/vpc/developer-reference/api-vpc-2016-04-28-describevpcattribute)
-   [https://www.alibabacloud.com/help/en/vpc/developer-reference/api-vpc-2016-04-28-describevpcs](https://www.alibabacloud.com/help/en/vpc/developer-reference/api-vpc-2016-04-28-describevpcs)
-   [https://www.alibabacloud.com/help/en/vpn/sub-product-ipsec-vpn/developer-reference/api-vpc-2016-04-28-describevpngateways-vpns](https://www.alibabacloud.com/help/en/vpn/sub-product-ipsec-vpn/developer-reference/api-vpc-2016-04-28-describevpngateways-vpns)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (7)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Build Group and User Relationships | `ram:ListUsersForGroup` | `https://ram.aliyuncs.com?Action=ListUsersForGroup` |
| Build Policy and Group Relationships | `ram:ListEntitiesForPolicy` | `https://ram.aliyuncs.com?Action=ListEntitiesForPolicy` |
| Build Policy and Role Relationships | `ram:ListEntitiesForPolicy` | `https://ram.aliyuncs.com?Action=ListEntitiesForPolicy` |
| Build Policy and User Relationships | `ram:ListEntitiesForPolicy` | `https://ram.aliyuncs.com?Action=ListEntitiesForPolicy` |
| Fetch RAM Groups' Policies | `ram:ListPoliciesForGroup` | `https://ram.aliyuncs.com?Action=ListPoliciesForGroup` |
| Fetch RAM Roles' Policies | `ram:ListPoliciesForRole` | `https://ram.aliyuncs.com?Action=ListPoliciesForRole` |
| Fetch RAM Users' Policies | `ram:ListPoliciesForUser` | `https://ram.aliyuncs.com?Action=ListPoliciesForUser` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `alibaba_cloud_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| ALB Load Balancer | `alibaba_cloud_alb_load_balancer` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Autoscaling Group | `alibaba_cloud_autoscaling_group` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| ECS Instance | `alibaba_cloud_ecs_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| NAT Gateway | `alibaba_cloud_nat_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| OSS Bucket | `alibaba_cloud_oss_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| RAM Group | `alibaba_cloud_ram_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| RAM Policy | `alibaba_cloud_ram_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| RAM Role | `alibaba_cloud_ram_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| RAM User | `alibaba_cloud_ram_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| VPC | `alibaba_cloud_vpc` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| VPN Gateway | `alibaba_cloud_vpn_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `alibaba_cloud_autoscaling_group` | **USES** | `alibaba_cloud_vpc` |
| `alibaba_cloud_ram_group` | **HAS** | `alibaba_cloud_ram_user` |
| `alibaba_cloud_ram_policy` | **ASSIGNED** | `alibaba_cloud_ram_user` |
| `alibaba_cloud_ram_policy` | **ASSIGNED** | `alibaba_cloud_ram_group` |
| `alibaba_cloud_ram_policy` | **ASSIGNED** | `alibaba_cloud_ram_role` |
| `alibaba_cloud_vpc` | **HAS** | `alibaba_cloud_ecs_instance` |
| `alibaba_cloud_vpc` | **HAS** | `alibaba_cloud_alb_load_balancer` |
| `alibaba_cloud_vpc` | **HAS** | `alibaba_cloud_nat_gateway` |
| `alibaba_cloud_vpc` | **HAS** | `alibaba_cloud_vpn_gateway` |

## Release Notes

-   **2026-04-08** — Improved OS type and name accuracy for Alibaba Cloud ECS instance entities.

---

Source: /integrations/directory/anthropic

# Anthropic

Visualize Anthropic organization data in the JupiterOne graph. Map users to workspaces, track API key ownership and status, and monitor identity and access changes through custom queries and alerts.

## Installation

The Anthropic integration ingests organization details, users, workspaces, workspace memberships, and API keys using the Anthropic [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api). Before setting up the integration in JupiterOne, you will need to create an **Admin API key** in the Claude Console.

### Prerequisites

-   An Anthropic **organization** (the Admin API is unavailable for individual accounts). If you have not set one up, go to **Console > Settings > Organization** first.
-   An organization member with the **admin** role — only admins can create Admin API keys.
-   Access to JupiterOne with permission to configure integrations.

### Creating an Admin API key in Anthropic

1.  Log in to the [Claude Console](https://console.anthropic.com/) as an organization admin.
2.  Navigate to **Settings > Admin Keys** ([https://platform.claude.com/settings/admin-keys](https://platform.claude.com/settings/admin-keys)).
3.  Click **Create Admin Key** and give it a recognizable name (for example, `JupiterOne Integration`).
4.  Copy the generated key — it starts with `sk-ant-admin` and is shown only once.

> **NOTE**
> 
> Admin API keys are separate from standard API keys. Only organization admins can create them, and they provide access to the organization management endpoints (`/v1/organizations/me`, `/v1/organizations/users`, `/v1/organizations/workspaces`, workspace members, and `/v1/organizations/api_keys`). No additional scope configuration is required — the integration only reads from these endpoints.

### Configuration in JupiterOne

To install the Anthropic integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Anthropic. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Anthropic account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Anthropic **API Key** — the Admin API key created above (starts with `sk-ant-admin`). This field is required.
    
-   Optionally, a **Base URL** to override the Anthropic API endpoint. Leave blank to use the default `https://api.anthropic.com`.
    
-   Optionally, an **Anthropic Version** to override the `anthropic-version` request header. Leave blank to use the default `2023-06-01`.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `admin`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://platform.claude.com/docs/en/docs/administration/administration-api](https://platform.claude.com/docs/en/docs/administration/administration-api)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | Roles |
| --- | --- |
| Fetch Api Keys | `admin` |
| Fetch Users | `admin` |
| Fetch Workspace Members | `admin` |
| Fetch Workspaces | `admin` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `anthropic_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Api Key | `anthropic_api_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| User | `anthropic_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Workspace | `anthropic_workspace` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `anthropic_account` | **HAS** | `anthropic_user` |
| `anthropic_account` | **HAS** | `anthropic_workspace` |
| `anthropic_user` | **ASSIGNED** | `anthropic_workspace` |
| `anthropic_user` | **CREATED** | `anthropic_api_key` |
| `anthropic_workspace` | **HAS** | `anthropic_api_key` |

### Anthropic Account

`anthropic_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Anthropic Api Key

`anthropic_api_key` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `partialKeyHint` | `string` | A partial hint of the API key value |  |
| `status` | `string` | The status of the API key (active, inactive, archived) |  |

---

### Anthropic User

`anthropic_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `email` | `array` of `string`s | The email address(es) of the user |  |
| `role` | `string` | The role of the user in the organization (user, developer, billing, admin, claude\_code\_user, managed) |  |

---

### Anthropic Workspace

`anthropic_workspace` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `archivedOn` | `number` | Timestamp when the workspace was archived |  |
| `displayColor` | `string` | The display color of the workspace |  |

---

---

Source: /integrations/directory/apple-business-manager

# Apple Business Manager

JupiterOne's integration with Apple Business Manager collects data about MDM servers and managed devices, providing visibility into your organization's Apple device management infrastructure.

## Installation

For this integration, you will need an [Apple Business Manager](https://business.apple.com/) account with administrative access and API access enabled. This integration uses JWT-based OAuth authentication with the Apple Business Manager API.

> **INFO**
> 
> You will need to generate a server token and obtain the required credentials from Apple Business Manager. See the [Apple Business Manager API documentation](https://developer.apple.com/documentation/applebusinessmanagerapi) for more information.

### Obtaining API Credentials

1.  Log in to [Apple Business Manager](https://business.apple.com/)
2.  Navigate to **Settings** > **Preferences**
3.  Under **Server Tokens**, create a new token with the required permissions
4.  Download the private key (.pem file)
5.  Note the following values:
    -   **Client ID**: Your organization's Apple Business Manager Client ID
    -   **Key ID**: The identifier for the private key
    -   **Private Key**: The content of the downloaded .pem file Once the API Token is created, you can find the Client ID and Key ID by clicking "Manage" next to the new token.

![Apple Business Manager server token settings](/assets/images/abm2-66e38746559bae2b8f5bc276e8ccfdd5.png) ![Apple Business Manager server token details](/assets/images/abm1-54704a98d7c20c24af3eb41b607aba85.png)

The server token you create must have sufficient permissions to access:

-   MDM server configurations
-   Device inventory

### Configuration in JupiterOne

To install the Apple Business Manager integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Apple Business Manager. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Apple Business Manager account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Client ID**: Your Apple Business Manager Client ID
    
-   **Key ID**: The Key ID associated with your private key
    
-   **Private Key**: Upload the .pem file you downloaded from Apple Business Manager
    

Click **Create** once all values are provided to finalize the integration.

> **NOTE**
> 
> If the integration runs successfully but no entities are collected, verify that your organization has MDM servers configured in Apple Business Manager and that devices are assigned to your organization.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| AppleCare Coverage | `apple_business_manager_apple_care_coverage` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| MDM Server | `apple_business_manager_mdm_server` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Org Device | `apple_business_manager_org_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Organization | `apple_business_manager_organization` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `apple_business_manager_org_device` | **HAS** | `apple_business_manager_apple_care_coverage` |
| `apple_business_manager_organization` | **HAS** | `apple_business_manager_mdm_server` |

### Apple Business Manager Apple Care Coverage

`apple_business_manager_apple_care_coverage` inherits from [Subscription](/data-model/schemas/Subscription.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agreementNumber` | `string` **|** `null` | Apple-issued agreement number for the coverage contract. Null for base Limited Warranty. |  |
| `contractCancelOn` | `number` **|** `null` | Timestamp the contract was cancelled, if cancelled (ms since epoch). |  |
| `endedOn` | `number` **|** `null` | Coverage end timestamp (ms since epoch). |  |
| `isCanceled` | `boolean` **|** `null` | Whether the coverage contract has been cancelled. |  |
| `isRenewable` | `boolean` **|** `null` | Whether the coverage contract can be renewed at end of term. |  |
| `paymentType` | `string` **|** `null` | Payment type for the coverage contract. Known values: `ABE_SUBSCRIPTION`, `PAID_UP_FRONT`, `SUBSCRIPTION`, `NONE`. |  |
| `startedOn` | `number` **|** `null` | Coverage start timestamp (ms since epoch). |  |

---

### Apple Business Manager Mdm Server

`apple_business_manager_mdm_server` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `serverType` | `string` **|** `null` |  |  |

---

### Apple Business Manager Org Device

`apple_business_manager_org_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `addedToOrgOn` | `number` |  |  |
| `bluetoothMacAddress` | `string` **|** `null` |  |  |
| `color` | `string` **|** `null` |  |  |
| `deviceCapacity` | `string` **|** `null` |  |  |
| `deviceFamily` | `string` **|** `null` |  |  |
| `eid` | `string` **|** `null` |  |  |
| `imei` | `array` **|** `null` |  |  |
| `meid` | `array` **|** `null` |  |  |
| `orderedOn` | `number` |  |  |
| `orderNumber` | `string` |  |  |
| `partNumber` | `string` |  |  |
| `productType` | `string` **|** `null` |  |  |
| `purchaseSourceId` | `string` |  |  |
| `purchaseSourceType` | `string` |  |  |
| `releasedFromOrgOn` | `number` **|** `null` |  |  |
| `status` | `string` |  |  |
| `wifiMacAddress` | `string` **|** `null` |  |  |

---

### Apple Business Manager Organization

`apple_business_manager_organization` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `adminId` | `string` |  |  |
| `orgAddress` | `string` |  |  |
| `orgEmail` | `string` |  |  |
| `orgId` | `string` |  |  |
| `orgPhone` | `string` |  |  |
| `orgType` | `string` |  |  |

---

## Release Notes

-   **2026-01-20** — New Apple Business Manager integration: ingests organizations, MDM servers, and organization-owned devices.

---

Source: /integrations/directory/aquasec

# Aqua Security

Visualize Aqua Security accounts, groups, users, and API keys, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create an API Key and Secret key on Aqua Security. See [their documentation](https://cloud.aquasec.com/cspm/#/apikeys) for more information.

### Configuration in Aqua Security

When creating the API Key and Secret for this integration, ensure the credentials have **read-only access** to the following resources:

-   **Accounts** (`/v2/accounts/{accountId}`)
-   **Groups** (`/v2/groups`)
-   **Users** (`/v2/users`)
-   **API Keys** (`/v2/apikeys`)

The integration uses HMAC-SHA256 signature authentication and requires no write permissions.

### Configuration in JupiterOne

To install the Aqua Security integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Aqua Security. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Aqua Security account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Aqua Security **Account ID**, **API Key**, and **API Secret**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `aquasec_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| API Key | `aquasec_api_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Group | `aquasec_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| User | `aquasec_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `aquasec_account` | **HAS** | `aquasec_user` |
| `aquasec_account` | **HAS** | `aquasec_group` |
| `aquasec_account` | **HAS** | `aquasec_api_key` |
| `aquasec_group` | **HAS** | `aquasec_user` |

### Aquasec User

`aquasec_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admin` | `boolean` |  |  |
| `confirmed` | `boolean` |  |  |
| `multiaccount` | `boolean` |  |  |
| `passwordReset` | `boolean` |  |  |
| `sendAnnouncements` | `boolean` |  |  |
| `sendNewPlugins` | `boolean` |  |  |
| `sendNewRisks` | `boolean` |  |  |
| `sendScanResults` | `boolean` |  |  |

---

---

Source: /integrations/directory/armis

# Armis

The Armis integration adds comprehensive device visibility and threat detection capabilities. This integration enables JupiterOne users to better manage assets, assess risks, and respond to incidents more effectively by leveraging Armis's device insights.

## Installation

To install this integration, you will need to configure settings both within Armis and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your Armis's account.

### Configuration on Armis

> **NOTE**
> 
> You will have to configure an API secret key in Armis so that the integration can make REST API calls to fetch data from Armis.

1.  Using a web browser, go to your Armis tenant (e.g. `https://my-tenant.armis.com`) and log in with your credentials.
    
2.  Click on Settings -> API Management
    
    ![Settings](/assets/images/armis-settings-8af8fa5df13ab217a097715d8e55274d.png)
    
3.  Click on the `Create` button
    
    ![Create Button](/assets/images/armis-create-button-c9e6fcfb6b60f6ebce67779519957801.png)
    
4.  You will get a message box with the newly created API Secret Key. Save the key in a safe place, you will need this to configure the integration in JupiterOne.
    
    ![Armis API Secret Key](/assets/images/armis-api-key-26b61713983b8516ae6b8eaa056307bf.png)
    

## Data Volume Configuration

Control how much data is ingested from Armis to manage storage and processing.

### Ingestion Windows (Time Ranges)

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Historical Days** | Number of days for which data should be retrieved from Armis | 90 | Any number greater than 0 |
| **Vulnerabilities Ingestion Window** | Ingestion window for vulnerabilities last detected (days ago) | 90 | 90, 180, 275, 365 |

**How it affects data volume:** Higher number of days will result in more devices, alerts, and vulnerabilities being ingested from Armis.

### Data Filtering Options

| Field | Type | Description | Default |
| --- | --- | --- | --- |
| **Included Vulnerability Severities** | Multi-select | Select vulnerability severities to ingest | Critical, High, Medium |
| **Included Vulnerability Status** | Multi-select | Select vulnerability status to ingest | Open |

**How it affects data volume:** Filtering by severity and status reduces the number of vulnerability entities ingested. By default, only Critical, High, and Medium severity vulnerabilities with Open status are imported.

### Finalize in JupiterOne

To install the `Armis` integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select `Armis`. Click **New Instance** to begin configuring the integration.

Creating an integration instance requires the following:

-   Enter the Armis URL (e.g. `https://<tenant>.armis.com`)
    
-   Enter the Armis API Secret Key generated for use by JupiterOne.
    
-   Enter the account name by which you want to identify this Armis account in JupiterOne.
    
-   \[Optional\] Enter a description to help your team identify the integration.
    
-   \[Optional\] Select a polling interval that is sufficient for your monitoring requirements. You can leave this as `DISABLED` and manually execute the integration.
    
-   \[Optional\] Enter the Historical Days (any number greater than 0). The integration will ask Armis to return devices/alerts seen in the last few days. The Historical Days number will be used for this query. Higher number of days will result in more data ingested.
    
-   \[Optional\] Disable TLS Verification - Set this to true only if you have an on-prem Armis server that does not have a valid SSL certificate configured. For most cases this value should be false.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `armis_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `armis_finding_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Device | `armis_device` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Site | `armis_site` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| Vendor | `armis` | [Vendor](https://docs.jupiterone.io/data-model/schemas/Vendor) |
| Vulnerability | `armis_finding_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Vulnerability | `armis_finding_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `armis` | **HOSTS** | `armis_account` |
| `armis_account` | **MANAGES** | `armis_device` |
| `armis_account` | **HAS** | `armis_site` |
| `armis_device` | **HAS** | `armis_finding_vulnerability` |
| `armis_device` | **HAS** | `armis_finding_alert` |
| `armis_site` | **HAS** | `armis_device` |

### Armis Device

`armis_device` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_key` \*

 | `string` |  |  |
| `ipAddress` | `string` |  |  |
| `ipv6` | `string` |  |  |
| `macAddress` | `string` |  |  |

---

### Armis Finding Vulnerability

`armis_finding_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`blocking` \*

 | `boolean` **|** `null` |  |  |
| 

`production` \*

 | `boolean` **|** `null` |  |  |
| 

`public` \*

 | `boolean` **|** `null` |  |  |
| 

`remediationActions` \*

 | `string` **|** `null` |  |  |

---

### Armis Finding Vulnerability

`armis_finding_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`blocking` \*

 | `boolean` **|** `null` |  |  |
| 

`production` \*

 | `boolean` **|** `null` |  |  |
| 

`public` \*

 | `boolean` **|** `null` |  |  |
| 

`remediationActions` \*

 | `string` **|** `null` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name accuracy for Armis device entities, using human-readable OS names.
-   **2025-08-19** — Added recommended actions normalization to Armis vulnerability and finding entities.
-   **2025-08-05** — Added advisory ID, confidence level, remediation information, first detected, and last detected timestamps to Armis vulnerability entities.
-   **2025-06-03** — Added Armis unified vulnerability ingestion, supporting both vulnerability and finding entity classes with configurable severity filtering.

---

Source: /integrations/directory/artifactory

# Artifactory

Visualize JFrog Artifactory repository groups, code repositories, builds, keys, permissions, user groups, and users, and monitor changes through queries and alerts.

## Installation

For this integration, JupiterOne requires the namespace of your Artifactory account. It also requires are a **Client Access Token**, **Client Pipeline Access Token**, and the **Client Administrator Name** that granted the access tokens.

### Configuration in Artifactory

Configure API access tokens in Artifactory using the instructions in the [Access Tokens guide](https://jfrog.com/help/r/jfrog-platform-administration-documentation/access-tokens#AccessTokens-CreateToken).

## Data Volume Configuration

Control how much data is ingested from Artifactory to manage storage and processing.

### Ingestion Windows (Time Ranges)

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Artifacts Ingestion Window** | Ingest artifacts created within the last X days | 30 | 30, 60, 90, 365 |

**How it affects data volume:** A longer ingestion window retrieves more artifacts from Artifactory, increasing the number of artifact entities stored in JupiterOne.

### Data Filtering Options

| Field | Type | Description | Default |
| --- | --- | --- | --- |
| **Included Vulnerability Severities** | Multi-select | Select vulnerability severities to ingest | Medium, High, Critical |
| **Include Repository Artifacts** | Array | Comma-separated list of repositories from which artifacts will be ingested. Excludes all others. | None (all repositories) |

**How it affects data volume:**

-   Severity filtering reduces vulnerability entities by excluding low-severity findings. By default, only Medium, High, and Critical vulnerabilities are ingested.
-   Repository filtering limits artifact ingestion to specified repositories, significantly reducing data when only specific repositories are needed.

### Configuration in JupiterOne

To install the JFrog Artifactory integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Artifactory. Click **New Instance** to begin configuring your integration, providing the following:

-   **Account Name** used to identify the JFrog Artifactory account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` option is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Client Namespace** of your Artifactory account.
    
-   **Client Access Token** configured in your Artifactory account.
    
-   **Client Pipeline Access Token** configured in your Artifactory account.
    
-   **Client Administrator Name**, or username of the administrator who granted the Artifactory access tokens.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| AccessToken | `artifactory_access_token` | [Key](https://docs.jupiterone.io/data-model/schemas/Key), [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Account | `artifactory_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| ArtifactCodeModule | `artifactory_artifact_codemodule` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Build | `artifactory_build` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Finding | `artifactory_vulnerability_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Group | `artifactory_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Permission | `artifactory_permission` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| PipelineSource | `artifactory_pipeline_source` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Repository | `artifactory_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| RepositoryGroup | `artifactory_repository_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| User | `artifactory_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `artifactory_access_token` | **ASSIGNED** | `artifactory_user` |
| `artifactory_account` | **HAS** | `artifactory_group` |
| `artifactory_account` | **HAS** | `artifactory_access_token` |
| `artifactory_account` | **HAS** | `artifactory_user` |
| `artifactory_account` | **HAS** | `artifactory_repository` |
| `artifactory_account` | **HAS** | `artifactory_repository_group` |
| `artifactory_account` | **HAS** | `artifactory_pipeline_source` |
| `artifactory_artifact_codemodule` | **HAS** | `artifactory_vulnerability_finding` |
| `artifactory_build` | **CREATED** | `artifactory_artifact_codemodule` |
| `artifactory_group` | **HAS** | `artifactory_user` |
| `artifactory_permission` | **ASSIGNED** | `artifactory_user` |
| `artifactory_permission` | **ASSIGNED** | `artifactory_group` |
| `artifactory_permission` | **ALLOWS** | `artifactory_repository` |
| `artifactory_permission` | **ALLOWS** | `artifactory_build` |
| `artifactory_permission` | **ALLOWS** | `artifactory_repository_group` |
| `artifactory_repository` | **HAS** | `artifactory_artifact_codemodule` |

### Artifactory User

`artifactory_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `disableUIAccess` | `boolean` |  |  |
| `internalPasswordDisable` | `boolean` |  |  |
| `mfaStatus` | `boolean` |  |  |
| `policyManager` | `boolean` |  |  |
| `profileUpdatable` | `boolean` |  |  |
| `realm` | `string` |  |  |
| `reportsManager` | `boolean` |  |  |
| `watchManager` | `boolean` |  |  |

---

### Artifactory Vulnerability Finding

`artifactory_vulnerability_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

---

## Release Notes

-   **2026-02-13** — Added TLS verification configuration options for Artifactory, supporting custom CA certificates and self-signed certificate environments.
-   **2025-06-03** — Artifactory vulnerability findings now support both the Vulnerability and Weakness entity classes for improved data model compatibility.
-   **2025-04-29** — Added configuration option to include artifacts from specific repositories in Artifactory ingestion.

---

Source: /integrations/directory/asana

# Asana

Visualize Asana workspaces, teams, users, projects, and project memberships, map Asana users to employees, and monitor changes to Asana users through queries and alerts.

## Installation

> **INFO**
> 
> Before configuring this integration in JupiterOne, you need to set up OAuth authentication in Asana:
> 
> **Required in Asana:**
> 
> -   An Administrator user account with permission to create OAuth applications
> -   An OAuth application registered in your Asana account with a Client ID and Client Secret
> -   An OAuth refresh token generated through the OAuth authorization flow
> 
> **Authentication:** This integration uses OAuth 2.0 with refresh tokens. JupiterOne will automatically refresh access tokens as needed using the credentials you provide.
> 
> **Permissions:** The OAuth application will have access to read all workspaces, teams, users, projects, and project memberships that the authorizing user can access.
> 
> For detailed OAuth setup instructions, see the [Asana OAuth documentation](https://developers.asana.com/docs/oauth).

To install the Asana integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Asana. Click **New Instance** to begin configuring your integration.

Creating an Asana integration requires the following:

-   The **Account Name** used to identify the Asana account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

After clicking **Create**, you'll be prompted to authorize JupiterOne with Asana. Completing the authorization process will finalize the integration setup.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `asana_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Project | `asana_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Project Membership | `asana_project_membership` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Team | `asana_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team) |
| User | `asana_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Workspace | `asana_workspace` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `asana_account` | **HAS** | `asana_workspace` |
| `asana_project` | **HAS** | `asana_project_membership` |
| `asana_project_membership` | **ALLOWS** | `asana_project` |
| `asana_team` | **HAS** | `asana_user` |
| `asana_team` | **ASSIGNED** | `asana_project` |
| `asana_user` | **OWNS** | `asana_project` |
| `asana_user` | **ASSIGNED** | `asana_project_membership` |
| `asana_workspace` | **HAS** | `asana_user` |
| `asana_workspace` | **HAS** | `asana_team` |
| `asana_workspace` | **HAS** | `asana_project` |

### Asana User

`asana_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |

---

---

Source: /integrations/directory/asset-panda

# Asset Panda

Visualize Asset Panda users and assets, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to acquire and provide the following within JupiterOne:

1.  An **Asset Panda Email and Password**: You need to enter the e-mail and password you would use to log into your account when going to the asset panda web application on the website. It is recommended to create a service account used for creating your token.
2.  The **Asset Mapping Configuration JSON File**: A JSON file that defines the mapping between Asset Panda assets and JupiterOne entities. It specifies the Group ID of the asset to be ingested and the Entity Class used to classify the corresponding JupiterOne entity. The entity classes can be found [here](https://docs.jupiterone.io/data-model/schemas/Host)

#### The Asset Mapping Configuration JSON file should adhere to the following structure:

```json
{
  "groups": [
    {
      "groupId": 123,
      "_class": "Host",
      "propertyToFieldMap": {
        "hostname": "field_12",
        "model": "field_24",
        "os": null,
        "retiredOn": {"field": "field_48", "type": "date"}
      }
    },
    {
      "groupId": 456,
      "_class": "Site",
      "propertyToFieldMap": {
        "displayName": "field_1",
        "officeCode": "field_2",
        "address": "field_3",
        "region": "field_4"
      }
    }
  ],
  "relationships": [
    {
      "_class": "HAS",
      "sourceGroupId": 123,
      "sourceField": "field_48",
      "targetGroupId": 456,
      "targetField": "id"
    }
  ]
}
```

#### Key descriptions:

##### `groups`: An array of objects that define the mapping between Asset Panda groups and JupiterOne entities.

1.  `groupId` (Required):

-   Type: `number`
-   Description: A unique identifier for the group. This ID must exist and be valid in Asset Panda.

2.  `_class` (Required):

-   Type: `string`
-   Description: The name of the class representing the schema. This must correspond to a valid class name in JupiterOne's data model schema repository.

3.  `propertyToFieldMap` (Required):

-   Type: `object`
-   Description: A mapping of property names to field names. Each property represents an entity property in the JupiterOne schema, and its value is the field to which it maps in the Asset Panda asset.
    -   Keys: Property names (`string`)
    -   Values: Field names (`string`) or `null` if no mapping is provided. An object with the following fields is also accepted:
        -   `field`: The field name in Asset Panda.
        -   `type`: The type of the field. Only valid value for now is `date`, used to parse date values to the correct JupiterOne format.
-   For the specified \_class, all required properties from the schema must be included in propertyToFieldMap. Missing properties will cause validation to fail. You can find the required properties in the [data model schema](https://docs.jupiterone.io/data-model/schemas/Host#required-properties).
-   Fields not found in the JupiterOne schema can be added as additional properties.

##### `relationships`: Relationships define how entities in Asset Panda relate to one another in JupiterOne. The \_class field must be a valid relationship type in the JupiterOne data model.

1.  `_class` (Required):

-   Type: `string`
-   Description: The name of the class representing the relationship. Examples of possible relationship classes can be found in the JupiterOne documentation [here](https://docs.jupiterone.io/data-model/jupiterone-data-model#relationship-examples).

2.  `sourceGroupId` (required):

-   Type: `number`
-   Description: A unique identifier for the source group. This ID must exist and be valid in Asset Panda.

3.  `sourceField` (required):

-   Type: `string`
-   Description: The field in the source group that contains the identifier for the target entity. This field must exist and hold valid values.

4.  `targetGroupId` (required):

-   Type: `number`
-   Description: A unique identifier for the target group. This ID must exist and be valid in Asset Panda.

5.  `targetField` (optional, default: `id`):

-   Type: `string`
-   Description: The field in the target group that corresponds to the source entity's reference field. This field must exist and hold valid values. When this field is `id`, the sourceField must be of type `EntityListField` in Asset Panda.

#### How to find the group ID in Asset Panda:

1.  Open Group Settings:

-   Log in to the Asset Panda web application.
-   Click on the Cog icon in the top-right corner.
-   Select Group Settings from the dropdown menu.

2.  Select the Desired Group:

-   In the Group Settings, locate and click on the group you want to ingest.

3.  Copy the Group ID:

-   Once the group is selected, look at the URL in your browser's address bar.
-   The Group ID will be part of the URL. Copy this ID for your use.

#### How to find the field keys in Asset Panda:

1.  Open Developer Tools:

-   Go to the Asset Panda web application in your browser.
-   Right-click anywhere on the page and select Inspect or Inspect Element to open the developer tools.

2.  Access the Network Tab:

-   In the developer tools, click on the Network tab.
-   Reload the page to capture all network requests.

3.  Filter Requests:

-   Use the search bar or filter options to search for requests containing the term "fields".

4.  View the Request Details:

-   Select the relevant network request.
-   Go to the Preview tab in the request details.

5.  Locate the Field Keys:

-   In the list of field objects displayed under the Preview tab, look for the property labeled "key". This is the field key you need.

### Configuration in JupiterOne

To install the Asset Panda integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Asset Panda. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Asset Panda account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Asset Panda **Email** and **Password**.
    
-   The **Asset Mapping Configuration JSON File** that defines the mapping between Asset Panda assets and JupiterOne entities.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `asset_panda_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| User | `asset_panda_account_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `asset_panda_account` | **HAS** | `asset_panda_account_user` |
| `asset_panda_account` | **HAS** | `ANY_RESOURCE` |

### Asset Panda Account

`asset_panda_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `subtype` | `string` |  |  |
| `type` | `string` |  |  |

---

### Asset Panda Account User

`asset_panda_account_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |

---

---

Source: /integrations/directory/atspoke

# atSpoke

Visualize atSpoke users, teams, requests and webhooks in the JupiterOne graph. Map atSpoke users to employees in your JupiterOne account. Monitor changes to atSpoke users using JupiterOne alerts. Correlate atSpoke request types and volume with other security events.

## Installation

To install this integration, you will need a Business or Enterprise level atSpoke account in order to create an API key for JupiterOne to access the system.

### Configuration on atSpoke

1.  Log into atSpoke on a Business-level or Enterprise-level account (Teams-level accounts do not provide API functionality).
2.  Go to My Profile.
3.  Select the API tab.
4.  Generate a token at the bottom of the page. Note that you can only have one token for the whole atSpoke account, and it allows access to all things.

### Configuration in JupiterOne

To install the atSpoke integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select atSpoke. Click **New Instance** to begin configuring the integration.

Creating an atSpoke instance requires the following:

-   The **Account Name** used to identify the atSpoke account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Enter the **atSpoke API Key** generated on the atSpoke site.
    

Click **Create** once all values are provided to finalize the integration.

> **NOTE**
> 
> When the integration runs, the JupiterOne graph will request the most recent 100 atSpoke requests. If there are more than 100 requests available and the first 100 are not enough to establish at least 14 days of history, JupiterOne will keep collecting requests in batches of 100 until 14 days of history are established or all requests are gathered.
> 
> These requests will be Record entities in the JupiterOne graph, and the collection size will grow indefinitely (ie. old Records will not be deleted, unlike users, teams, and webhooks which only show current in the J1 graph).

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| atSpoke Account | `atspoke_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| atSpoke Request | `atspoke_request` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| atSpoke Request Type | `atspoke_requesttype` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| atSpoke Team | `atspoke_team` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| atSpoke User | `atspoke_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| atSpoke Webhook | `atspoke_webhook` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `atspoke_account` | **HAS** | `atspoke_user` |
| `atspoke_account` | **HAS** | `atspoke_team` |
| `atspoke_account` | **HAS** | `atspoke_webhook` |
| `atspoke_account` | **HAS** | `atspoke_request` |
| `atspoke_account` | **HAS** | `atspoke_requesttype` |
| `atspoke_request` | **HAS** | `atspoke_requesttype` |
| `atspoke_team` | **HAS** | `atspoke_user` |

---

Source: /integrations/directory/auth0

# Auth0

Visualize Auth0 clients and users, map Auth0 users to employees, and monitor changes through queries and alerts.

## Installation

To install this integration, you will need to configure settings both within Auth0 and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your Auth0 dashboard.

### Configuration on Auth0

> **NOTE**
> 
> An Auth0 Machine-to-Machine app's `Domain`, `Client ID`, and `Client Secret` are required for the JupiterOne integration to interact with Auth0.

In order to obtain your app's credentials for the integration, an administrator of the Auth0 account will need to create a new App within your Auth0 dashboard.

To create a new Auth0 app for use with JupiterOne:

1.  Navigate to the Auth0 dashboard.
2.  Within the **Applications** section, select **Applications**.
3.  Create a new Machine-to-Machine application and enable the app to use the Auth0 Management API or select your desired API.
4.  In the API permissions, select `read:users` ,`read:roles`,`read:resource_servers` and `read:clients` and click **Authorize**.
5.  Navigate to the newly created app's **Settings** to retrieve the `Domain`, `Client ID`, and `Client Secret`.

> **INFO**
> 
> For more information, refer to Auth0's documentation for [creating a machine-to-machine app](https://auth0.com/docs/get-started/auth0-overview/create-applications) or for [accessing the app's settings](https://auth0.com/docs/get-started/applications/application-settings).

### Configuration in JupiterOne

To install the Auth0 integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Auth0. Click **New Instance** to begin configuring the integration.

Creating an Auth0 instance requires the following:

-   The **Account Name** used to identify the Auth0 account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Enter the **Auth0 Client ID** for the Machine-to-Machine application designated for JupiterOne's use.
    
-   Enter the **Auth0 Client Secret** for the Machine-to-Machine application designated for JupiterOne's use.
    
-   Enter the **Auth0 Domain** for your Auth0 tenant. Format is typically `{YOURDOMAIN}.{REGION}.auth0.com`. Do not include `https://`. If you are using a custom domain (e.g. 'mycustomdomain.com'), you can use it here.
    
-   Enter the **Auth0 Audience** for your Auth0 tenant, which points to the specific API you will be using. Format must be an auth0.com subdomain, followed by `/api/{version}/`. Examples might be `https://{YOURDOMAIN}.{REGION}.auth0.com/api/v2/` or `https://{YOURDOMAIN}.auth0.com/api/v2/`.
    
    > **NOTE**
    > 
    > Even if you are using a custom domain with Auth0, you need to use your default Auth0 tenant domain here. Also, the trailing slash is necessary.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Auth0 Account | `auth0_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Auth0 Client | `auth0_client` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Auth0 Role | `auth0_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Auth0 Server | `auth0_server` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Auth0 User | `auth0_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `auth0_account` | **HAS** | `auth0_user` |
| `auth0_account` | **HAS** | `auth0_client` |
| `auth0_role` | **PROTECTS** | `auth0_server` |
| `auth0_user` | **ASSIGNED** | `auth0_role` |

### Auth0 Server

`auth0_server` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `function` | `array` of `string`s |  |  |
| `offlineAccess` | `boolean` |  |  |
| `public` | `boolean` |  |  |
| `webLink` | `string` |  |  |

---

### Auth0 User

`auth0_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `blocked` | `boolean` |  |  |
| `createdAt` | `string` |  |  |
| `emailVerified` | `boolean` |  |  |
| `familyName` | `string` |  |  |
| `givenName` | `string` |  |  |
| `identities` | `string` |  |  |
| `lastIp` | `string` |  |  |
| `lastLogin` | `string` |  |  |
| `loginsCount` | `number` |  |  |
| `multifactor` | `array` of `string`s |  |  |
| `nickname` | `string` |  |  |
| `phoneNumber` | `string` |  |  |
| `phoneVerified` | `boolean` |  |  |
| `picture` | `string` |  |  |
| `updatedAt` | `string` |  |  |
| `userId` | `string` |  |  |
| `weblink` | `string` |  |  |

---

---

Source: /integrations/directory/automox

# Automox

Visualize Automox services, teams, and users, map users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create an `API Key` in Automox, which requires . See [their documentation](https://help.automox.com/hc/en-us/articles/5385455262484-Managing-Keys) for more information.

### Configuration in JupiterOne

To install the Automox integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Automox. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Automox account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Automox **Account ID**, **Agent Access Key**, and the **API Key** generated for use by JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `automox_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device | `automox_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Device Group | `automox_device_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| User | `automox_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `automox_account` | **HAS** | `automox_user` |
| `automox_account` | **MANAGES** | `automox_device` |
| `automox_account` | **MANAGES** | `automox_device_group` |
| `automox_device_group` | **HAS** | `automox_device` |

### Automox Account

`automox_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Automox Device

`automox_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `compliant` | `boolean` |  |  |
| `connected` | `boolean` |  |  |
| `createdOn` | `number` |  |  |
| `deleted` | `boolean` |  |  |
| `lastProcessedOn` | `number` |  |  |
| `lastRefreshedOn` | `number` |  |  |
| `lastScanFailedOn` | `number` |  |  |
| `macAddress` | `array` of `string`s |  |  |
| `organizationId` | `number` |  |  |
| `osFamily` | `string` |  |  |
| `osVersionId` | `number` |  |  |
| `serialNumber` | `string` |  |  |
| `serverGroupId` | `number` |  |  |
| `status.agentStatus` | `string` |  |  |
| `status.deviceStatus` | `string` |  |  |
| `status.policyStatus` | `string` |  |  |
| `status.policyStatuses` | `array` of `number`s |  |  |
| `updatedOn` | `number` |  |  |

---

### Automox User

`automox_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `samlEnabled` | `boolean` |  |  |
| `ssoEnabled` | `boolean` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name accuracy for Automox device entities, combining OS family and OS name into human-readable display values.

---

Source: /integrations/directory/aws

# AWS

Visualize AWS cloud resources, map AWS users to employees, and monitor visibility, governance, and compliance against the AWS CIS Framework and security benchmarks. Additionally, monitor AWS vulnerabilities and findings and changes in AWS cloud resources through queries and alerts.

## Installation

To install this integration, you will need to configure settings both within AWS and on JupiterOne. The integration instance configuration requires the customer's **Role ARN** to assume in order to read infrastructure information through AWS APIs. The role is configured to require an **External ID**; this value is auto-generated by JupiterOne and must be used when creating the IAM role.

Information is ingested from all AWS regions that do not require additional contractual arrangements with AWS. Submit a JupiterOne support request if you need to monitor additional regions.

> **INFO**
> 
> This integration enables the creation of automated workflows within JupiterOne alerts using SNS and SQS to remediate configuration gaps in AWS.

### Configuration on AWS

Detailed setup instructions and a pre-built **CloudFormation Stack** are provided in the application and maintained in the public [JupiterOne AWS CloudFormation](https://github.com/JupiterOne/jupiterone-aws-cloudformation) project on GitHub. Follow the steps under **In JupiterOne** to capture the auto-generated **External ID** specific to the integration instance.

Once the steps on GitHub are completed, continue to finalizing the integration instance on JupiterOne.

### Configuration in JupiterOne

To install the AWS integration in JupiterOne, navigate to **Integrations** and select **AWS**. Click **New Instance** to begin configuring the integration.

Creating an integration instance requires the following:

-   The **Account Name** used to identify the AWS account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
-   A **Description** to assist in identifying the integration instance, if desired.
-   A **Polling Interval** that fits your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
-   The **Role ARN** of the IAM role to assume in order to authenticate with AWS.
-   The **External ID** associated with the IAM role. This value is auto-generated and should be used when creating the IAM role for this integration.

Click **Create** once all values are provided.

#### Use Role Chaining

Enable **Use Role Chaining** to cause the integration to assume an intermediate IAM role before assuming the primary **Role ARN**. This gives AWS administrators a dedicated role to monitor and audit the actions taken by this integration.

When **Use Role Chaining** is enabled, two additional required fields appear:

-   **Intermediate Role ARN** — The ARN of the IAM role to assume before assuming the primary Role ARN.
-   **Intermediate External ID** — The External ID associated with the intermediate role.

### Set Permissions

The AWS integration requires security auditor permissions into the target AWS account, as defined by a combination of the [SecurityAudit](https://console.aws.amazon.com/iam/home#policies/arn:aws:iam::aws:policy/SecurityAudit) IAM policy managed by AWS, and a few additional `List*`, `Get*`, and `Describe*` permissions missing from the AWS managed policy. The exact policy and permission statements can be found in the public [JupiterOne AWS CloudFormation](https://github.com/JupiterOne/jupiterone-aws-cloudformation) project on GitHub.

### Manage Organization Accounts

After configuring the AWS integration, enable **Configure Organization Accounts** to automatically create and manage JupiterOne integration instances for all accounts in your AWS Organization. This account must be the management (master) account, and all accounts must share the same IAM role name and External ID.

To exclude a specific sub-account from automatic integration configuration, tag the sub-account in AWS Organizations with: `j1-integration: SKIP`.

When **Configure Organization Accounts** is enabled, two additional options become available:

-   **Auto-delete Removed Accounts** — When enabled, JupiterOne automatically deletes integration instances for AWS accounts that have been deleted or removed from the Organization. Enabled by default.
-   **Auto-delete sub-accounts** — When enabled, JupiterOne automatically deletes sub-account integration instances when the parent organizational account integration is deleted.

> **NOTE**
> 
> JupiterOne automatically ingests all sub-accounts from the Organization the next time it polls your environment.

When adding or configuring sub-accounts separately, use the same IAM role name, policies, and External ID as the management account. Use your preferred infrastructure-as-code method to generate an identical IAM role in each sub-account.

### Service Control Policy Issues

Errors may occur if a Service Control Policy (SCP) is blocking specified services or regions. AWS services that JupiterOne cannot ingest are listed in the **Integration Jobs** logs (**Integrations > Configurations > Settings > Jobs**).

For each SCP that is blocking JupiterOne ingestion, add the following condition to your SCP JSON:

```json
"Condition": {
  "ArnNotLike": {
    "aws:PrincipalARN": [
        "arn:aws:iam::*:role/JupiterOne*"
    ]
  }
}
```

Ensure this ARN matches the IAM role ARN used to configure your JupiterOne AWS integration.

> **INFO**
> 
> See the [AWS Service control policies documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) for the latest information.

## Data Volume Configuration

Control how much data is ingested from AWS to manage storage and processing volume.

### Ingestion Windows

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **ECR Image Findings Ingestion Window** | Ingestion window for ECR image findings. Findings for images pulled or pushed within this timeframe are collected. | 7 days | 1 day, 3 days, 7 days, 30 days, 90 days |
| **Inspector V2 Findings Ingestion Window** | Ingestion window for Inspector V2 findings observed within the selected timeframe. | 30 days | 7 days, 30 days, 60 days, 90 days |
| **Security Hub Findings Ingestion Window** | Ingestion window for Security Hub findings. Only findings updated within this timeframe are collected. Leave empty to collect all active findings regardless of age. | 30 days | 7 days, 30 days, 60 days, 90 days |

Longer windows increase the number of security findings ingested from ECR, Inspector, and Security Hub.

### Data Filtering Options

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **ECR Findings Severities** | Select which severity levels of ECR image findings to ingest. | All severities | Informational, Low, Medium, High, Critical |
| **ECR Findings Maximum Scan Age** | Skip ECR image findings from scans completed more than the selected number of days ago. Findings without a scan completion date are always ingested. | All ages | 30 days, 90 days, 180 days, 365 days |
| **Inspector V2 resource types** | Limit Inspector V2 findings to specific AWS resource types. | All types | AWS EC2 Instance, AWS ECR Container Images, AWS ECR Repository, AWS Lambda Function, AWS Code Repository |
| **Security Hub compliance status to skip** | Compliance status values to exclude when ingesting Security Hub findings. | None (all ingested) | Passed, Warning, Failed, Not available |
| **Security Hub workflow status to skip** | Workflow status values to exclude when ingesting Security Hub findings. Skipping Resolved and Suppressed is a common way to reduce noise. | None (all ingested) | New, Notified, Resolved, Suppressed |

### Advanced Configuration

| Field | Description | Default |
| --- | --- | --- |
| **Consent to Collect Sensitive Data** | When enabled, JupiterOne collects sensitive data from `aws_lambda_function`, `aws_cloudformation_stack`, `aws_launch_template_version`, and `aws_ecs_task_definition` entities. JupiterOne redacts most sensitive fields, but not environment variable names. If you store secrets in environment variables, consider enabling redaction. | Enabled |
| **Lambda Environment Variables To Promote** | Lambda environment variable names to promote as properties on `aws_lambda_function` entities (comma-separated). Values are not redacted — do not include variables that hold sensitive data. | None |
| **Ingest Backup Recovery Point Tags** | When enabled, JupiterOne fetches and attaches tags for AWS Backup recovery points. May increase integration run time. | Disabled |
| **Ingest EC2 deprecated images** | When enabled, JupiterOne ingests EC2 images that are deprecated. Deprecated images may contain less information and may increase integration run time. | Disabled |
| **Ingest Bedrock Agent Instructions** | When enabled, JupiterOne ingests the system instruction (prompt) configured on Bedrock agents. This may contain sensitive business logic. | Disabled |

## Reference

### S3 Bucket `public` Property

The `aws_s3_bucket.public` property is calculated based on the **Access** field in the AWS S3 console:

| Access | `aws_s3_bucket.public` |
| --- | --- |
| Public | `true` |
| Objects can be public | `undefined` |
| Bucket and objects not public | `false` |

### AWS IAM Policies

Each `aws_iam_policy` entity includes a boolean `admin` property that indicates whether the policy grants administrative-level access. The flag is determined from the policy name: if the name contains the word "admin" (case-insensitive), the flag is set to `true`. Examples: `AdministratorAccess`, `AdminPolicy`, `MyCustomAdminRole`.

### Next Steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. See the [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (712)

-   `access-analyzer:ListAnalyzers`
-   `access-analyzer:ListFindings`
-   `account:GetAlternateContact`
-   `account:GetContactInformation`
-   `acm-pca:ListCertificateAuthorities`
-   `acm-pca:ListTags`
-   `acm:DescribeCertificate`
-   `acm:ListCertificates`
-   `acm:ListTagsForCertificate`
-   `airflow:GetEnvironment`
-   `airflow:ListEnvironments`
-   `apigateway:GET arn:aws:apigateway:*::/apis`
-   `apigateway:GET arn:aws:apigateway:*::/apis/*/authorizers`
-   `apigateway:GET arn:aws:apigateway:*::/apis/*/integrations`
-   `apigateway:GET arn:aws:apigateway:*::/apis/*/routes`
-   `apigateway:GET arn:aws:apigateway:*::/apis/*/stages`
-   `apigateway:GET arn:aws:apigateway:*::/domainnames`
-   `apigateway:GET arn:aws:apigateway:*::/domainnames/*/apimappings`
-   `apigateway:GET arn:aws:apigateway:*::/restapis`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/authorizers`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/authorizers/*`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*/methods/*`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/stages`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/stages/*`
-   `appconfig:GetAccountSettings`
-   `appconfig:GetConfigurationProfile`
-   `appconfig:GetDeployment`
-   `appconfig:ListApplications`
-   `appconfig:ListConfigurationProfiles`
-   `appconfig:ListDeploymentStrategies`
-   `appconfig:ListDeployments`
-   `appconfig:ListEnvironments`
-   `appconfig:ListHostedConfigurationVersions`
-   `appconfig:ListTagsForResource`
-   `aps:DescribeLoggingConfiguration`
-   `aps:DescribeQueryLoggingConfiguration`
-   `aps:DescribeResourcePolicy`
-   `aps:DescribeScraper`
-   `aps:DescribeWorkspace`
-   `aps:DescribeWorkspaceConfiguration`
-   `aps:ListScrapers`
-   `aps:ListWorkspaces`
-   `athena:GetWorkGroup`
-   `athena:ListTagsForResource`
-   `athena:ListWorkGroups`
-   `auditmanager:GetAssessment`
-   `auditmanager:GetAssessmentFramework`
-   `auditmanager:GetControl`
-   `auditmanager:GetDelegations`
-   `auditmanager:GetEvidenceFoldersByAssessmentControl`
-   `auditmanager:GetSettings`
-   `auditmanager:ListAssessmentFrameworks`
-   `auditmanager:ListAssessments`
-   `auditmanager:ListControls`
-   `auditmanager:ListTagsForResource`
-   `autoscaling:DescribeAutoScalingGroups`
-   `autoscaling:DescribeLaunchConfigurations`
-   `autoscaling:DescribePolicies`
-   `aws-marketplace:GetEntitlements`
-   `aws-marketplace:ListEntities`
-   `backup:GetBackupVaultAccessPolicy`
-   `backup:ListBackupJobs`
-   `backup:ListBackupPlans`
-   `backup:ListBackupVaults`
-   `backup:ListCopyJobs`
-   `backup:ListRecoveryPointsByBackupVault`
-   `backup:ListRestoreJobs`
-   `backup:ListRestoreTestingPlans`
-   `backup:ListTags`
-   `backup:ListTagsForResource`
-   `batch:DescribeComputeEnvironments`
-   `batch:DescribeJobDefinitions`
-   `batch:DescribeJobQueues`
-   `batch:ListJobs`
-   `bedrock-agentcore:GetAgentRuntime`
-   `bedrock-agentcore:GetCodeInterpreter`
-   `bedrock-agentcore:ListAgentRuntimes`
-   `bedrock-agentcore:ListCodeInterpreters`
-   `bedrock:GetAgent`
-   `bedrock:GetAgentActionGroup`
-   `bedrock:GetCustomModel`
-   `bedrock:GetDataSource`
-   `bedrock:GetEvaluationJob`
-   `bedrock:GetFlow`
-   `bedrock:GetGuardrail`
-   `bedrock:GetInferenceProfile`
-   `bedrock:GetKnowledgeBase`
-   `bedrock:GetModelCustomizationJob`
-   `bedrock:GetModelInvocationLoggingConfiguration`
-   `bedrock:GetProvisionedModelThroughput`
-   `bedrock:ListAgentActionGroups`
-   `bedrock:ListAgents`
-   `bedrock:ListCustomModels`
-   `bedrock:ListDataSources`
-   `bedrock:ListEvaluationJobs`
-   `bedrock:ListFlows`
-   `bedrock:ListFoundationModels`
-   `bedrock:ListGuardrails`
-   `bedrock:ListInferenceProfiles`
-   `bedrock:ListKnowledgeBases`
-   `bedrock:ListModelCustomizationJobs`
-   `bedrock:ListProvisionedModelThroughputs`
-   `cloudformation:DescribeStacks`
-   `cloudformation:ListStacks`
-   `cloudfront:GetDistributionConfig`
-   `cloudfront:ListDistributions`
-   `cloudfront:ListKeyGroups`
-   `cloudfront:ListPublicKeys`
-   `cloudfront:ListTagsForResource`
-   `cloudhsm:DescribeBackups`
-   `cloudhsm:DescribeClusters`
-   `cloudhsm:ListTags`
-   `cloudtrail:DescribeTrails`
-   `cloudtrail:GetEventSelectors`
-   `cloudtrail:GetTrailStatus`
-   `cloudtrail:ListTags`
-   `cloudwatch:DescribeAlarms`
-   `cloudwatch:GetMetricData`
-   `cloudwatch:ListTagsForResource`
-   `codeartifact:DescribeDomain`
-   `codeartifact:DescribeRepository`
-   `codeartifact:GetDomainPermissionsPolicy`
-   `codeartifact:GetRepositoryEndpoint`
-   `codeartifact:GetRepositoryPermissionsPolicy`
-   `codeartifact:ListDomains`
-   `codeartifact:ListPackageGroups`
-   `codeartifact:ListPackages`
-   `codeartifact:ListRepositories`
-   `codeartifact:ListTagsForResource`
-   `codebuild:BatchGetProjects`
-   `codebuild:BatchGetReportGroups`
-   `codebuild:GetResourcePolicy`
-   `codebuild:ListProjects`
-   `codebuild:ListReportGroups`
-   `codecommit:GetRepository`
-   `codecommit:ListRepositories`
-   `codecommit:ListTagsForResource`
-   `codedeploy:BatchGetApplications`
-   `codedeploy:BatchGetDeploymentGroups`
-   `codedeploy:GetDeploymentConfig`
-   `codedeploy:ListApplications`
-   `codedeploy:ListDeploymentConfigs`
-   `codedeploy:ListDeploymentGroups`
-   `codedeploy:ListTagsForResource`
-   `codeguru-profiler:ListProfilingGroups`
-   `codeguru-reviewer:DescribeRepositoryAssociation`
-   `codeguru-reviewer:ListRepositoryAssociations`
-   `codeguru-reviewer:ListTagsForResource`
-   `codepipeline:GetPipeline`
-   `codepipeline:ListPipelines`
-   `cognito-identity:DescribeIdentityPool`
-   `cognito-identity:ListIdentityPools`
-   `cognito-idp:DescribeRiskConfiguration`
-   `cognito-idp:DescribeUserPool`
-   `cognito-idp:DescribeUserPoolClient`
-   `cognito-idp:DescribeUserPoolDomain`
-   `cognito-idp:ListUserPoolClients`
-   `cognito-idp:ListUserPools`
-   `cognito-idp:ListUsers`
-   `config:BatchGetResourceConfig`
-   `config:DescribeComplianceByConfigRule`
-   `config:DescribeConfigRules`
-   `config:GetComplianceDetailsByConfigRule`
-   `datasync:DescribeLocationEfs`
-   `datasync:DescribeLocationFsxLustre`
-   `datasync:DescribeLocationFsxOntap`
-   `datasync:DescribeLocationFsxOpenZfs`
-   `datasync:DescribeLocationFsxWindows`
-   `datasync:DescribeLocationHdfs`
-   `datasync:DescribeLocationNfs`
-   `datasync:DescribeLocationObjectStorage`
-   `datasync:DescribeLocationS3`
-   `datasync:DescribeLocationSmb`
-   `datasync:DescribeTask`
-   `datasync:ListLocations`
-   `datasync:ListTagsForResource`
-   `datasync:ListTasks`
-   `dax:DescribeClusters`
-   `detective:GetInvestigation`
-   `detective:ListGraphs`
-   `detective:ListInvestigations`
-   `detective:ListTagsForResource`
-   `devops-guru:DescribeAccountHealth`
-   `devops-guru:DescribeServiceIntegration`
-   `devops-guru:ListAnomaliesForInsight`
-   `devops-guru:ListInsights`
-   `devops-guru:ListNotificationChannels`
-   `directconnect:DescribeConnections`
-   `directconnect:DescribeDirectConnectGateways`
-   `directconnect:DescribeLags`
-   `directconnect:DescribeVirtualInterfaces`
-   `dms:DescribeEndpoints`
-   `dms:DescribeReplicationInstances`
-   `dms:ListTagsForResource`
-   `ds:DescribeDirectories`
-   `dynamodb:DescribeContinuousBackups`
-   `dynamodb:DescribeGlobalTable`
-   `dynamodb:DescribeTable`
-   `dynamodb:ListBackups`
-   `dynamodb:ListGlobalTables`
-   `dynamodb:ListTables`
-   `dynamodb:ListTagsOfResource`
-   `ec2:DescribeAddresses`
-   `ec2:DescribeCustomerGateways`
-   `ec2:DescribeFlowLogs`
-   `ec2:DescribeHosts`
-   `ec2:DescribeIamInstanceProfileAssociations`
-   `ec2:DescribeImageAttribute`
-   `ec2:DescribeImages`
-   `ec2:DescribeInstanceAttribute`
-   `ec2:DescribeInstances`
-   `ec2:DescribeInternetGateways`
-   `ec2:DescribeKeyPairs`
-   `ec2:DescribeLaunchTemplateVersions`
-   `ec2:DescribeLaunchTemplates`
-   `ec2:DescribeManagedPrefixLists`
-   `ec2:DescribeNatGateways`
-   `ec2:DescribeNetworkAcls`
-   `ec2:DescribeNetworkInterfaces`
-   `ec2:DescribeRegions`
-   `ec2:DescribeRouteTables`
-   `ec2:DescribeSecurityGroups`
-   `ec2:DescribeSnapshotAttribute`
-   `ec2:DescribeSnapshots`
-   `ec2:DescribeSubnets`
-   `ec2:DescribeTransitGatewayAttachments`
-   `ec2:DescribeTransitGatewayRouteTables`
-   `ec2:DescribeTransitGatewayVpcAttachments`
-   `ec2:DescribeTransitGateways`
-   `ec2:DescribeVolumes`
-   `ec2:DescribeVpcEndpointConnections`
-   `ec2:DescribeVpcEndpointServiceConfigurations`
-   `ec2:DescribeVpcEndpointServicePermissions`
-   `ec2:DescribeVpcEndpointServices`
-   `ec2:DescribeVpcEndpoints`
-   `ec2:DescribeVpcPeeringConnections`
-   `ec2:DescribeVpcs`
-   `ec2:DescribeVpnConnections`
-   `ec2:DescribeVpnGateways`
-   `ec2:GetEbsDefaultKmsKeyId`
-   `ec2:GetEbsEncryptionByDefault`
-   `ec2:GetManagedPrefixListEntries`
-   `ecr:DescribeImageScanFindings`
-   `ecr:DescribeImages`
-   `ecr:DescribeRepositories`
-   `ecr:GetLifecyclePolicy`
-   `ecr:GetRepositoryPolicy`
-   `ecr:ListTagsForResource`
-   `ecs:DescribeClusters`
-   `ecs:DescribeContainerInstances`
-   `ecs:DescribeServices`
-   `ecs:DescribeTaskDefinition`
-   `ecs:DescribeTasks`
-   `ecs:ListClusters`
-   `ecs:ListContainerInstances`
-   `ecs:ListServices`
-   `ecs:ListTaskDefinitionFamilies`
-   `ecs:ListTasks`
-   `eks:DescribeCluster`
-   `eks:DescribeClusterVersions`
-   `eks:DescribeNodegroup`
-   `eks:ListClusters`
-   `eks:ListNodegroups`
-   `elasticache:DescribeCacheClusters`
-   `elasticache:DescribeCacheSubnetGroups`
-   `elasticache:DescribeReplicationGroups`
-   `elasticache:DescribeSnapshots`
-   `elasticache:ListTagsForResource`
-   `elasticfilesystem:DescribeFileSystemPolicy`
-   `elasticfilesystem:DescribeFileSystems`
-   `elasticfilesystem:DescribeMountTargetSecurityGroups`
-   `elasticfilesystem:DescribeMountTargets`
-   `elasticloadbalancing:DescribeListeners`
-   `elasticloadbalancing:DescribeLoadBalancerAttributes`
-   `elasticloadbalancing:DescribeLoadBalancers`
-   `elasticloadbalancing:DescribeRules`
-   `elasticloadbalancing:DescribeTags`
-   `elasticloadbalancing:DescribeTargetGroups`
-   `elasticloadbalancing:DescribeTargetHealth`
-   `elasticmapreduce:DescribeCluster`
-   `elasticmapreduce:DescribeSecurityConfiguration`
-   `elasticmapreduce:ListClusters`
-   `elasticmapreduce:ListInstances`
-   `elasticmapreduce:ListSecurityConfigurations`
-   `emr-serverless:GetApplication`
-   `emr-serverless:ListApplications`
-   `es:DescribeDomains`
-   `es:DescribeElasticsearchDomains`
-   `es:ListDomainNames`
-   `es:ListTags`
-   `events:DescribeApiDestination`
-   `events:DescribeArchive`
-   `events:DescribeConnection`
-   `events:DescribeEventBus`
-   `events:ListApiDestinations`
-   `events:ListArchives`
-   `events:ListConnections`
-   `events:ListEndpoints`
-   `events:ListEventBuses`
-   `events:ListRules`
-   `events:ListTagsForResource`
-   `events:ListTargetsByRule`
-   `firehose:DescribeDeliveryStream`
-   `firehose:ListDeliveryStreams`
-   `firehose:ListTagsForDeliveryStream`
-   `fms:ListAppsLists`
-   `fms:ListPolicies`
-   `fms:ListProtocolsLists`
-   `fms:ListResourceSetResources`
-   `fms:ListResourceSets`
-   `fms:ListTagsForResource`
-   `fsx:DescribeFileSystems`
-   `glacier:GetVaultAccessPolicy`
-   `glacier:GetVaultLock`
-   `glacier:ListTagsForVault`
-   `glacier:ListVaults`
-   `globalaccelerator:ListAccelerators`
-   `globalaccelerator:ListCustomRoutingAccelerators`
-   `globalaccelerator:ListCustomRoutingEndpointGroups`
-   `globalaccelerator:ListCustomRoutingListeners`
-   `globalaccelerator:ListEndpointGroups`
-   `globalaccelerator:ListListeners`
-   `globalaccelerator:ListTagsForResource`
-   `glue:GetConnection`
-   `glue:GetConnections`
-   `glue:GetDataCatalogEncryptionSettings`
-   `glue:GetDatabase`
-   `glue:GetDatabases`
-   `glue:GetDevEndpoint`
-   `glue:GetDevEndpoints`
-   `glue:GetJob`
-   `glue:GetResourcePolicy`
-   `glue:GetSecurityConfigurations`
-   `glue:GetTags`
-   `glue:ListJobs`
-   `glue:ListSessions`
-   `grafana:DescribeWorkspace`
-   `grafana:ListWorkspaces`
-   `guardduty:DescribeOrganizationConfiguration`
-   `guardduty:DescribePublishingDestination`
-   `guardduty:GetDetector`
-   `guardduty:GetFindings`
-   `guardduty:ListDetectors`
-   `guardduty:ListFindings`
-   `guardduty:ListOrganizationAdminAccounts`
-   `guardduty:ListPublishingDestinations`
-   `health:DescribeEventDetails`
-   `health:DescribeEvents`
-   `iam:GenerateCredentialReport`
-   `iam:GetAccessKeyLastUsed`
-   `iam:GetAccountPasswordPolicy`
-   `iam:GetAccountSummary`
-   `iam:GetCredentialReport`
-   `iam:GetGroup`
-   `iam:GetGroupPolicy`
-   `iam:GetOpenIDConnectProvider`
-   `iam:GetPolicyVersion`
-   `iam:GetRole`
-   `iam:GetRolePolicy`
-   `iam:GetSAMLProvider`
-   `iam:GetServerCertificate`
-   `iam:GetUser`
-   `iam:GetUserPolicy`
-   `iam:ListAccessKeys`
-   `iam:ListAccountAliases`
-   `iam:ListEntitiesForPolicy`
-   `iam:ListGroupPolicies`
-   `iam:ListGroups`
-   `iam:ListInstanceProfiles`
-   `iam:ListMFADevices`
-   `iam:ListOpenIDConnectProviderTags`
-   `iam:ListOpenIDConnectProviders`
-   `iam:ListPolicies`
-   `iam:ListRolePolicies`
-   `iam:ListRoleTags`
-   `iam:ListRoles`
-   `iam:ListSAMLProviders`
-   `iam:ListServerCertificates`
-   `iam:ListServiceSpecificCredentials`
-   `iam:ListUserPolicies`
-   `iam:ListUserTags`
-   `iam:ListUsers`
-   `identitystore:ListGroupMemberships`
-   `identitystore:ListGroups`
-   `identitystore:ListUsers`
-   `imagebuilder:GetComponent`
-   `imagebuilder:GetContainerRecipe`
-   `imagebuilder:GetDistributionConfiguration`
-   `imagebuilder:GetImage`
-   `imagebuilder:GetImagePipeline`
-   `imagebuilder:GetInfrastructureConfiguration`
-   `imagebuilder:GetLifecyclePolicy`
-   `imagebuilder:GetWorkflow`
-   `imagebuilder:ListComponents`
-   `imagebuilder:ListContainerRecipes`
-   `imagebuilder:ListDistributionConfigurations`
-   `imagebuilder:ListImageBuildVersions`
-   `imagebuilder:ListImagePipelines`
-   `imagebuilder:ListImages`
-   `imagebuilder:ListInfrastructureConfigurations`
-   `imagebuilder:ListLifecyclePolicies`
-   `imagebuilder:ListWorkflows`
-   `inspector2:DescribeOrganizationConfiguration`
-   `inspector2:GetConfiguration`
-   `inspector2:GetDelegatedAdminAccount`
-   `inspector2:GetEncryptionKey`
-   `inspector2:ListCoverage`
-   `inspector2:ListFilters`
-   `inspector2:ListFindings`
-   `inspector2:ListTagsForResource`
-   `inspector:DescribeAssessmentRuns`
-   `inspector:DescribeFindings`
-   `inspector:DescribeRulesPackages`
-   `inspector:ListAssessmentRuns`
-   `inspector:ListFindings`
-   `kafka:GetBootstrapBrokers`
-   `kafka:ListClustersV2`
-   `kafka:ListTagsForResource`
-   `kinesis:DescribeStreamSummary`
-   `kinesis:ListStreamConsumers`
-   `kinesis:ListStreams`
-   `kinesis:ListTagsForStream`
-   `kms:DescribeKey`
-   `kms:GetKeyPolicy`
-   `kms:GetKeyRotationStatus`
-   `kms:ListAliases`
-   `kms:ListKeys`
-   `kms:ListResourceTags`
-   `lambda:GetFunction`
-   `lambda:GetFunctionUrlConfig`
-   `lambda:GetPolicy`
-   `lambda:ListCodeSigningConfigs`
-   `lambda:ListFunctions`
-   `lambda:ListFunctionsByCodeSigningConfig`
-   `lambda:ListTags`
-   `lex:DescribeResourcePolicy`
-   `lex:ListBotAliases`
-   `lex:ListBots`
-   `license-manager:ListLicenses`
-   `license-manager:ListReceivedLicenses`
-   `logs:DescribeDestinations`
-   `logs:DescribeLogGroups`
-   `logs:DescribeMetricFilters`
-   `logs:DescribeSubscriptionFilters`
-   `macie2:GetFindings`
-   `macie2:ListFindings`
-   `mq:DescribeBroker`
-   `mq:ListBrokers`
-   `neptune-graph:GetGraph`
-   `neptune-graph:GetImportTask`
-   `neptune-graph:ListExportTasks`
-   `neptune-graph:ListGraphSnapshots`
-   `neptune-graph:ListGraphs`
-   `neptune-graph:ListImportTasks`
-   `neptune-graph:ListPrivateGraphEndpoints`
-   `neptune-graph:ListTagsForResource`
-   `neptune:DescribeDBClusters`
-   `neptune:DescribeDBInstances`
-   `network-firewall:DescribeFirewall`
-   `network-firewall:DescribeFirewallPolicy`
-   `network-firewall:DescribeRuleGroup`
-   `network-firewall:ListFirewallPolicies`
-   `network-firewall:ListFirewalls`
-   `network-firewall:ListRuleGroups`
-   `networkmanager:GetConnectPeer`
-   `networkmanager:GetCoreNetwork`
-   `networkmanager:GetCoreNetworkPolicy`
-   `networkmanager:ListAttachmentRoutingPolicyAssociations`
-   `networkmanager:ListAttachments`
-   `networkmanager:ListConnectPeers`
-   `networkmanager:ListCoreNetworkPolicyVersions`
-   `networkmanager:ListCoreNetworks`
-   `organizations:DescribeAccount`
-   `organizations:DescribeOrganization`
-   `organizations:DescribeOrganizationalUnit`
-   `organizations:DescribePolicy`
-   `organizations:ListAccounts`
-   `organizations:ListChildren`
-   `organizations:ListPolicies`
-   `organizations:ListRoots`
-   `organizations:ListTagsForResource`
-   `organizations:ListTargetsForPolicy`
-   `quicksight:DescribeAccountSettings`
-   `quicksight:DescribeAccountSubscription`
-   `quicksight:DescribeDashboard`
-   `quicksight:DescribeDashboardPermissions`
-   `quicksight:DescribeDataSet`
-   `quicksight:DescribeDataSource`
-   `quicksight:DescribeIpRestriction`
-   `quicksight:DescribeKeyRegistration`
-   `quicksight:DescribeVpcConnection`
-   `quicksight:ListCustomPermissions`
-   `quicksight:ListDashboards`
-   `quicksight:ListDataSets`
-   `quicksight:ListDataSources`
-   `quicksight:ListGroupMemberships`
-   `quicksight:ListGroups`
-   `quicksight:ListNamespaces`
-   `quicksight:ListTagsForResource`
-   `quicksight:ListUsers`
-   `quicksight:ListVpcConnections`
-   `ram:GetResourceShareAssociations`
-   `ram:GetResourceShareInvitations`
-   `ram:GetResourceShares`
-   `ram:ListResources`
-   `rds:DescribeDBClusterParameterGroups`
-   `rds:DescribeDBClusterParameters`
-   `rds:DescribeDBClusterSnapshots`
-   `rds:DescribeDBClusters`
-   `rds:DescribeDBInstances`
-   `rds:DescribeDBParameterGroups`
-   `rds:DescribeDBParameters`
-   `rds:DescribeDBProxies`
-   `rds:DescribeDBProxyTargetGroups`
-   `rds:DescribeDBProxyTargets`
-   `rds:DescribeDBSnapshots`
-   `rds:DescribeDBSubnetGroups`
-   `rds:DescribeOptionGroups`
-   `redshift-serverless:ListEndpointAccess`
-   `redshift-serverless:ListNamespaces`
-   `redshift-serverless:ListRecoveryPoints`
-   `redshift-serverless:ListSnapshots`
-   `redshift-serverless:ListTagsForResource`
-   `redshift-serverless:ListUsageLimits`
-   `redshift-serverless:ListWorkgroups`
-   `redshift:DescribeClusterParameterGroups`
-   `redshift:DescribeClusterParameters`
-   `redshift:DescribeClusters`
-   `redshift:DescribeDataShares`
-   `redshift:DescribeLoggingStatus`
-   `resource-explorer-2:GetDefaultView`
-   `resource-explorer-2:GetIndex`
-   `resource-explorer-2:GetView`
-   `resource-explorer-2:ListIndexes`
-   `resource-explorer-2:ListTagsForResource`
-   `resource-explorer-2:ListViews`
-   `rolesanywhere:GetProfile`
-   `rolesanywhere:GetTrustAnchor`
-   `rolesanywhere:ListProfiles`
-   `rolesanywhere:ListTagsForResource`
-   `rolesanywhere:ListTrustAnchors`
-   `route53:GetHostedZone`
-   `route53:ListHostedZones`
-   `route53:ListResourceRecordSets`
-   `route53domains:GetDomainDetail`
-   `route53domains:ListDomains`
-   `route53domains:ListTagsForDomain`
-   `route53resolver:ListResolverRuleAssociations`
-   `route53resolver:ListResolverRules`
-   `route53resolver:ListTagsForResource`
-   `s3:GetAccountPublicAccessBlock`
-   `s3:GetBucketAcl`
-   `s3:GetBucketLocation`
-   `s3:GetBucketLogging`
-   `s3:GetBucketNotification`
-   `s3:GetBucketObjectLockConfiguration`
-   `s3:GetBucketOwnershipControls`
-   `s3:GetBucketPolicy`
-   `s3:GetBucketPolicyStatus`
-   `s3:GetBucketPublicAccessBlock`
-   `s3:GetBucketTagging`
-   `s3:GetBucketVersioning`
-   `s3:GetBucketWebsite`
-   `s3:GetEncryptionConfiguration`
-   `s3:GetInventoryConfiguration`
-   `s3:GetLifecycleConfiguration`
-   `s3:GetReplicationConfiguration`
-   `s3:ListAccessPoints`
-   `s3:ListAllMyBuckets`
-   `sagemaker:DescribeDomain`
-   `sagemaker:DescribeEndpoint`
-   `sagemaker:DescribeEndpointConfig`
-   `sagemaker:DescribeFeatureGroup`
-   `sagemaker:DescribeModel`
-   `sagemaker:DescribeNotebookInstance`
-   `sagemaker:DescribeProcessingJob`
-   `sagemaker:DescribeTrainingJob`
-   `sagemaker:DescribeTransformJob`
-   `sagemaker:ListDomains`
-   `sagemaker:ListEndpoints`
-   `sagemaker:ListFeatureGroups`
-   `sagemaker:ListModels`
-   `sagemaker:ListNotebookInstances`
-   `sagemaker:ListProcessingJobs`
-   `sagemaker:ListTags`
-   `sagemaker:ListTrainingJobs`
-   `sagemaker:ListTransformJobs`
-   `secretsmanager:DescribeSecret`
-   `secretsmanager:GetResourcePolicy`
-   `secretsmanager:ListSecretVersionIds`
-   `secretsmanager:ListSecrets`
-   `securityhub:DescribeHub`
-   `securityhub:DescribeStandards`
-   `securityhub:DescribeStandardsControls`
-   `securityhub:GetEnabledStandards`
-   `securityhub:GetFindings`
-   `servicecatalog:DescribeConstraint`
-   `servicecatalog:DescribePortfolio`
-   `servicecatalog:DescribeProductAsAdmin`
-   `servicecatalog:ListConstraintsForPortfolio`
-   `servicecatalog:ListLaunchPaths`
-   `servicecatalog:ListPortfolios`
-   `servicecatalog:ListPortfoliosForProduct`
-   `servicecatalog:ListPrincipalsForPortfolio`
-   `servicecatalog:ListProvisioningArtifacts`
-   `servicecatalog:ListResourcesForTagOption`
-   `servicecatalog:ListTagOptions`
-   `servicecatalog:SearchProductsAsAdmin`
-   `servicediscovery:GetInstance`
-   `servicediscovery:ListInstances`
-   `servicediscovery:ListNamespaces`
-   `servicediscovery:ListServices`
-   `servicediscovery:ListTagsForResource`
-   `ses:GetConfigurationSet`
-   `ses:GetEmailIdentity`
-   `ses:ListConfigurationSets`
-   `ses:ListEmailIdentities`
-   `ses:ListReceiptFilters`
-   `shield:DescribeDRTAccess`
-   `shield:DescribeEmergencyContactSettings`
-   `shield:DescribeSubscription`
-   `shield:GetSubscriptionState`
-   `shield:ListProtectionGroups`
-   `shield:ListProtections`
-   `shield:ListResourcesInProtectionGroup`
-   `shield:ListTagsForResource`
-   `signer:GetSigningProfile`
-   `signer:ListProfilePermissions`
-   `signer:ListSigningJobs`
-   `signer:ListSigningProfiles`
-   `sns:GetSubscriptionAttributes`
-   `sns:GetTopicAttributes`
-   `sns:ListSubscriptions`
-   `sns:ListTagsForResource`
-   `sns:ListTopics`
-   `sqs:GetQueueAttributes`
-   `sqs:ListQueueTags`
-   `sqs:ListQueues`
-   `ssm:DescribeDocumentPermission`
-   `ssm:DescribeInstanceInformation`
-   `ssm:DescribeInstancePatchStates`
-   `ssm:DescribeParameters`
-   `ssm:DescribePatchBaselines`
-   `ssm:DescribePatchGroupState`
-   `ssm:DescribePatchGroups`
-   `ssm:GetDocument`
-   `ssm:GetServiceSetting`
-   `ssm:ListAssociations`
-   `ssm:ListComplianceItems`
-   `ssm:ListComplianceSummaries`
-   `ssm:ListDocuments`
-   `ssm:ListInventoryEntries`
-   `ssm:ListTagsForResource`
-   `sso:DescribePermissionSet`
-   `sso:GetInlinePolicyForPermissionSet`
-   `sso:ListAccountAssignments`
-   `sso:ListAccountAssignmentsForPrincipal`
-   `sso:ListAccountsForProvisionedPermissionSet`
-   `sso:ListApplications`
-   `sso:ListCustomerManagedPolicyReferencesInPermissionSet`
-   `sso:ListInstances`
-   `sso:ListManagedPoliciesInPermissionSet`
-   `sso:ListPermissionSets`
-   `sso:ListTagsForResource`
-   `states:DescribeStateMachine`
-   `states:ListStateMachines`
-   `states:ListTagsForResource`
-   `storagegateway:DescribeCachediSCSIVolumes`
-   `storagegateway:DescribeGatewayInformation`
-   `storagegateway:DescribeNFSFileShares`
-   `storagegateway:DescribeSMBFileShares`
-   `storagegateway:DescribeStorediSCSIVolumes`
-   `storagegateway:DescribeTapeArchives`
-   `storagegateway:ListFileShares`
-   `storagegateway:ListGateways`
-   `storagegateway:ListTagsForResource`
-   `storagegateway:ListTapePools`
-   `storagegateway:ListTapes`
-   `storagegateway:ListVolumes`
-   `tag:GetResources`
-   `transfer:DescribeServer`
-   `transfer:ListServers`
-   `transfer:ListTagsForResource`
-   `transfer:ListUsers`
-   `vpc-lattice:ListListeners`
-   `vpc-lattice:ListServiceNetworkServiceAssociations`
-   `vpc-lattice:ListServiceNetworkVpcAssociations`
-   `vpc-lattice:ListServiceNetworkVpcEndpointAssociations`
-   `vpc-lattice:ListServiceNetworks`
-   `vpc-lattice:ListServices`
-   `vpc-lattice:ListTargetGroups`
-   `waf:GetWebACL`
-   `waf:ListWebACLs`
-   `wafv2:GetIPSet`
-   `wafv2:GetLoggingConfiguration`
-   `wafv2:GetRuleGroup`
-   `wafv2:GetWebACL`
-   `wafv2:ListIPSets`
-   `wafv2:ListResourcesForWebACL`
-   `wafv2:ListRuleGroups`
-   `wafv2:ListTagsForResource`
-   `wafv2:ListWebACLs`
-   `workspaces:DescribeTags`
-   `workspaces:DescribeWorkspaceBundles`
-   `workspaces:DescribeWorkspaces`
-   `xray:GetEncryptionConfig`
-   `xray:GetGroups`
-   `xray:ListResourcePolicies`
-   `xray:ListTagsForResource`

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (205)

-   `access-analyzer:List*`
-   `account:Get*`
-   `acm-pca:List*`
-   `acm:Describe*`
-   `acm:List*`
-   `airflow:Get*`
-   `airflow:List*`
-   `apigateway:GET arn:aws:apigateway:*::/*`
-   `appconfig:Get*`
-   `appconfig:List*`
-   `aps:Describe*`
-   `aps:Get*`
-   `aps:List*`
-   `athena:Get*`
-   `athena:List*`
-   `auditmanager:Get*`
-   `auditmanager:List*`
-   `autoscaling:Describe*`
-   `aws-marketplace:Get*`
-   `aws-marketplace:List*`
-   `backup:Get*`
-   `backup:List*`
-   `batch:Describe*`
-   `batch:List*`
-   `bedrock-agentcore:Get*`
-   `bedrock-agentcore:List*`
-   `bedrock:Get*`
-   `bedrock:List*`
-   `cloudformation:Describe*`
-   `cloudformation:List*`
-   `cloudfront:Get*`
-   `cloudfront:List*`
-   `cloudhsm:Describe*`
-   `cloudhsm:List*`
-   `cloudtrail:Describe*`
-   `cloudtrail:Get*`
-   `cloudtrail:List*`
-   `cloudwatch:Describe*`
-   `cloudwatch:Get*`
-   `cloudwatch:List*`
-   `codeartifact:Describe*`
-   `codeartifact:Get*`
-   `codeartifact:List*`
-   `codebuild:BatchGet*`
-   `codebuild:Get*`
-   `codebuild:List*`
-   `codecommit:Get*`
-   `codecommit:List*`
-   `codedeploy:BatchGet*`
-   `codedeploy:Get*`
-   `codedeploy:List*`
-   `codeguru-profiler:List*`
-   `codeguru-reviewer:Describe*`
-   `codeguru-reviewer:List*`
-   `codepipeline:Get*`
-   `codepipeline:List*`
-   `cognito-identity:Describe*`
-   `cognito-identity:List*`
-   `cognito-idp:Describe*`
-   `cognito-idp:List*`
-   `config:BatchGet*`
-   `config:Describe*`
-   `config:Get*`
-   `datasync:Describe*`
-   `datasync:List*`
-   `dax:Describe*`
-   `detective:Get*`
-   `detective:List*`
-   `devops-guru:Describe*`
-   `devops-guru:List*`
-   `directconnect:Describe*`
-   `dms:Describe*`
-   `dms:List*`
-   `ds:Describe*`
-   `dynamodb:Describe*`
-   `dynamodb:List*`
-   `ec2:Describe*`
-   `ec2:Get*`
-   `ecr:Describe*`
-   `ecr:Get*`
-   `ecr:List*`
-   `ecs:Describe*`
-   `ecs:List*`
-   `eks:Describe*`
-   `eks:List*`
-   `elasticache:Describe*`
-   `elasticache:List*`
-   `elasticfilesystem:Describe*`
-   `elasticloadbalancing:Describe*`
-   `elasticmapreduce:Describe*`
-   `elasticmapreduce:List*`
-   `emr-serverless:Get*`
-   `emr-serverless:List*`
-   `es:Describe*`
-   `es:List*`
-   `events:List*`
-   `firehose:Describe*`
-   `firehose:List*`
-   `fms:List*`
-   `fsx:Describe*`
-   `glacier:Get*`
-   `glacier:List*`
-   `globalaccelerator:List*`
-   `glue:Get*`
-   `glue:List*`
-   `grafana:Describe*`
-   `grafana:List*`
-   `guardduty:Describe*`
-   `guardduty:Get*`
-   `guardduty:List*`
-   `health:Describe*`
-   `iam:Generate*`
-   `iam:Get*`
-   `iam:List*`
-   `identitystore:List*`
-   `imagebuilder:Get*`
-   `imagebuilder:List*`
-   `inspector2:Describe*`
-   `inspector2:Get*`
-   `inspector2:List*`
-   `inspector:Describe*`
-   `inspector:List*`
-   `kafka:Get*`
-   `kafka:List*`
-   `kinesis:Describe*`
-   `kinesis:List*`
-   `kms:Describe*`
-   `kms:Get*`
-   `kms:List*`
-   `lambda:Get*`
-   `lambda:List*`
-   `lex:Describe*`
-   `lex:List*`
-   `license-manager:List*`
-   `logs:Describe*`
-   `macie2:Get*`
-   `macie2:List*`
-   `mq:Describe*`
-   `mq:List*`
-   `neptune-graph:Get*`
-   `neptune-graph:List*`
-   `neptune:Describe*`
-   `network-firewall:Describe*`
-   `network-firewall:List*`
-   `networkmanager:Get*`
-   `networkmanager:List*`
-   `organizations:Describe*`
-   `organizations:List*`
-   `quicksight:Describe*`
-   `quicksight:List*`
-   `ram:Get*`
-   `ram:List*`
-   `rds:Describe*`
-   `redshift-serverless:List*`
-   `redshift:Describe*`
-   `rolesanywhere:Get*`
-   `rolesanywhere:List*`
-   `route53:Get*`
-   `route53:List*`
-   `route53domains:Get*`
-   `route53domains:List*`
-   `route53resolver:List*`
-   `s3:Get*`
-   `s3:List*`
-   `sagemaker:Describe*`
-   `sagemaker:List*`
-   `secretsmanager:Describe*`
-   `secretsmanager:Get*`
-   `secretsmanager:List*`
-   `securityhub:Describe*`
-   `securityhub:Get*`
-   `servicediscovery:Get*`
-   `servicediscovery:List*`
-   `ses:Get*`
-   `ses:List*`
-   `shield:Describe*`
-   `shield:Get*`
-   `shield:List*`
-   `signer:Get*`
-   `signer:List*`
-   `sns:Get*`
-   `sns:List*`
-   `sqs:Get*`
-   `sqs:List*`
-   `ssm:Describe*`
-   `ssm:Get*`
-   `ssm:List*`
-   `sso:Describe*`
-   `sso:Get*`
-   `sso:List*`
-   `states:Describe*`
-   `states:List*`
-   `storagegateway:Describe*`
-   `storagegateway:List*`
-   `tag:Get*`
-   `transfer:Describe*`
-   `transfer:List*`
-   `vpc-lattice:List*`
-   `waf:Get*`
-   `waf:List*`
-   `wafv2:Get*`
-   `wafv2:List*`
-   `workspaces:Describe*`
-   `xray:Get*`
-   `xray:List*`

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (211)

| Step | Permissions | Roles |
| --- | --- | --- |
| Build AccessAnalyzer Finding Principal Relationships | \- | \- |
| Build ACM Certificate to Cognito User Pool Relationships | `cognito-idp:DescribeUserPoolDomain` | `cognito-idp:Describe*` |
| Build AWS ApiGateway API to Domain Name Relationships | `apigateway:GET arn:aws:apigateway:*::/domainnames/*/apimappings` | `apigateway:GET arn:aws:apigateway:*::/*` |
| Build AWS EC2 VPC Endpoint Service to LB Relationships | \- | \- |
| Build AWS EC2 VPC Endpoint Service to VPC Endpoint Relationships | \- | \- |
| Build Bedrock Action Group to Lambda Function Relationships | \- | \- |
| Build Bedrock Agent Runtime to IAM Role Relationships | \- | \- |
| Build Bedrock Agent Runtime to VPC Relationships | \- | \- |
| Build Bedrock Agent to Foundation Model Relationships | \- | \- |
| Build Bedrock Agent to IAM Role Relationships | \- | \- |
| Build Bedrock Agent to KMS Key Relationships | \- | \- |
| Build Bedrock API Key to IAM User Relationships | \- | \- |
| Build Bedrock Code Interpreter to IAM Role Relationships | \- | \- |
| Build Bedrock Code Interpreter to VPC Relationships | \- | \- |
| Build Bedrock Custom Model to Foundation Model Relationships | \- | \- |
| Build Bedrock Custom Model to KMS Key Relationships | \- | \- |
| Build Bedrock Custom Model to S3 Bucket Relationships | \- | \- |
| Build Bedrock Data Source to S3 Bucket Relationships | \- | \- |
| Build Bedrock Evaluation Job to S3 Bucket Relationships | \- | \- |
| Build Bedrock Flow to IAM Role Relationships | \- | \- |
| Build Bedrock Flow to KMS Key Relationships | \- | \- |
| Build Bedrock Guardrail to Agent Relationships | \- | \- |
| Build Bedrock Guardrail to KMS Key Relationships | \- | \- |
| Build Bedrock Knowledge Base to Foundation Model Relationships | \- | \- |
| Build Bedrock Knowledge Base to IAM Role Relationships | \- | \- |
| Build Bedrock Knowledge Base to OpenSearch Domain Relationships | \- | \- |
| Build Bedrock Logging to CloudWatch Log Group Relationships | \- | \- |
| Build Bedrock Logging to S3 Bucket Relationships | \- | \- |
| Build Bedrock Model Customization Job to S3 Bucket Relationships | \- | \- |
| Build Bedrock Provisioned Throughput to Model Relationships | \- | \- |
| Build CodeArtifact Domain KMS Key Relationships | \- | \- |
| Build CodeArtifact Package Group Parent Relationships | \- | \- |
| Build CodeArtifact VPC Endpoint Relationships | \- | \- |
| Build CodeBuild Project Has VPC Relationship | \- | \- |
| Build CodeDeploy Deployment Group IAM Relationships | \- | \- |
| Build CodeGuru Reviewer Repository Association KMS Key Relationships | \- | \- |
| Build EC2 Instance uses IAM Instance Profile Relationships | `ec2:DescribeIamInstanceProfileAssociations` | `ec2:Describe*` |
| Build EMR Cluster to IAM Relationships | \- | \- |
| Build EMR Cluster to Security Configuration Relationships | \- | \- |
| Build EMR Cluster to VPC Endpoint Relationships | \- | \- |
| Build GuardDuty Publishing Destination to KMS Key Relationships | \- | \- |
| Build GuardDuty Publishing Destination to S3 Bucket Relationships | \- | \- |
| Build IAM Identity Center Group has User relationships | `identitystore:ListGroupMemberships` | `identitystore:List*` |
| Build IAM Identity Center Permission Set relationships | `sso:ListAccountAssignments`, `sso:ListAccountAssignmentsForPrincipal`, `sso:ListAccountsForProvisionedPermissionSet`, `sso:GetInlinePolicyForPermissionSet`, `sso:ListManagedPoliciesInPermissionSet`, `sso:ListCustomerManagedPolicyReferencesInPermissionSet` | `sso:Get*`, `sso:List*` |
| Build IAM Roles Anywhere Profile to IAM Policy Relationships | \- | \- |
| Build IAM Roles Anywhere Profile to IAM Role Relationships | \- | \- |
| Build IAM Roles Anywhere Trust Anchor to ACM PCA Relationships | \- | \- |
| Build Inspector v2 to KMS Key Relationships | \- | \- |
| Build Inspector v2 to Resource Relationships | `inspector2:ListCoverage` | `inspector2:List*` |
| Build Inspector v2 to VPC Endpoint Relationships | \- | \- |
| Build Kinesis Stream to Consumer Relationships | `kinesis:ListStreamConsumers` | `kinesis:List*` |
| Build Launch Template Version to Ami Relationships | \- | \- |
| Build OpenSearch Domain to CloudWatch Log Group Relationships | \- | \- |
| Build Quicksight Group to User Relationships | `quicksight:ListGroupMemberships` | `quicksight:List*` |
| Build Quicksight User to Custom Permissions Relationships | \- | \- |
| Build RDS DB Proxy connects RDS Cluster relationships | \- | \- |
| Build RDS DB Proxy connects RDS DB Instance relationships | \- | \- |
| Build Resource Explorer CloudTrail Relationships | \- | \- |
| Build Resource Explorer VPC Endpoint Relationships | \- | \- |
| Build Route53 Resolver Rules uses VPC relationships | `route53resolver:ListResolverRuleAssociations` | `route53resolver:List*` |
| Build S3 Bucket Lifecycle Rules | `s3:GetLifecycleConfiguration` | `s3:Get*` |
| Build SageMaker Domain Relationships | \- | \- |
| Build SageMaker Endpoint Relationships | \- | \- |
| Build SageMaker Feature Group Relationships | \- | \- |
| Build SageMaker Processing Job Relationships | \- | \- |
| Build SageMaker Training Job Relationships | \- | \- |
| Build SageMaker Transform Job Relationships | \- | \- |
| Build Service Catalog Portfolio Product Relationships | `servicecatalog:ListPortfoliosForProduct` | \- |
| Build Service Catalog Principal Relationships | `servicecatalog:ListPrincipalsForPortfolio` | \- |
| Build Shared DB Cluster Snapshot to Account Relationships | `rds:DescribeDBClusterSnapshots` | `rds:Describe*` |
| Build Shared DB Snapshot to Account Relationships | `rds:DescribeDBSnapshots` | `rds:Describe*` |
| Build States to CloudWatch Log Group Relationships | \- | \- |
| Build States to IAM Relationships | \- | \- |
| Build VPC Endpoint to Service Relationships | \- | \- |
| Build VPC has OpenSearch Domain Relationships | \- | \- |
| Build WAF v2 Web ACL to Resource Relationships | `wafv2:ListResourcesForWebACL` | `wafv2:List*` |
| Build WAF Web ACL to Cognito User Pool Relationships | `wafv2:ListResourcesForWebACL` | `wafv2:List*` |
| Fetch AccessAnalyzer Findings | `access-analyzer:ListFindings` | `access-analyzer:List*` |
| Fetch ApiGateway Api to Integration Relationship | `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources`, `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration` | `apigateway:GET arn:aws:apigateway:*::/*` |
| Fetch ApiGateway Resources | `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources`, `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*` | `apigateway:GET arn:aws:apigateway:*::/*` |
| Fetch ApiGateway Stages | `apigateway:GET arn:aws:apigateway:*::/restapis/*/stages`, `apigateway:GET arn:aws:apigateway:*::/restapis/*/stages/*` | `apigateway:GET arn:aws:apigateway:*::/*` |
| Fetch ApiGatewayV2 Authorizers | `apigateway:GET arn:aws:apigateway:*::/apis/*/authorizers` | `apigateway:GET arn:aws:apigateway:*::/*` |
| Fetch ApiGatewayV2 Integrations | `apigateway:GET arn:aws:apigateway:*::/apis/*/integrations` | `apigateway:GET arn:aws:apigateway:*::/*` |
| Fetch ApiGatewayV2 Routes | `apigateway:GET arn:aws:apigateway:*::/apis/*/routes` | `apigateway:GET arn:aws:apigateway:*::/*` |
| Fetch ApiGatewayV2 Stages | `apigateway:GET arn:aws:apigateway:*::/apis/*/stages` | `apigateway:GET arn:aws:apigateway:*::/*` |
| Fetch AppConfig Configuration Profiles | `appconfig:ListConfigurationProfiles`, `appconfig:GetConfigurationProfile` | `appconfig:List*`, `appconfig:Get*` |
| Fetch AppConfig Deployments | `appconfig:ListDeployments`, `appconfig:GetDeployment`, `appconfig:ListTagsForResource` | `appconfig:List*`, `appconfig:Get*` |
| Fetch AppConfig Environments | `appconfig:ListEnvironments` | `appconfig:List*` |
| Fetch AppConfig Hosted Configuration Versions | `appconfig:ListHostedConfigurationVersions` | `appconfig:List*` |
| Fetch Audit Manager Evidence Folders | `auditmanager:GetEvidenceFoldersByAssessmentControl` | `auditmanager:Get*` |
| Fetch Autoscaling Launch Config to Image Relationships | `ec2:DescribeImages` | `ec2:Describe*` |
| Fetch AWS EC2 Images | `ec2:DescribeImages`, `ec2:DescribeImageAttribute` | `ec2:Describe*` |
| Fetch AWS EC2 Internet Gateways | `ec2:DescribeInternetGateways` | `ec2:Describe*` |
| Fetch AWS EC2 Launch Template Versions | `ec2:DescribeLaunchTemplateVersions` | `ec2:Describe*` |
| Fetch AWS EC2 NAT Gateways | `ec2:DescribeNatGateways` | `ec2:Describe*` |
| Fetch AWS EC2 Subnets | `ec2:DescribeSubnets` | `ec2:Describe*` |
| Fetch AWS EC2 Volumes | `ec2:DescribeVolumes` | `ec2:Describe*` |
| Fetch AWS EC2 VPC Endpoints | `ec2:DescribeVpcEndpoints` | `ec2:Describe*` |
| Fetch AWS EC2 VPN Gateways | `ec2:DescribeVpnGateways`, `ec2:DescribeCustomerGateways` | `ec2:Describe*` |
| Fetch AWS EMR Instances | `elasticmapreduce:ListInstances` | `elasticmapreduce:List*` |
| Fetch AWS Organization | `organizations:DescribeOrganization`, `organizations:ListAccounts`, `organizations:ListTagsForResource` | `organizations:Describe*`, `organizations:List*` |
| Fetch Backup Copy Jobs | `backup:ListCopyJobs` | `backup:List*` |
| Fetch Backup Jobs | `backup:ListBackupJobs` | `backup:List*` |
| Fetch Backup Recovery Points | `backup:ListRecoveryPointsByBackupVault`, `backup:ListTagsForResource` | `backup:List*` |
| Fetch Backup Restore Jobs | `backup:ListRestoreJobs` | `backup:List*` |
| Fetch Batch Jobs | `batch:ListJobs` | `batch:List*` |
| Fetch Bedrock Agent Action Groups | `bedrock:ListAgentActionGroups`, `bedrock:GetAgentActionGroup` | `bedrock:Get*`, `bedrock:List*` |
| Fetch Bedrock Knowledge Base Data Sources | `bedrock:ListDataSources`, `bedrock:GetDataSource` | `bedrock:Get*`, `bedrock:List*` |
| Fetch Cloudfront Key Groups | `cloudfront:ListKeyGroups` | `cloudfront:List*` |
| Fetch Cloudhsm Backups | `cloudhsm:DescribeBackups` | `cloudhsm:Describe*` |
| Fetch CloudMap Service Instances | `servicediscovery:ListInstances`, `servicediscovery:GetInstance` | `servicediscovery:Get*`, `servicediscovery:List*` |
| Fetch CloudMap Services | `servicediscovery:ListServices`, `servicediscovery:ListTagsForResource` | `servicediscovery:Get*`, `servicediscovery:List*` |
| Fetch Cloudtrail Event Selectors | `cloudtrail:DescribeTrails`, `cloudtrail:GetEventSelectors` | `cloudtrail:Describe*`, `cloudtrail:Get*` |
| Fetch CloudWAN Attachments | `networkmanager:ListAttachments`, `networkmanager:ListAttachmentRoutingPolicyAssociations` | `networkmanager:List*` |
| Fetch CloudWAN Connect Peers | `networkmanager:ListConnectPeers`, `networkmanager:GetConnectPeer` | `networkmanager:List*`, `networkmanager:Get*` |
| Fetch CloudWAN Core Network Policies | `networkmanager:GetCoreNetworkPolicy` | `networkmanager:Get*` |
| Fetch CloudWatch Log Group Metrics | `cloudwatch:GetMetricData` | `cloudwatch:Get*` |
| Fetch Cloudwatch Logs Metric Filters | `logs:DescribeMetricFilters` | `logs:Describe*` |
| Fetch Cloudwatch Logs Subscription Filters | `logs:DescribeSubscriptionFilters` | `logs:Describe*` |
| Fetch CodeArtifact Package Groups | `codeartifact:ListPackageGroups`, `codeartifact:ListTagsForResource` | `codeartifact:List*` |
| Fetch CodeArtifact Packages | `codeartifact:ListPackages` | `codeartifact:List*` |
| Fetch CodeArtifact Repositories | `codeartifact:ListRepositories`, `codeartifact:DescribeRepository`, `codeartifact:GetRepositoryPermissionsPolicy`, `codeartifact:GetRepositoryEndpoint`, `codeartifact:ListTagsForResource` | `codeartifact:List*`, `codeartifact:Describe*`, `codeartifact:Get*` |
| Fetch CodeDeploy Deployment Groups | `codedeploy:ListDeploymentGroups`, `codedeploy:BatchGetDeploymentGroups`, `codedeploy:ListTagsForResource` | `codedeploy:BatchGet*`, `codedeploy:List*` |
| Fetch Cognito IDP User Pool Clients | `cognito-idp:ListUserPoolClients`, `cognito-idp:DescribeUserPoolClient` | `cognito-idp:Describe*`, `cognito-idp:List*` |
| Fetch Cognito IDP User Pool Users | `cognito-idp:ListUsers` | `cognito-idp:List*` |
| Fetch DataSync Locations | `datasync:ListLocations`, `datasync:DescribeLocationS3`, `datasync:DescribeLocationEfs`, `datasync:DescribeLocationFsxWindows`, `datasync:DescribeLocationFsxLustre`, `datasync:DescribeLocationFsxOntap`, `datasync:DescribeLocationFsxOpenZfs`, `datasync:DescribeLocationNfs`, `datasync:DescribeLocationSmb`, `datasync:DescribeLocationObjectStorage`, `datasync:DescribeLocationHdfs`, `datasync:ListTagsForResource` | `datasync:Describe*`, `datasync:List*` |
| Fetch DataSync Tasks | `datasync:ListTasks`, `datasync:DescribeTask`, `datasync:ListTagsForResource` | `datasync:Describe*`, `datasync:List*` |
| Fetch Detective Investigations | `detective:ListInvestigations`, `detective:GetInvestigation` | `detective:Get*`, `detective:List*` |
| Fetch DevOps Guru Anomalies | `devops-guru:ListAnomaliesForInsight` | `devops-guru:List*` |
| Fetch DevOps Guru Notification Channels | `devops-guru:ListNotificationChannels` | `devops-guru:List*` |
| Fetch EC2 Transit Gateway Attachments | `ec2:DescribeTransitGatewayAttachments` | `ec2:Describe*` |
| Fetch EC2 Transit Gateway Route Tables | `ec2:DescribeTransitGatewayRouteTables` | `ec2:Describe*` |
| Fetch EC2 Transit Gateway VPC Attachments | `ec2:DescribeTransitGatewayVpcAttachments` | `ec2:Describe*` |
| Fetch ECR Image Findings | `ecr:DescribeImageScanFindings` | `ecr:Describe*` |
| Fetch ECR Images | `ecr:DescribeImages` | `ecr:Describe*` |
| Fetch ECS Cluster Services | `ecs:ListServices`, `ecs:DescribeServices` | `ecs:Describe*`, `ecs:List*` |
| Fetch ECS Container Instances | `ecs:DescribeContainerInstances`, `ecs:ListContainerInstances` | `ecs:Describe*`, `ecs:List*` |
| Fetch ECS Task Definitions | `ecs:DescribeTaskDefinition`, `ecs:ListTaskDefinitionFamilies` | `ecs:Describe*`, `ecs:List*` |
| Fetch ECS Tasks | `ecs:DescribeTasks`, `ecs:ListTasks` | `ecs:Describe*`, `ecs:List*` |
| Fetch EFS Mount Targets | `elasticfilesystem:DescribeMountTargetSecurityGroups`, `elasticfilesystem:DescribeMountTargets` | `elasticfilesystem:Describe*` |
| Fetch EKS Node Groups | `eks:ListNodegroups`, `eks:DescribeNodegroup` | `eks:Describe*`, `eks:List*` |
| Fetch Elasticache Clusters Subnet Groups | `elasticache:DescribeCacheSubnetGroups` | `elasticache:Describe*` |
| Fetch Elasticache Snapshots | `elasticache:ListTagsForResource`, `elasticache:DescribeSnapshots` | `elasticache:Describe*`, `elasticache:List*` |
| Fetch ELB Listener Rules | `elasticloadbalancing:DescribeTags`, `elasticloadbalancing:DescribeRules` | `elasticloadbalancing:Describe*` |
| Fetch ELB Listeners | `elasticloadbalancing:DescribeTags`, `elasticloadbalancing:DescribeListeners` | `elasticloadbalancing:Describe*` |
| Fetch ELB Target Groups | `elasticloadbalancing:DescribeTags`, `elasticloadbalancing:DescribeTargetGroups`, `elasticloadbalancing:DescribeTargetHealth` | `elasticloadbalancing:Describe*` |
| Fetch Firewall Manager Resource Set Resources | `fms:ListResourceSetResources` | `fms:List*` |
| Fetch Global Accelerator Custom Routing Endpoint Groups | `globalaccelerator:ListCustomRoutingEndpointGroups` | `globalaccelerator:List*` |
| Fetch Global Accelerator Custom Routing Listeners | `globalaccelerator:ListCustomRoutingListeners` | `globalaccelerator:List*` |
| Fetch Global Accelerator Endpoint Groups | `globalaccelerator:ListEndpointGroups` | `globalaccelerator:List*` |
| Fetch Global Accelerator Listeners | `globalaccelerator:ListListeners` | `globalaccelerator:List*` |
| Fetch Guardduty Findings | `guardduty:ListFindings`, `guardduty:GetFindings` | `guardduty:Get*`, `guardduty:List*` |
| Fetch GuardDuty Publishing Destinations | `guardduty:ListPublishingDestinations`, `guardduty:DescribePublishingDestination` | `guardduty:List*`, `guardduty:Describe*` |
| Fetch IAM Group Policies | `iam:ListGroupPolicies`, `iam:GetGroupPolicy` | `iam:Get*`, `iam:List*` |
| Fetch IAM Group to User Relationships | `iam:GetGroup` | `iam:Get*` |
| Fetch IAM Identity Center Applications | `sso:ListApplications` | `sso:List*` |
| Fetch IAM Identity Center Groups | `identitystore:ListGroups` | `identitystore:List*` |
| Fetch IAM Identity Center Permission Sets | `sso:ListPermissionSets`, `sso:DescribePermissionSet`, `sso:ListTagsForResource` | `sso:Describe*`, `sso:List*` |
| Fetch IAM Identity Center Users | `identitystore:ListUsers` | `identitystore:List*` |
| Fetch IAM Policies | `iam:ListPolicies`, `iam:GetPolicyVersion`, `iam:ListEntitiesForPolicy`, `tag:GetResources` | `iam:Get*`, `iam:List*`, `tag:Get*` |
| Fetch IAM Role Policies | `iam:ListRolePolicies`, `iam:GetRolePolicy` | `iam:Get*`, `iam:List*` |
| Fetch IAM Roles | `iam:ListInstanceProfiles`, `iam:GetRole`, `iam:ListRoles`, `iam:ListRoleTags` | `iam:Get*`, `iam:List*` |
| Fetch IAM User Policies | `iam:ListUserPolicies`, `iam:GetUserPolicy` | `iam:Get*`, `iam:List*` |
| Fetch IAM Users | `iam:GetUser`, `iam:ListUsers`, `iam:ListUserTags`, `iam:ListAccessKeys`, `iam:ListMFADevices`, `iam:GetAccessKeyLastUsed` | `iam:Get*`, `iam:List*` |
| Fetch Inspector Findings | `inspector:DescribeFindings`, `inspector:DescribeRulesPackages`, `inspector:ListFindings` | `inspector:Describe*`, `inspector:List*` |
| Fetch Instance to Image Relationships | `ec2:DescribeImages` | `ec2:Describe*` |
| Fetch Lex V2 Bot Aliases | `lex:ListBotAliases`, `lex:DescribeResourcePolicy` | `lex:Describe*`, `lex:List*` |
| Fetch Marketplace Entitlements | `aws-marketplace:GetEntitlements` | `aws-marketplace:Get*` |
| Fetch Neptune Analytics Graph Export Tasks | `neptune-graph:ListExportTasks` | `neptune-graph:List*` |
| Fetch Neptune Analytics Graph Import Tasks | `neptune-graph:ListImportTasks`, `neptune-graph:GetImportTask` | `neptune-graph:Get*`, `neptune-graph:List*` |
| Fetch Neptune Analytics Graph Snapshots | `neptune-graph:ListGraphSnapshots`, `neptune-graph:ListTagsForResource` | `neptune-graph:List*` |
| Fetch Organization Policy Targets | `organizations:ListTargetsForPolicy` | `organizations:List*` |
| Fetch Organization Roots | `organizations:ListRoots` | `organizations:List*` |
| Fetch Organizational Units | `organizations:DescribeOrganizationalUnit`, `organizations:ListChildren` | `organizations:Describe*`, `organizations:List*` |
| Fetch Quicksight Dashboards | `quicksight:ListDashboards`, `quicksight:DescribeDashboard`, `quicksight:DescribeDashboardPermissions` | `quicksight:Describe*`, `quicksight:List*` |
| Fetch Quicksight Data Sets | `quicksight:ListDataSets`, `quicksight:DescribeDataSet` | `quicksight:Describe*`, `quicksight:List*` |
| Fetch Quicksight Data Sources | `quicksight:ListDataSources`, `quicksight:DescribeDataSource` | `quicksight:Describe*`, `quicksight:List*` |
| Fetch RAM Resource Share Associations | `ram:GetResourceShareAssociations` | `ram:Get*` |
| Fetch RAM Resource Share Invitations | `ram:GetResourceShareInvitations` | `ram:Get*` |
| Fetch RAM Shared Resources | `ram:ListResources` | `ram:List*` |
| Fetch RDS DB Proxy Target Groups | `rds:DescribeDBProxyTargetGroups` | `rds:Describe*` |
| Fetch Restore Testing Plans | `backup:ListRestoreTestingPlans`, `backup:ListTags` | `backup:List*` |
| Fetch Route53 Records | `route53:ListResourceRecordSets` | `route53:List*` |
| Fetch S3 Access Points | `s3:ListAccessPoints` | `s3:List*` |
| Fetch S3 Buckets | `cloudwatch:GetMetricData`, `s3:ListAllMyBuckets`, `s3:GetBucketLocation`, `s3:GetBucketPolicy`, `s3:GetBucketTagging`, `s3:GetBucketAcl`, `s3:GetBucketLogging`, `s3:GetBucketNotification`, `s3:GetBucketVersioning`, `s3:GetReplicationConfiguration`, `s3:GetBucketPublicAccessBlock`, `s3:GetBucketObjectLockConfiguration`, `s3:GetLifecycleConfiguration`, `s3:GetBucketOwnershipControls`, `s3:GetBucketPolicyStatus`, `s3:GetEncryptionConfiguration`, `s3:GetInventoryConfiguration` | `cloudwatch:Get*`, `s3:Get*`, `s3:List*` |
| Fetch S3 Buckets Website Config | `s3:GetBucketWebsite` | `s3:Get*` |
| Fetch Secret Versions | `secretsmanager:ListSecretVersionIds` | `secretsmanager:List*` |
| Fetch Secrets | `secretsmanager:ListSecrets`, `secretsmanager:DescribeSecret`, `secretsmanager:GetResourcePolicy` | `secretsmanager:Describe*`, `secretsmanager:Get*`, `secretsmanager:List*` |
| Fetch Service Catalog Constraints | `servicecatalog:ListConstraintsForPortfolio`, `servicecatalog:DescribeConstraint` | \- |
| Fetch Service Catalog Launch Paths | `servicecatalog:ListLaunchPaths` | \- |
| Fetch Service Catalog Provisioning Artifacts | `servicecatalog:ListProvisioningArtifacts` | \- |
| Fetch Service Catalog Tag Options | `servicecatalog:ListTagOptions`, `servicecatalog:ListResourcesForTagOption` | \- |
| Fetch Signer Signing Jobs | `signer:ListSigningJobs` | `signer:List*` |
| Fetch Signer Signing Profiles | `signer:ListSigningProfiles`, `signer:GetSigningProfile`, `signer:ListProfilePermissions` | `signer:List*`, `signer:Get*` |
| Fetch SSM Instance Inventory Entries | `ssm:ListInventoryEntries` | `ssm:List*` |
| Fetch SSM Instance Patch States | `ssm:DescribeInstancePatchStates` | `ssm:Describe*` |
| Fetch SSM Service to EC2 Instance Relationships | `ssm:DescribeInstanceInformation` | `ssm:Describe*` |
| Fetch Storage Gateway File Shares | `storagegateway:ListFileShares`, `storagegateway:DescribeNFSFileShares`, `storagegateway:DescribeSMBFileShares`, `storagegateway:ListTagsForResource` | `storagegateway:Describe*`, `storagegateway:List*` |
| Fetch Storage Gateway Tapes | `storagegateway:ListTapes`, `storagegateway:DescribeTapeArchives`, `storagegateway:ListTagsForResource` | `storagegateway:Describe*`, `storagegateway:List*` |
| Fetch Storage Gateway Volumes | `storagegateway:ListVolumes`, `storagegateway:DescribeCachediSCSIVolumes`, `storagegateway:DescribeStorediSCSIVolumes`, `storagegateway:ListTagsForResource` | `storagegateway:Describe*`, `storagegateway:List*` |
| Fetch Transfer Servers details | \- | \- |
| Fetch Transfer Users | `transfer:ListUsers`, `transfer:ListTagsForResource` | `transfer:List*` |
| Fetch VPC Lattice Listeners | `vpc-lattice:ListListeners` | `vpc-lattice:List*` |
| Fetch VPC Lattice Networks | `vpc-lattice:ListServiceNetworks` | `vpc-lattice:List*` |
| Fetch VPC Lattice Service Network Service Associations | `vpc-lattice:ListServiceNetworkServiceAssociations` | `vpc-lattice:List*` |
| Fetch VPC Lattice Service Network VPC Associations | `vpc-lattice:ListServiceNetworkVpcAssociations` | `vpc-lattice:List*` |
| Fetch VPC Lattice Service Network VPC Endpoint Associations | `vpc-lattice:ListServiceNetworkVpcEndpointAssociations` | `vpc-lattice:List*` |
| Fetch VPC Lattice Services | `vpc-lattice:ListServices` | `vpc-lattice:List*` |
| Fetch VPC Lattice Target Groups | `vpc-lattice:ListTargetGroups` | `vpc-lattice:List*` |
| Fetch VPC to VPC Relationships | `ec2:DescribeVpcPeeringConnections` | `ec2:Describe*` |
| Fetch WAF v2 IP Sets | `wafv2:GetIPSet`, `wafv2:ListIPSets`, `wafv2:ListTagsForResource` | `wafv2:Get*`, `wafv2:List*` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| AccessAnalyzer Analyzer | `aws_accessanalyzer_analyzer` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment), [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| AccessAnalyzer Finding | `aws_accessanalyzer_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| ACM Certificate | `aws_acm_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| Amazon Managed Grafana | `aws_grafana` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Amazon Managed Service for Prometheus | `aws_prometheus` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| ApiGateway Domain Name | `aws_api_gateway_domain_name` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| ApiGateway Resource | `aws_api_gateway_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| ApiGateway Resource Method | `aws_api_gateway_method` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| ApiGateway Rest Api | `aws_api_gateway_rest_api` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ApiGateway Stage | `aws_api_gateway_stage` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| ApiGateway Stage Method Setting | `aws_api_gateway_stage_method_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ApiGatewayV2 Api | `aws_api_gateway_v2_api` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ApiGatewayV2 Authorizer | `aws_api_gateway_v2_authorizer` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ApiGatewayV2 Integration | `aws_api_gateway_v2_integration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ApiGatewayV2 Route | `aws_api_gateway_v2_route` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| ApiGatewayV2 Stage | `aws_api_gateway_v2_stage` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Athena Work Group | `aws_athena_work_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Audit Manager Assessment | `aws_auditmanager_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Audit Manager Control | `aws_auditmanager_control` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Audit Manager Evidence Folder | `aws_auditmanager_evidence_folder` | [DataObject](https://docs.jupiterone.io/data-model/schemas/DataObject) |
| Audit Manager Framework | `aws_auditmanager_framework` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Autoscaling Group | `aws_autoscaling_group` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Autoscaling Launch Configuration | `aws_autoscaling_launch_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Autoscaling Policy | `aws_autoscaling_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AccessAnalyzer Service | `aws_accessanalyzer` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Account | `aws_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AWS ACM Service | `aws_acm` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS ApiGateway Service | `aws_apigateway` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS AppConfig | `aws_appconfig` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS AppConfig Account Settings | `aws_appconfig_account_settings` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AppConfig Application | `aws_appconfig_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS AppConfig Configuration Profile | `aws_appconfig_configuration_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AppConfig Deployment | `aws_appconfig_deployment` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| AWS AppConfig Deployment Strategy | `aws_appconfig_deployment_strategy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AppConfig Environment | `aws_appconfig_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AppConfig Hosted Configuration Version | `aws_appconfig_hosted_configuration_version` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Athena Service | `aws_athena` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Audit Manager Delegation | `aws_auditmanager_delegation` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Audit Manager Service | `aws_auditmanager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Audit Manager Settings | `aws_auditmanager_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Auto Scaling Plans Service | `aws_autoscalingplans` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Autoscaling Service | `aws_autoscaling` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Backup Copy Job | `aws_backup_copy_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Backup Job | `aws_backup_job` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Backup Plan | `aws_backup_plan` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Backup Recovery Point | `aws_backup_recovery_point` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Backup Restore Job | `aws_backup_restore_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Backup Service | `aws_backup` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Backup Vault | `aws_backup_vault` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Batch Compute Environment | `aws_batch_compute_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Batch Job Definition | `aws_batch_job_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| AWS Batch Job Queue | `aws_batch_job_queue` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| AWS Batch Service | `aws_batch` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Bedrock Agent | `aws_bedrock_agent` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| AWS Bedrock Agent Action Group | `aws_bedrock_agent_action_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Agent Runtime | `aws_bedrock_agent_runtime` | [Workload](https://docs.jupiterone.io/data-model/schemas/Workload) |
| AWS Bedrock API Key | `aws_bedrock_api_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| AWS Bedrock Code Interpreter | `aws_bedrock_code_interpreter` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Bedrock Custom Model | `aws_bedrock_custom_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Bedrock Evaluation Job | `aws_bedrock_evaluation_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Bedrock Flow | `aws_bedrock_flow` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AWS Bedrock Foundation Model | `aws_bedrock_foundation_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Bedrock Guardrail | `aws_bedrock_guardrail` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| AWS Bedrock Inference Profile | `aws_bedrock_inference_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Knowledge Base | `aws_bedrock_knowledge_base` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Bedrock Knowledge Base Data Source | `aws_bedrock_knowledge_base_data_source` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Model Customization Job | `aws_bedrock_model_customization_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Bedrock Model Invocation Logging | `aws_bedrock_model_invocation_logging` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Provisioned Throughput | `aws_bedrock_provisioned_throughput` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Bedrock Service | `aws_bedrock` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cloud WAN Attachment | `aws_networkmanager_attachment` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Cloud WAN Connect Peer | `aws_networkmanager_connect_peer` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloud WAN Core Network | `aws_networkmanager_core_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Cloud WAN Core Network Policy | `aws_networkmanager_core_network_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloudformation Service | `aws_cloudformation` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cloudformation Stacks | `aws_cloudformation_stack` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloudfront Distribution | `aws_cloudfront_distribution` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Cloudfront Distribution Origin | `aws_cloudfront_distribution_origin` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloudfront Key Group | `aws_cloudfront_key_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS Cloudfront Public Key | `aws_cloudfront_public_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| AWS Cloudfront Service | `aws_cloudfront` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cloudhsm Service | `aws_cloudhsm` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudMap Namespace | `aws_cloudmap_namespace` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS CloudMap Service | `aws_cloudmap` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudMap Service | `aws_cloudmap_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudMap Service Instance | `aws_cloudmap_service_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS Cloudtrail Service | `aws_cloudtrail` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudTrail Trail | `aws_cloudtrail_trail` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloudwatch Alarms | `aws_cloudwatch_metric_alarm` | Monitor |
| AWS Cloudwatch Event | `aws_cloudwatch_events` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudWatch Log Group Metrics | `aws_cloudwatch_log_group_metrics` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| AWS Cloudwatch Logs Service | `aws_cloudwatch_logs` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cloudwatch Service | `aws_cloudwatch` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeArtifact Service | `aws_codeartifact` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeBuild Service | `aws_codebuild` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeCommit Service | `aws_codecommit` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeDeploy Service | `aws_codedeploy` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeGuru Service | `aws_codeguru` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodePipeline Service | `aws_codepipeline` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cognito Identity | `aws_cognito_identity` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cognito Identity Pool | `aws_cognito_identity_pool` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cognito IDP Service | `aws_cognito_idp` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cognito IDP User Pool Client | `aws_cognito_user_pool_client` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS Cognito IDP User Pool User | `aws_cognito_user_pool_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| AWS Config Rule Finding | `aws_config_rule_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| AWS Customer Gateway | `aws_customer_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Database Migration Service | `aws_dms` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Database Migration Service Endpoint | `aws_dms_endpoint` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| AWS Database Migration Service Instance | `aws_dms_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS DataSync Location | `aws_datasync_location` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS DataSync Service | `aws_datasync` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS DataSync Task | `aws_datasync_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Dedicated Host | `aws_dedicated_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS Detective Service | `aws_detective` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS DevOps Guru Service | `aws_devops_guru` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Direct Connect BGP Peer | `aws_directconnect_bgp_peer` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Direct Connect Connection | `aws_directconnect_connection` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Direct Connect Gateway | `aws_directconnect_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Direct Connect LAG | `aws_directconnect_lag` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Direct Connect Service | `aws_directconnect` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Direct Connect Virtual Interface | `aws_directconnect_virtual_interface` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Directory Service | `aws_ds` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Directory Service Directory | `aws_ds_directory` | [Directory](https://docs.jupiterone.io/data-model/schemas/Directory) |
| AWS DynamoDB Service | `aws_dynamodb` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EC2 Image Builder | `aws_imagebuilder` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EC2 Service | `aws_ec2` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EC2 Settings | `aws_ec2_settings` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS EC2 Transit Gateway | `aws_ec2_transit_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS EC2 Transit Gateway Attachment | `aws_ec2_transit_gateway_attachment` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS EC2 Transit Gateway Route Table | `aws_ec2_transit_gateway_route_table` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS EC2 Transit Gateway VPC Attachment | `aws_ec2_transit_gateway_vpc_attachment` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS ECR Service | `aws_ecr` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS ECS Service | `aws_ecs` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EFS Service | `aws_efs` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EIP Address | `aws_eip` | [IpAddress](https://docs.jupiterone.io/data-model/schemas/IpAddress) |
| AWS EKS Service | `aws_eks` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS ElastiCache Service | `aws_elasticache` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Elasticsearch Service | `aws_es` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS ELB Service | `aws_elasticloadbalancing` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EMR Cluster | `aws_elasticmapreduce_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS EMR Security Configuration | `aws_emr_security_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS EMR Serverless | `aws_emr_serverless` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EMR Serverless Application | `aws_emr_serverless_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS EMR Service | `aws_elasticmapreduce` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Firehose Delivery Stream | `aws_firehose_delivery_stream` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection), [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| AWS Firehose Service | `aws_firehose` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Firewall Manager | `aws_fms` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS FSx | `aws_fsx` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Glacier Service | `aws_glacier` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Global Accelerator Accelerator | `aws_global_accelerator_accelerator` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Global Accelerator Endpoint Group | `aws_global_accelerator_endpoint_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS Global Accelerator Listener | `aws_global_accelerator_listener` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Global Accelerator Service | `aws_global_accelerator` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Glue Catalog Database | `aws_glue_catalog_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| AWS Glue Connection | `aws_glue_connection` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Glue Data Catalog Encryption Settings | `aws_glue_data_catalog_encryption_settings` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| AWS Glue Dev Endpoint | `aws_glue_dev_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| AWS Glue Job | `aws_glue_job` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AWS Glue Security Configurations | `aws_glue_security_configuration` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| AWS Glue Service | `aws_glue` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Glue Session | `aws_glue_session` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Grafana Workspace | `aws_grafana_workspace` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS Guardduty Service | `aws_guardduty` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Health Event | `aws_health_event` | Event |
| AWS Health Service | `aws_health` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS IAM Identity Center | `aws_sso` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS IAM Identity Center Application | `aws_sso_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS IAM Identity Center Group | `aws_sso_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| AWS IAM Identity Center Instance | `aws_sso_instance` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS IAM Identity Center Permission Set | `aws_sso_permission_set` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS IAM Identity Center User | `aws_sso_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| AWS IAM Roles Anywhere Profile | `aws_iam_roles_anywhere_profile` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| AWS IAM Roles Anywhere Service | `aws_iam_roles_anywhere` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS IAM Roles Anywhere Trust Anchor | `aws_iam_roles_anywhere_trust_anchor` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| AWS IAM Service | `aws_iam` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Image | `aws_ami` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource), [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| AWS Image Builder Component | `aws_imagebuilder_component` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| AWS Image Builder Container Recipe | `aws_imagebuilder_container_recipe` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Image Builder Distribution Configuration | `aws_imagebuilder_distribution_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Image Builder Image | `aws_imagebuilder_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| AWS Image Builder Image Pipeline | `aws_imagebuilder_image_pipeline` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AWS Image Builder Infrastructure Configuration | `aws_imagebuilder_infrastructure_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Image Builder Lifecycle Policy | `aws_imagebuilder_lifecycle_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Image Builder Workflow | `aws_imagebuilder_workflow` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AWS Inspector Assessment | `aws_inspector_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| AWS Inspector Service | `aws_inspector` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Inspector v2 Service | `aws_inspectorv2` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Instance | `aws_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS Instance Application | `aws_instance_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS Internet Gateway | `aws_internet_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Key Pair | `aws_key_pair` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| AWS Kinesis Consumer | `aws_kinesis_consumer` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS Kinesis Service | `aws_kinesis` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Kinesis Stream | `aws_kinesis_stream` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection), [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| AWS KMS Key | `aws_kms_key` | [CryptoKey](https://docs.jupiterone.io/data-model/schemas/CryptoKey), [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| AWS KMS Service | `aws_kms` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Lambda Service | `aws_lambda` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Launch Template | `aws_launch_template` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Launch Template Version | `aws_launch_template_version` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| AWS Lex V2 Bot | `aws_lexv2_bot` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Lex V2 Bot Alias | `aws_lexv2_bot_alias` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Lex V2 Service | `aws_lexv2` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS License Manager License | `aws_license_manager_license` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| AWS License Manager Received License | `aws_license_manager_received_license` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| AWS License Manager Service | `aws_license_manager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Macie Finding | `aws_macie_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| AWS Macie Service | `aws_macie` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Marketplace Entitlement | `aws_marketplace_entitlement` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| AWS Marketplace Entity | `aws_marketplace_entity` | [Product](https://docs.jupiterone.io/data-model/schemas/Product) |
| AWS Marketplace Service | `aws_marketplace` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS MQ | `aws_mq` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS MQ Broker | `aws_mq_broker` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS MSK | `aws_msk` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS MSK Cluster | `aws_msk_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS MWAA Environment | `aws_mwaa_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS NAT Gateway | `aws_nat_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Neptune Service | `aws_neptune` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Network ACL | `aws_network_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Network Firewall Service | `aws_networkfirewall` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Network Interface | `aws_eni` | [NetworkInterface](https://docs.jupiterone.io/data-model/schemas/NetworkInterface) |
| AWS Network Manager | `aws_networkmanager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS OpenSearch Domain | `aws_opensearch_domain` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS OpenSearch Service | `aws_opensearch` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Organization | `aws_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| AWS Organization Root | `aws_organization_root` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS Organizational Unit | `aws_organizational_unit` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS Prefix List | `aws_prefix_list` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Private Certificate Authority Service | `aws_acm_pca` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Prometheus Scraper | `aws_prometheus_scraper` | [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| AWS Prometheus Workspace | `aws_prometheus_workspace` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Quicksight Service | `aws_quicksight` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS RAM Principal | `aws_ram_principal` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AWS RAM Resource Share | `aws_ram_resource_share` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS RAM Resource Share Invitation | `aws_ram_resource_share_invitation` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| AWS RAM Shared Resource | `aws_ram_shared_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS RDS Service | `aws_rds` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Redshift Serverless Service | `aws_redshift_serverless` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Redshift Service | `aws_redshift` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Resource Access Manager Service | `aws_ram_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Resource Explorer Service | `aws_resource_explorer` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Restore Testing Plan | `aws_backup_restore_testing_plan` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Route Table | `aws_route_table` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Route53 Domain | `aws_route53_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| AWS Route53 Hosted Zone | `aws_route53_zone` | [DomainZone](https://docs.jupiterone.io/data-model/schemas/DomainZone) |
| AWS Route53 record | `aws_route53_record` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |
| AWS Route53 Resolver Rule | `aws_route53_resolver_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS Route53 Service | `aws_route53` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS S3 Access Point | `aws_s3_access_point` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| AWS S3 Bucket | `aws_s3_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS S3 Bucket Lifecycle Rule | `aws_s3_bucket_lifecycle_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS S3 Bucket Policy | `aws_s3_bucket_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| AWS S3 Service | `aws_s3` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS S3 Website Configuration | `aws_s3_website_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SageMaker | `aws_sagemaker` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS SageMaker Domain | `aws_sagemaker_domain` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS SageMaker Endpoint | `aws_sagemaker_endpoint` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS SageMaker Feature Group | `aws_sagemaker_feature_group` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS SageMaker Model | `aws_sagemaker_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS SageMaker Notebook Instance | `aws_sagemaker_notebook_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS SageMaker Processing Job | `aws_sagemaker_processing_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS SageMaker Training Job | `aws_sagemaker_training_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS SageMaker Transform Job | `aws_sagemaker_transform_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Secrets Manager Service | `aws_secretsmanager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Security Group | `aws_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Security Hub | `aws_securityhub` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Security Hub Control | `aws_securityhub_control` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| AWS Security Hub Standard | `aws_securityhub_standard` | [Standard](https://docs.jupiterone.io/data-model/schemas/Standard) |
| AWS Service Catalog | `aws_servicecatalog` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Service Catalog Constraint | `aws_servicecatalog_constraint` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| AWS Service Catalog Launch Path | `aws_servicecatalog_launch_path` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Service Catalog Portfolio | `aws_servicecatalog_portfolio` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Service Catalog Product | `aws_servicecatalog_product` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Service Catalog Provisioning Artifact | `aws_servicecatalog_provisioning_artifact` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Service Catalog Tag Option | `aws_servicecatalog_tag_option` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SES Configuration Set | `aws_ses_configuration_set` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SES Identity | `aws_ses_identity` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| AWS SES Receipt Filter | `aws_ses_receipt_filter` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| AWS SES Service | `aws_ses` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Shield Protection | `aws_shield_protection` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Shield Protection Group | `aws_shield_protection_group` | ResourceGroup |
| AWS Shield Service | `aws_shield` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Shield Subscription | `aws_shield_subscription` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| AWS Signer Service | `aws_signer` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Signer Signing Job | `aws_signer_signing_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Signer Signing Profile | `aws_signer_signing_profile` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Snapshot | `aws_ebs_snapshot` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk), [Image](https://docs.jupiterone.io/data-model/schemas/Image), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS SNS Service | `aws_sns` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS SNS Subscription | `aws_sns_subscription` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| AWS SNS Topic | `aws_sns_topic` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| AWS SQS Service | `aws_sqs` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS SSM Associations | `aws_ssm_associations` | [Document](https://docs.jupiterone.io/data-model/schemas/Document) |
| AWS SSM Compliance Summary | `aws_ssm_compliance_summary` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| AWS SSM Document | `aws_ssm_document` | [Document](https://docs.jupiterone.io/data-model/schemas/Document) |
| AWS SSM Instance Inventory | `aws_instance_inventory` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SSM Instance Patch State | `aws_instance_patch_state` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| AWS SSM Patch Baseline | `aws_patch_baseline` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SSM Patch Group | `aws_patch_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS SSM Secure String Parameter Metadata | `aws_secure_string_parameter` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| AWS SSM Service | `aws_ssm` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS SSM Service Setting | `aws_ssm_service_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SSM Session Document | `aws_session_document` | [Document](https://docs.jupiterone.io/data-model/schemas/Document) |
| AWS States Service | `aws_states` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS States State Machine | `aws_states_state_machine` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| AWS Storage Gateway | `aws_storage_gateway_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Storage Gateway File Share | `aws_storage_gateway_file_share` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Storage Gateway Service | `aws_storage_gateway` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Storage Gateway Tape | `aws_storage_gateway_tape` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Storage Gateway Tape Pool | `aws_storage_gateway_tape_pool` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Storage Gateway Volume | `aws_storage_gateway_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| AWS Subnet | `aws_subnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Transfer Server | `aws_transfer_server` | [Host](https://docs.jupiterone.io/data-model/schemas/Host), [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Transfer Service | `aws_transfer` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Transfer User | `aws_transfer_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| AWS Volume | `aws_ebs_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| AWS VPC | `aws_vpc` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS VPC Endpoint | `aws_vpc_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| AWS VPC Endpoint Service | `aws_vpc_endpoint_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS VPC Lattice | `aws_vpc_lattice` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS VPC Lattice Listener | `aws_vpc_lattice_listener` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| AWS VPC Lattice Listener Rule | `aws_vpc_lattice_listener_rule` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS VPC Lattice Service | `aws_vpc_lattice_service` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| AWS VPC Lattice Service Network | `aws_vpc_lattice_service_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS VPC Lattice Target Group | `aws_vpc_lattice_target_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS VPC Service | `aws_ec2_vpc` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS VPN Connection | `aws_vpn_connection` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS VPN Gateway | `aws_vpn_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS WAF Classic Service | `aws_waf` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS WAF v2 IP Set | `aws_waf_v2_ip_set` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS WAF v2 Rule Group | `aws_waf_v2_rule_group` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| AWS WAF v2 Service | `aws_wafv2` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS WAF v2 Web ACL | `aws_waf_v2_web_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS WAF v2 Web ACL Firewall Manager Rule Group | `aws_waf_v2_web_acl_firewall_manager_rule_group` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS WAF v2 Web ACL Rule | `aws_waf_v2_web_acl_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS WAF Web ACL | `aws_waf_web_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS WorkSpaces Bundle | `aws_workspaces_bundle` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS WorkSpaces Service | `aws_workspaces` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS WorkSpaces Workspace | `aws_workspace` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS X-Ray Service | `aws_xray` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Batch Job | `aws_batch_job` | [Process](https://docs.jupiterone.io/data-model/schemas/Process), [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Cloudhsm Backup | `aws_cloudhsm_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup), [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |
| Cloudhsm Cluster | `aws_cloudhsm_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster), [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |
| Cloudhsm Instance | `aws_cloudhsm_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host), [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |
| Cloudwatch Events Rule | `aws_cloudwatch_event_rule` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Cloudwatch Logs Destination | `aws_cloudwatch_log_destination` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| Cloudwatch Logs Log Group | `aws_cloudwatch_log_group` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| CloudWatch Logs Metric Filter | `aws_cloudwatch_log_metric_filter` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Cloudwatch Logs Subscription Filter | `aws_cloudwatch_log_subscription_filter` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| CodeArtifact Domain | `aws_codeartifact_domain` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| CodeArtifact Package | `aws_codeartifact_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| CodeArtifact Package Group | `aws_codeartifact_package_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| CodeArtifact Repository | `aws_codeartifact_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| CodeBuild Project | `aws_codebuild_project` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodeBuild Report Group | `aws_codebuild_report_group` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| CodeCommit Repository | `aws_codecommit_repository` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| CodeDeploy Application | `aws_codedeploy_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| CodeDeploy Deployment Config | `aws_codedeploy_deployment_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodeDeploy Deployment Group | `aws_codedeploy_deployment_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodeGuru Profiling Group | `aws_codeguru_profiling_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodeGuru Reviewer Repository Association | `aws_codeguru_reviewer_repository_association` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodePipeline Pipeline | `aws_codepipeline_pipeline` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| Cognito User Pool | `aws_cognito_user_pool` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Configservice Rule | `aws_config_rule` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Configservice Service | `aws_config` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Detective Graph | `aws_detective_graph` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Detective Investigation | `aws_detective_investigation` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| DevOps Guru Anomaly | `aws_devops_guru_anomaly` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| DevOps Guru Insight | `aws_devops_guru_insight` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| DevOps Guru Notification Channel | `aws_devops_guru_notification_channel` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| DynamoDB Accelerator (DAX) Cluster | `aws_dax_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| DynamoDB Accelerator (DAX) Service | `aws_dax` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| DynamoDB Global Table | `aws_dynamodb_global_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| DynamoDB Table | `aws_dynamodb_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| ECR Image | `aws_ecr_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| ECR Image Finding | `aws_ecr_image_scan_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| ECR Repository | `aws_ecr_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| ECS Cluster | `aws_ecs_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| ECS Cluster Service | `aws_ecs_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| ECS Container Instance | `aws_ecs_container_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host), [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| ECS Task | `aws_ecs_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task), [Process](https://docs.jupiterone.io/data-model/schemas/Process) |
| ECS Task Container Definition | `aws_ecs_task_container_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ECS Task Definition | `aws_ecs_task_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| EFS File System | `aws_efs_file_system` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| EFS Mount Target | `aws_efs_mount_target` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| EKS Clusters | `aws_eks_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| EKS Node Group | `aws_eks_node_group` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Elasticache Cluster | `aws_elasticache_memcached_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Elasticache Node | `aws_elasticache_cluster_node` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Elasticache Redis Cluster | `aws_elasticache_redis_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Elasticache Snapshot | `aws_elasticache_snapshot` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Image](https://docs.jupiterone.io/data-model/schemas/Image), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Elasticsearch Domain | `aws_elasticsearch_domain` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| ELB Application Load Balancer | `aws_alb` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ELB Gateway Load Balancer | `aws_elb` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ELB Listener | `aws_lb_listener` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| ELB Listener Rule | `aws_lb_listener_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| ELB Network Load Balancer | `aws_nlb` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ELB Target Group | `aws_lb_target_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| EventBridge API Destination | `aws_eventbridge_api_destination` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| EventBridge Archive | `aws_eventbridge_archive` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| EventBridge Connection | `aws_eventbridge_connection` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| EventBridge Event Bus | `aws_eventbridge_event_bus` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| EventBridge Global Endpoint | `aws_eventbridge_endpoint` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Firewall | `aws_firewall` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Firewall Policy | `aws_firewall_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Firewall Rule Group | `aws_firewall_rule_group` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| FMS Application List | `aws_fms_application_list` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| FMS Policy | `aws_fms_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| FMS Protocols List | `aws_fms_protocols_list` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| FMS Resource Set | `aws_fms_resource_set` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| FSx File System | `aws_fsx_file_system` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Glacier Vault | `aws_glacier_vault` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Guardduty Detector | `aws_guardduty_detector` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment), [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| Guardduty Finding | `aws_guardduty_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| GuardDuty Publishing Destination | `aws_guardduty_publishing_destination` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| IAM Access Key | `aws_iam_access_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key), [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAM Account Password Policy | `aws_iam_account_password_policy` | [PasswordPolicy](https://docs.jupiterone.io/data-model/schemas/PasswordPolicy) |
| IAM Group | `aws_iam_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| IAM Group Policy | `aws_iam_group_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| IAM Instance Profile | `aws_iam_instance_profile` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAM MFA Device | `mfa_device` | [Key](https://docs.jupiterone.io/data-model/schemas/Key), [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| IAM OIDC Provider | `aws_iam_oidc_provider` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| IAM Policy | `aws_iam_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| IAM Role | `aws_iam_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAM Role Policy | `aws_iam_role_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| IAM SAML Provider | `aws_iam_saml_provider` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| IAM Server Certificate | `aws_iam_server_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAM User | `aws_iam_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| IAM User Policy | `aws_iam_user_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Inspector Finding | `aws_inspector_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Inspector Finding | `aws_inspector_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Inspector v2 Configuration | `aws_inspectorv2_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Inspector v2 Filter | `aws_inspectorv2_filter` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Inspector v2 Finding | `aws_inspectorv2_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Inspector v2 Finding | `aws_inspectorv2_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Lambda Functions | `aws_lambda_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| Managed Workflows for Apache Airflow | `aws_mwaa` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Neptune Analytics Graph | `aws_neptune_analytics_graph` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Neptune Analytics Graph Export Task | `aws_neptune_analytics_graph_export_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Neptune Analytics Graph Import Task | `aws_neptune_analytics_graph_import_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Neptune Analytics Graph Snapshot | `aws_neptune_analytics_graph_snapshot` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Neptune Database Cluster | `aws_neptune_database_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Neptune Database Instance | `aws_neptune_database_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Organization Policy | `aws_organization_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Organization Tag Policy | `aws_organization_tag_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Private Certificate Authority | `aws_acm_pca_certificate_authority` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| Quicksight Custom Permissions | `aws_quicksight_custom_permissions` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Quicksight Dashboard | `aws_quicksight_dashboard` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Quicksight Data Set | `aws_quicksight_data_set` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| Quicksight Data Source | `aws_quicksight_data_source` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Quicksight Group | `aws_quicksight_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Quicksight User | `aws_quicksight_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Quicksight VPC Connection | `aws_quicksight_vpc_connection` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS Cluster | `aws_rds_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| RDS DB Cluster Parameter Group | `aws_rds_cluster_parameter_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Cluster Snapshots | `aws_db_cluster_snapshot` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Image](https://docs.jupiterone.io/data-model/schemas/Image), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| RDS DB Instance | `aws_db_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| RDS DB Option Group | `aws_db_option_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Parameter Group | `aws_db_parameter_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Proxy | `aws_db_proxy` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| RDS DB Proxy Target | `aws_db_proxy_target` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Proxy Target Group | `aws_db_proxy_target_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Snapshots | `aws_db_snapshot` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Image](https://docs.jupiterone.io/data-model/schemas/Image), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| RDS DB Subnet Group | `aws_db_subnet_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Redshift Cluster | `aws_redshift_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Redshift Cluster Parameter Group | `aws_redshift_cluster_parameter_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Redshift Datashare | `aws_redshift_datashare` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| Redshift Datashare Authorization | `aws_redshift_datashare_authorization` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Redshift Serverless Endpoint Access | `aws_redshift_serverless_endpoint_access` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| Redshift Serverless Namespace | `aws_redshift_serverless_namespace` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Redshift Serverless Recovery Point | `aws_redshift_serverless_recovery_point` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Redshift Serverless Snapshot | `aws_redshift_serverless_snapshot` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Redshift Serverless Usage Limit | `aws_redshift_serverless_usage_limit` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Redshift Serverless Workgroup | `aws_redshift_serverless_workgroup` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Resource Explorer Index | `aws_resource_explorer_index` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Resource Explorer View | `aws_resource_explorer_view` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Secret | `aws_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Secret Version | `aws_secret_version` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Security Hub Account | `aws_securityhub_account` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Security Hub Finding | `aws_securityhub_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Security Hub Finding | `aws_securityhub_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| SQS Queue | `aws_sqs_queue` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| X-Ray Encryption Config | `aws_xray_encryption_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| X-Ray Group | `aws_xray_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| X-Ray Resource Policy | `aws_xray_resource_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `aws_accessanalyzer` | **HAS** | `aws_accessanalyzer_analyzer` |
| `aws_accessanalyzer_analyzer` | **IDENTIFIED** | `aws_accessanalyzer_finding` |
| `aws_accessanalyzer_finding` | **IDENTIFIED** | `aws_resource` |
| `aws_account` | **HAS** | `aws_accessanalyzer` |
| `aws_account` | **HAS** | `aws_acm` |
| `aws_account` | **HAS** | `aws_acm_pca` |
| `aws_account` | **HAS** | `aws_autoscalingplans` |
| `aws_account` | **HAS** | `aws_ec2_vpc` |
| `aws_account` | **HAS** | `aws_apigateway` |
| `aws_account` | **HAS** | `aws_appconfig` |
| `aws_account` | **HAS** | `aws_athena` |
| `aws_account` | **HAS** | `aws_auditmanager` |
| `aws_account` | **HAS** | `aws_autoscaling` |
| `aws_account` | **HAS** | `aws_backup` |
| `aws_account` | **HAS** | `aws_batch` |
| `aws_account` | **HAS** | `aws_bedrock` |
| `aws_account` | **HAS** | `aws_cloudformation` |
| `aws_account` | **HAS** | `aws_cloudfront` |
| `aws_account` | **HAS** | `aws_cloudhsm` |
| `aws_account` | **HAS** | `aws_cloudtrail` |
| `aws_account` | **HAS** | `aws_cloudmap` |
| `aws_account` | **HAS** | `aws_cloudwatch_events` |
| `aws_account` | **HAS** | `aws_cloudwatch_logs` |
| `aws_account` | **HAS** | `aws_cloudwatch` |
| `aws_account` | **HAS** | `aws_cognito_idp` |
| `aws_account` | **HAS** | `aws_cognito_identity` |
| `aws_account` | **HAS** | `aws_codeartifact` |
| `aws_account` | **HAS** | `aws_codebuild` |
| `aws_account` | **HAS** | `aws_codedeploy` |
| `aws_account` | **HAS** | `aws_codeguru` |
| `aws_account` | **HAS** | `aws_codecommit` |
| `aws_account` | **HAS** | `aws_codepipeline` |
| `aws_account` | **HAS** | `aws_config` |
| `aws_account` | **HAS** | `aws_datasync` |
| `aws_account` | **HAS** | `aws_detective` |
| `aws_account` | **HAS** | `aws_devops_guru` |
| `aws_account` | **HAS** | `aws_directconnect` |
| `aws_account` | **HAS** | `aws_dms` |
| `aws_account` | **HAS** | `aws_ds` |
| `aws_account` | **HAS** | `aws_dynamodb` |
| `aws_account` | **HAS** | `aws_dax` |
| `aws_account` | **HAS** | `aws_ec2` |
| `aws_account` | **HAS** | `aws_ecr` |
| `aws_account` | **HAS** | `aws_ecs` |
| `aws_account` | **HAS** | `aws_efs` |
| `aws_account` | **HAS** | `aws_eks` |
| `aws_account` | **HAS** | `aws_elasticache` |
| `aws_account` | **HAS** | `aws_elasticloadbalancing` |
| `aws_account` | **HAS** | `aws_elasticmapreduce` |
| `aws_account` | **HAS** | `aws_emr_serverless` |
| `aws_account` | **HAS** | `aws_es` |
| `aws_account` | **HAS** | `aws_firehose` |
| `aws_account` | **HAS** | `aws_fms` |
| `aws_account` | **HAS** | `aws_glacier` |
| `aws_account` | **HAS** | `aws_global_accelerator` |
| `aws_account` | **HAS** | `aws_glue` |
| `aws_account` | **HAS** | `aws_grafana` |
| `aws_account` | **HAS** | `aws_guardduty` |
| `aws_account` | **HAS** | `aws_health` |
| `aws_account` | **HAS** | `aws_iam` |
| `aws_account` | **HAS** | `aws_iam_roles_anywhere` |
| `aws_account` | **HAS** | `aws_imagebuilder` |
| `aws_account` | **HAS** | `aws_inspector` |
| `aws_account` | **HAS** | `aws_inspectorv2` |
| `aws_account` | **HAS** | `aws_kinesis` |
| `aws_account` | **HAS** | `aws_kms` |
| `aws_account` | **HAS** | `aws_lambda` |
| `aws_account` | **HAS** | `aws_license_manager` |
| `aws_account` | **HAS** | `aws_lexv2` |
| `aws_account` | **HAS** | `aws_macie` |
| `aws_account` | **HAS** | `aws_marketplace` |
| `aws_account` | **OWNS** | `aws_marketplace_entity` |
| `aws_account` | **HAS** | `aws_mwaa` |
| `aws_account` | **HAS** | `aws_mq` |
| `aws_account` | **HAS** | `aws_msk` |
| `aws_account` | **HAS** | `aws_neptune` |
| `aws_account` | **HAS** | `aws_networkfirewall` |
| `aws_account` | **HAS** | `aws_networkmanager` |
| `aws_account` | **HAS** | `aws_prometheus` |
| `aws_account` | **HAS** | `aws_quicksight` |
| `aws_account` | **HAS** | `aws_resource_explorer` |
| `aws_account` | **HAS** | `aws_ram_service` |
| `aws_account` | **HAS** | `aws_rds` |
| `aws_account` | **HAS** | `aws_db_instance` |
| `aws_account` | **HAS** | `aws_redshift_serverless` |
| `aws_account` | **HAS** | `aws_redshift` |
| `aws_account` | **HAS** | `aws_route53` |
| `aws_account` | **HAS** | `aws_s3` |
| `aws_account` | **HAS** | `aws_sagemaker` |
| `aws_account` | **HAS** | `aws_secretsmanager` |
| `aws_account` | **HAS** | `aws_securityhub` |
| `aws_account` | **HAS** | `aws_servicecatalog` |
| `aws_account` | **HAS** | `aws_ses` |
| `aws_account` | **HAS** | `aws_shield` |
| `aws_account` | **HAS** | `aws_signer` |
| `aws_account` | **HAS** | `aws_sns` |
| `aws_account` | **HAS** | `aws_sqs` |
| `aws_account` | **HAS** | `aws_states` |
| `aws_account` | **HAS** | `aws_ssm` |
| `aws_account` | **HAS** | `aws_sso` |
| `aws_account` | **OWNS** | `aws_sso_instance` |
| `aws_account` | **HAS** | `aws_transfer` |
| `aws_account` | **HAS** | `aws_waf` |
| `aws_account` | **HAS** | `aws_wafv2` |
| `aws_account` | **HAS** | `aws_workspaces` |
| `aws_account` | **HAS** | `aws_vpc_lattice` |
| `aws_account` | **HAS** | `aws_fsx` |
| `aws_account` | **HAS** | `aws_opensearch` |
| `aws_account` | **HAS** | `aws_storage_gateway` |
| `aws_account` | **HAS** | `aws_xray` |
| `aws_acm` | **HAS** | `aws_acm_certificate` |
| `aws_acm_certificate` | **PROTECTS** | `aws_cognito_user_pool` |
| `aws_acm_pca` | **HAS** | `aws_acm_pca_certificate_authority` |
| `aws_alb` | **USES** | `aws_eni` |
| `aws_alb` | **HAS** | `aws_security_group` |
| `aws_alb` | **HAS** | `aws_lb_listener` |
| `aws_alb` | **CONNECTS** | `aws_lb_target_group` |
| `aws_ami` | **CONTAINS** | `aws_ebs_snapshot` |
| `aws_api_gateway_domain_name` | **HAS** | `aws_acm_certificate` |
| `aws_api_gateway_resource` | **HAS** | `aws_api_gateway_method` |
| `aws_api_gateway_rest_api` | **TRIGGERS** | `aws_lambda_function` |
| `aws_api_gateway_rest_api` | **HAS** | `aws_api_gateway_resource` |
| `aws_api_gateway_rest_api` | **HAS** | `aws_api_gateway_stage` |
| `aws_api_gateway_rest_api` | **USES** | `aws_api_gateway_domain_name` |
| `aws_api_gateway_stage` | **DEFINES** | `aws_api_gateway_stage_method_setting` |
| `aws_api_gateway_stage` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_api_gateway_v2_api` | **HAS** | `aws_api_gateway_v2_route` |
| `aws_api_gateway_v2_api` | **HAS** | `aws_api_gateway_v2_stage` |
| `aws_api_gateway_v2_api` | **USES** | `aws_api_gateway_domain_name` |
| `aws_api_gateway_v2_authorizer` | **CONNECTS** | `aws_lambda_function` |
| `aws_api_gateway_v2_integration` | **CONNECTS** | `aws_lambda_function` |
| `aws_api_gateway_v2_route` | **HAS** | `aws_api_gateway_v2_authorizer` |
| `aws_api_gateway_v2_route` | **HAS** | `aws_api_gateway_v2_integration` |
| `aws_api_gateway_v2_stage` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_apigateway` | **HAS** | `aws_api_gateway_rest_api` |
| `aws_apigateway` | **HAS** | `aws_api_gateway_domain_name` |
| `aws_apigateway` | **HAS** | `aws_api_gateway_v2_api` |
| `aws_appconfig` | **HAS** | `aws_appconfig_account_settings` |
| `aws_appconfig` | **HAS** | `aws_appconfig_application` |
| `aws_appconfig` | **HAS** | `aws_appconfig_deployment_strategy` |
| `aws_appconfig` | **CONNECTS** | `aws_vpc_endpoint` |
| `aws_appconfig_application` | **HAS** | `aws_appconfig_environment` |
| `aws_appconfig_application` | **HAS** | `aws_appconfig_configuration_profile` |
| `aws_appconfig_application` | **HAS** | `aws_appconfig_deployment` |
| `aws_appconfig_configuration_profile` | **HAS** | `aws_appconfig_hosted_configuration_version` |
| `aws_appconfig_configuration_profile` | **USES** | `aws_kms_key` |
| `aws_appconfig_configuration_profile` | **USES** | `aws_iam_role` |
| `aws_appconfig_deployment` | **USES** | `aws_kms_key` |
| `aws_appconfig_environment` | **USES** | `aws_cloudwatch_metric_alarm` |
| `aws_appconfig_environment` | **USES** | `aws_iam_role` |
| `aws_appconfig_hosted_configuration_version` | **USES** | `aws_kms_key` |
| `aws_athena` | **HAS** | `aws_athena_work_group` |
| `aws_athena_work_group` | **USES** | `aws_iam_role` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_framework` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_assessment` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_control` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_setting` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_delegation` |
| `aws_auditmanager_assessment` | **USES** | `aws_auditmanager_framework` |
| `aws_auditmanager_assessment` | **HAS** | `aws_auditmanager_evidence_folder` |
| `aws_auditmanager_delegation` | **ASSIGNED** | `aws_iam_role` |
| `aws_auditmanager_delegation` | **HAS** | `aws_auditmanager_assessment` |
| `aws_auditmanager_framework` | **HAS** | `aws_auditmanager_control` |
| `aws_auditmanager_setting` | **USES** | `aws_kms_key` |
| `aws_auditmanager_setting` | **USES** | `aws_sns_topic` |
| `aws_auditmanager_setting` | **ASSIGNED** | `aws_iam_role` |
| `aws_auditmanager_setting` | **USES** | `aws_s3_bucket` |
| `aws_autoscaling` | **HAS** | `aws_autoscaling_group` |
| `aws_autoscaling` | **HAS** | `aws_autoscaling_launch_configuration` |
| `aws_autoscaling_group` | **USES** | `aws_autoscaling_launch_configuration` |
| `aws_autoscaling_group` | **USES** | `aws_launch_template` |
| `aws_autoscaling_group` | **HAS** | `aws_instance` |
| `aws_autoscaling_group` | **USES** | `aws_autoscaling_policy` |
| `aws_autoscaling_launch_configuration` | **USES** | `aws_ami` |
| `aws_backup` | **HAS** | `aws_backup_vault` |
| `aws_backup` | **HAS** | `aws_backup_plan` |
| `aws_backup` | **HAS** | `aws_backup_restore_testing_plan` |
| `aws_backup_copy_job` | **CREATED** | `aws_backup_recovery_point` |
| `aws_backup_copy_job` | **USES** | `aws_backup_recovery_point` |
| `aws_backup_plan` | **HAS** | `aws_backup_job` |
| `aws_backup_plan` | **HAS** | `aws_backup_copy_job` |
| `aws_backup_recovery_point` | **PROTECTS** | `aws_resource` |
| `aws_backup_restore_job` | **HAS** | `aws_instance` |
| `aws_backup_restore_job` | **HAS** | `aws_db_instance` |
| `aws_backup_restore_testing_plan` | **HAS** | `aws_backup_restore_job` |
| `aws_backup_vault` | **HAS** | `aws_backup_recovery_point` |
| `aws_batch` | **HAS** | `aws_batch_job_definition` |
| `aws_batch` | **HAS** | `aws_batch_job_queue` |
| `aws_batch_compute_environment` | **USES** | `aws_iam_role` |
| `aws_batch_compute_environment` | **USES** | `aws_ecs_cluster` |
| `aws_batch_compute_environment` | **HAS** | `aws_security_group` |
| `aws_batch_job_queue` | **HAS** | `aws_batch_job` |
| `aws_bedrock` | **HAS** | `aws_bedrock_evaluation_job` |
| `aws_bedrock` | **HAS** | `aws_bedrock_model_customization_job` |
| `aws_bedrock` | **HAS** | `aws_bedrock_code_interpreter` |
| `aws_bedrock` | **HAS** | `aws_bedrock_foundation_model` |
| `aws_bedrock` | **HAS** | `aws_bedrock_guardrail` |
| `aws_bedrock` | **HAS** | `aws_bedrock_model_invocation_logging` |
| `aws_bedrock` | **HAS** | `aws_bedrock_agent` |
| `aws_bedrock` | **HAS** | `aws_bedrock_knowledge_base` |
| `aws_bedrock` | **HAS** | `aws_bedrock_custom_model` |
| `aws_bedrock` | **HAS** | `aws_bedrock_provisioned_throughput` |
| `aws_bedrock` | **HAS** | `aws_bedrock_flow` |
| `aws_bedrock` | **HAS** | `aws_bedrock_inference_profile` |
| `aws_bedrock` | **HAS** | `aws_bedrock_agent_runtime` |
| `aws_bedrock` | **HAS** | `aws_bedrock_api_key` |
| `aws_bedrock_agent` | **HAS** | `aws_bedrock_agent_action_group` |
| `aws_bedrock_agent` | **USES** | `aws_iam_role` |
| `aws_bedrock_agent` | **USES** | `aws_kms_key` |
| `aws_bedrock_agent` | **USES** | `aws_bedrock_foundation_model` |
| `aws_bedrock_agent_action_group` | **USES** | `aws_lambda_function` |
| `aws_bedrock_agent_runtime` | **USES** | `aws_iam_role` |
| `aws_bedrock_agent_runtime` | **USES** | `aws_security_group` |
| `aws_bedrock_agent_runtime` | **USES** | `aws_subnet` |
| `aws_bedrock_code_interpreter` | **USES** | `aws_iam_role` |
| `aws_bedrock_code_interpreter` | **USES** | `aws_security_group` |
| `aws_bedrock_code_interpreter` | **USES** | `aws_subnet` |
| `aws_bedrock_custom_model` | **USES** | `aws_bedrock_foundation_model` |
| `aws_bedrock_custom_model` | **USES** | `aws_s3_bucket` |
| `aws_bedrock_custom_model` | **USES** | `aws_kms_key` |
| `aws_bedrock_evaluation_job` | **SENDS** | `aws_s3_bucket` |
| `aws_bedrock_flow` | **USES** | `aws_iam_role` |
| `aws_bedrock_flow` | **USES** | `aws_kms_key` |
| `aws_bedrock_guardrail` | **USES** | `aws_kms_key` |
| `aws_bedrock_guardrail` | **PROTECTS** | `aws_bedrock_agent` |
| `aws_bedrock_knowledge_base` | **HAS** | `aws_bedrock_knowledge_base_data_source` |
| `aws_bedrock_knowledge_base` | **USES** | `aws_iam_role` |
| `aws_bedrock_knowledge_base` | **USES** | `aws_bedrock_foundation_model` |
| `aws_bedrock_knowledge_base` | **USES** | `aws_opensearch_domain` |
| `aws_bedrock_knowledge_base_data_source` | **USES** | `aws_s3_bucket` |
| `aws_bedrock_model_customization_job` | **USES** | `aws_s3_bucket` |
| `aws_bedrock_model_customization_job` | **SENDS** | `aws_s3_bucket` |
| `aws_bedrock_model_invocation_logging` | **SENDS** | `aws_s3_bucket` |
| `aws_bedrock_model_invocation_logging` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_bedrock_provisioned_throughput` | **USES** | `aws_bedrock_foundation_model` |
| `aws_bedrock_provisioned_throughput` | **USES** | `aws_bedrock_custom_model` |
| `aws_cloudformation` | **HAS** | `aws_cloudformation_stack` |
| `aws_cloudfront` | **HAS** | `aws_cloudfront_distribution` |
| `aws_cloudfront` | **HAS** | `aws_cloudfront_key_group` |
| `aws_cloudfront` | **HAS** | `aws_cloudfront_public_key` |
| `aws_cloudfront_distribution` | **HAS** | `aws_cloudfront_distribution_origin` |
| `aws_cloudfront_distribution` | **TRIGGERS** | `aws_lambda_function` |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_api_gateway_rest_api` |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_elb` |
| `aws_cloudfront_key_group` | **HAS** | `aws_cloudfront_public_key` |
| `aws_cloudhsm` | **HAS** | `aws_cloudhsm_cluster` |
| `aws_cloudhsm_cluster` | **HAS** | `aws_cloudhsm_instance` |
| `aws_cloudhsm_cluster` | **HAS** | `aws_security_group` |
| `aws_cloudhsm_cluster` | **HAS** | `aws_cloudhsm_backup` |
| `aws_cloudhsm_instance` | **HAS** | `aws_security_group` |
| `aws_cloudmap` | **HAS** | `aws_cloudmap_namespace` |
| `aws_cloudmap_namespace` | **HAS** | `aws_cloudmap_service` |
| `aws_cloudmap_service` | **HAS** | `aws_cloudmap_service_instance` |
| `aws_cloudtrail` | **HAS** | `aws_cloudtrail_trail` |
| `aws_cloudtrail` | **LOGS** | `aws_resource_explorer` |
| `aws_cloudwatch` | **HAS** | `aws_cloudwatch_metric_alarm` |
| `aws_cloudwatch_events` | **HAS** | `aws_cloudwatch_event_rule` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_event_bus` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_archive` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_connection` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_api_destination` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_endpoint` |
| `aws_cloudwatch_log_group` | **USES** | `aws_kms_key` |
| `aws_cloudwatch_log_group` | **HAS** | `aws_cloudwatch_log_metric_filter` |
| `aws_cloudwatch_log_group` | **HAS** | `aws_cloudwatch_log_group_metrics` |
| `aws_cloudwatch_logs` | **HAS** | `aws_cloudwatch_log_group` |
| `aws_cloudwatch_logs` | **HAS** | `aws_cloudwatch_log_destination` |
| `aws_cloudwatch_logs` | **HAS** | `aws_cloudwatch_log_subscription_filter` |
| `aws_cloudwatch_logs` | **HAS** | `aws_cloudwatch_log_metric_filter` |
| `aws_cloudwatch_metric_alarm` | **TRIGGERS** | `aws_resource` |
| `aws_codeartifact` | **HAS** | `aws_codeartifact_domain` |
| `aws_codeartifact` | **USES** | `aws_vpc_endpoint` |
| `aws_codeartifact_domain` | **HAS** | `aws_codeartifact_repository` |
| `aws_codeartifact_domain` | **HAS** | `aws_codeartifact_package_group` |
| `aws_codeartifact_domain` | **USES** | `aws_kms_key` |
| `aws_codeartifact_package_group` | **HAS** | `aws_codeartifact_package_group` |
| `aws_codeartifact_repository` | **CONTAINS** | `aws_codeartifact_package` |
| `aws_codebuild` | **HAS** | `aws_codebuild_project` |
| `aws_codebuild` | **HAS** | `aws_codebuild_report_group` |
| `aws_codecommit` | **HAS** | `aws_codecommit_repository` |
| `aws_codedeploy` | **HAS** | `aws_codedeploy_application` |
| `aws_codedeploy` | **HAS** | `aws_codedeploy_deployment_config` |
| `aws_codedeploy_application` | **HAS** | `aws_codedeploy_deployment_group` |
| `aws_codedeploy_deployment_group` | **USES** | `aws_codedeploy_deployment_config` |
| `aws_codedeploy_deployment_group` | **USES** | `aws_iam_role` |
| `aws_codeguru` | **HAS** | `aws_codeguru_profiling_group` |
| `aws_codeguru` | **HAS** | `aws_codeguru_reviewer_repository_association` |
| `aws_codeguru_reviewer_repository_association` | **USES** | `aws_kms_key` |
| `aws_codepipeline` | **HAS** | `aws_codepipeline_pipeline` |
| `aws_cognito_identity` | **HAS** | `aws_cognito_identity_pool` |
| `aws_cognito_idp` | **HAS** | `aws_cognito_user_pool` |
| `aws_cognito_user_pool` | **HAS** | `aws_cognito_user_pool_client` |
| `aws_cognito_user_pool` | **HAS** | `aws_cognito_user_pool_user` |
| `aws_config` | **HAS** | `aws_config_rule` |
| `aws_config_rule` | **EVALUATES** | `aws_resource` |
| `aws_config_rule` | **IDENTIFIED** | `aws_config_rule_finding` |
| `aws_datasync` | **HAS** | `aws_datasync_task` |
| `aws_datasync` | **HAS** | `aws_datasync_location` |
| `aws_datasync_location` | **CONNECTS** | `aws_s3_bucket` |
| `aws_datasync_location` | **CONNECTS** | `aws_efs_file_system` |
| `aws_datasync_location` | **CONNECTS** | `aws_fsx_file_system` |
| `aws_datasync_task` | **USES** | `aws_datasync_location` |
| `aws_datasync_task` | **USES** | `aws_cloudwatch_log_group` |
| `aws_dax` | **HAS** | `aws_dax_cluster` |
| `aws_db_cluster_snapshot` | **USES** | `aws_kms_key` |
| `aws_db_instance` | **USES** | `aws_db_parameter_group` |
| `aws_db_instance` | **HAS** | `aws_security_group` |
| `aws_db_instance` | **USES** | `aws_kms_key` |
| `aws_db_instance` | **USES** | `aws_secret` |
| `aws_db_instance` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_db_instance` | **HAS** | `aws_db_snapshot` |
| `aws_db_instance` | **USES** | `aws_db_option_group` |
| `aws_db_instance` | **USES** | `aws_db_subnet_group` |
| `aws_db_proxy` | **USES** | `aws_subnet` |
| `aws_db_proxy` | **USES** | `aws_secret` |
| `aws_db_proxy` | **USES** | `aws_iam_role` |
| `aws_db_proxy` | **USES** | `aws_security_group` |
| `aws_db_proxy` | **HAS** | `aws_db_proxy_target_group` |
| `aws_db_proxy_target` | **CONNECTS** | `aws_db_instance` |
| `aws_db_proxy_target` | **CONNECTS** | `aws_rds_cluster` |
| `aws_db_proxy_target_group` | **HAS** | `aws_db_proxy_target` |
| `aws_db_snapshot` | **USES** | `aws_kms_key` |
| `aws_db_subnet_group` | **USES** | `aws_subnet` |
| `aws_detective` | **HAS** | `aws_detective_graph` |
| `aws_detective_graph` | **IDENTIFIED** | `aws_detective_investigation` |
| `aws_devops_guru` | **HAS** | `aws_devops_guru_notification_channel` |
| `aws_devops_guru` | **IDENTIFIED** | `aws_devops_guru_insight` |
| `aws_devops_guru_insight` | **HAS** | `aws_devops_guru_anomaly` |
| `aws_devops_guru_notification_channel` | **USES** | `aws_sns_topic` |
| `aws_directconnect` | **HAS** | `aws_directconnect_connection` |
| `aws_directconnect` | **HAS** | `aws_directconnect_virtual_interface` |
| `aws_directconnect` | **HAS** | `aws_directconnect_lag` |
| `aws_directconnect` | **HAS** | `aws_directconnect_gateway` |
| `aws_directconnect_lag` | **HAS** | `aws_direct_connect_virtual_interface` |
| `aws_directconnect_lag` | **USES** | `aws_direct_connect_connection` |
| `aws_directconnect_virtual_interface` | **HAS** | `aws_directconnect_bgp_peer` |
| `aws_directconnect_virtual_interface` | **USES** | `aws_directconnect_lag` |
| `aws_directconnect_virtual_interface` | **USES** | `aws_direct_connect_gateway` |
| `aws_dms` | **HAS** | `aws_dms_instance` |
| `aws_dms` | **HAS** | `aws_dms_endpoint` |
| `aws_ds` | **HAS** | `aws_ds_directory` |
| `aws_dynamodb` | **HAS** | `aws_dynamodb_table` |
| `aws_dynamodb` | **HAS** | `aws_dynamodb_global_table` |
| `aws_dynamodb_global_table` | **IS** | `aws_dynamodb_table` |
| `aws_dynamodb_table` | **USES** | `aws_kms_key` |
| `aws_ebs_snapshot` | **USES** | `aws_kms_key` |
| `aws_ebs_volume` | **USES** | `aws_ebs_snapshot` |
| `aws_ebs_volume` | **HAS** | `aws_ebs_snapshot` |
| `aws_ebs_volume` | **USES** | `aws_kms_key` |
| `aws_ec2` | **HAS** | `aws_ec2_settings` |
| `aws_ec2` | **USES** | `aws_kms_key` |
| `aws_ec2` | **HAS** | `aws_instance` |
| `aws_ec2` | **HAS** | `aws_internet_gateway` |
| `aws_ec2` | **HAS** | `aws_key_pair` |
| `aws_ec2` | **HAS** | `aws_launch_template` |
| `aws_ec2` | **HAS** | `aws_network_acl` |
| `aws_ec2` | **HAS** | `aws_prefix_list` |
| `aws_ec2` | **HAS** | `aws_security_group` |
| `aws_ec2` | **HAS** | `aws_subnet` |
| `aws_ec2` | **HAS** | `aws_ec2_transit_gateway` |
| `aws_ec2` | **HAS** | `aws_ebs_volume` |
| `aws_ec2` | **HAS** | `aws_vpc` |
| `aws_ec2` | **HAS** | `aws_vpc_endpoint_service` |
| `aws_ec2` | **HAS** | `aws_dedicated_host` |
| `aws_ec2_transit_gateway` | **HAS** | `aws_ec2_transit_gateway_vpc_attachment` |
| `aws_ec2_transit_gateway` | **HAS** | `aws_ec2_transit_gateway_route_table` |
| `aws_ec2_transit_gateway` | **HAS** | `aws_ec2_transit_gateway_attachment` |
| `aws_ec2_transit_gateway` | **CONNECTS** | `aws_vpn_connection` |
| `aws_ec2_transit_gateway_vpc_attachment` | **USES** | `aws_vpc` |
| `aws_ecr` | **HAS** | `aws_ecr_repository` |
| `aws_ecr_image` | **HAS** | `aws_ecr_image_scan_finding` |
| `aws_ecr_repository` | **HAS** | `aws_ecr_image` |
| `aws_ecs` | **HAS** | `aws_ecs_cluster` |
| `aws_ecs` | **HAS** | `aws_ecs_task_definition` |
| `aws_ecs_cluster` | **HAS** | `aws_ecs_service` |
| `aws_ecs_cluster` | **HAS** | `aws_ecs_container_instance` |
| `aws_ecs_cluster` | **RUNS** | `aws_ecs_task` |
| `aws_ecs_container_instance` | **RUNS** | `aws_ecs_task` |
| `aws_ecs_service` | **USES** | `aws_subnet` |
| `aws_ecs_service` | **HAS** | `aws_security_group` |
| `aws_ecs_task_container_definition` | **USES** | `aws_secret` |
| `aws_ecs_task_definition` | **DEFINES** | `aws_ecs_service` |
| `aws_ecs_task_definition` | **DEFINES** | `aws_ecs_task` |
| `aws_ecs_task_definition` | **USES** | `aws_iam_role` |
| `aws_ecs_task_definition` | **HAS** | `aws_ecs_task_container_definition` |
| `aws_efs` | **HAS** | `aws_efs_file_system` |
| `aws_efs_file_system` | **USES** | `aws_kms_key` |
| `aws_efs_file_system` | **HAS** | `aws_efs_mount_target` |
| `aws_efs_mount_target` | **USES** | `aws_eni` |
| `aws_efs_mount_target` | **HAS** | `aws_security_group` |
| `aws_eks` | **HAS** | `aws_eks_cluster` |
| `aws_eks_cluster` | **HAS** | `aws_eks_node_group` |
| `aws_eks_cluster` | **HAS** | `aws_security_group` |
| `aws_eks_cluster` | **USES** | `aws_kms_key` |
| `aws_eks_cluster` | **TRUSTS** | `aws_iam_oidc_provider` |
| `aws_eks_node_group` | **HAS** | `aws_instance` |
| `aws_eks_node_group` | **USES** | `aws_iam_role` |
| `aws_elasticache` | **HAS** | `aws_elasticache_memcached_cluster` |
| `aws_elasticache` | **HAS** | `aws_elasticache_redis_cluster` |
| `aws_elasticache_cluster_node` | **USES** | `aws_eni` |
| `aws_elasticache_cluster_node` | **HAS** | `aws_security_group` |
| `aws_elasticache_memcached_cluster` | **USES** | `aws_eni` |
| `aws_elasticache_memcached_cluster` | **HAS** | `aws_security_group` |
| `aws_elasticache_memcached_cluster` | **HAS** | `aws_elasticache_snapshot` |
| `aws_elasticache_redis_cluster` | **HAS** | `aws_elasticache_cluster_node` |
| `aws_elasticache_redis_cluster` | **USES** | `aws_kms_key` |
| `aws_elasticache_snapshot` | **USES** | `aws_kms_key` |
| `aws_elasticloadbalancing` | **HAS** | `aws_alb` |
| `aws_elasticloadbalancing` | **HAS** | `aws_elb` |
| `aws_elasticloadbalancing` | **HAS** | `aws_nlb` |
| `aws_elasticmapreduce` | **HAS** | `aws_elasticmapreduce_cluster` |
| `aws_elasticmapreduce` | **HAS** | `aws_emr_security_configuration` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_kms_key` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_iam_role` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_iam_instance_profile` |
| `aws_elasticmapreduce_cluster` | **HAS** | `aws_instance` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_emr_security_configuration` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_vpc_endpoint` |
| `aws_elasticsearch_domain` | **USES** | `aws_eni` |
| `aws_elasticsearch_domain` | **HAS** | `aws_security_group` |
| `aws_elb` | **USES** | `aws_eni` |
| `aws_elb` | **CONNECTS** | `aws_instance` |
| `aws_elb` | **HAS** | `aws_security_group` |
| `aws_elb` | **HAS** | `aws_lb_listener` |
| `aws_elb` | **CONNECTS** | `aws_lb_target_group` |
| `aws_emr_serverless` | **HAS** | `aws_emr_serverless_application` |
| `aws_emr_serverless_application` | **USES** | `aws_kms_key` |
| `aws_eni` | **USES** | `aws_eip` |
| `aws_eni` | **HAS** | `aws_security_group` |
| `aws_es` | **HAS** | `aws_elasticsearch_domain` |
| `aws_eventbridge_api_destination` | **USES** | `aws_eventbridge_connection` |
| `aws_eventbridge_endpoint` | **USES** | `aws_eventbridge_event_bus` |
| `aws_eventbridge_event_bus` | **USES** | `aws_kms_key` |
| `aws_eventbridge_event_bus` | **HAS** | `aws_eventbridge_archive` |
| `aws_firehose` | **HAS** | `aws_firehose_delivery_stream` |
| `aws_firehose_delivery_stream` | **USES** | `aws_kms_key` |
| `aws_firehose_delivery_stream` | **USES** | `aws_kinesis_stream` |
| `aws_firehose_delivery_stream` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_firehose_delivery_stream` | **USES** | `aws_vpc_endpoint` |
| `aws_firehose_delivery_stream` | **CONNECTS** | `aws_vpc_endpoint_service` |
| `aws_firehose_delivery_stream` | **USES** | `aws_vpc` |
| `aws_firehose_delivery_stream` | **USES** | `aws_subnet` |
| `aws_firehose_delivery_stream` | **USES** | `aws_security_group` |
| `aws_firewall` | **HAS** | `aws_firewall_policy` |
| `aws_firewall` | **PROTECTS** | `aws_vpc` |
| `aws_firewall_policy` | **HAS** | `aws_firewall_rule_group` |
| `aws_firewall_rule_group` | **USES** | `aws_prefix_list` |
| `aws_fms` | **HAS** | `aws_fms_policy` |
| `aws_fms` | **HAS** | `aws_fms_resource_set` |
| `aws_fms` | **HAS** | `aws_fms_application_list` |
| `aws_fms` | **HAS** | `aws_fms_protocols_list` |
| `aws_fms_resource_set` | **HAS** | `aws_resource` |
| `aws_fsx` | **HAS** | `aws_fsx_file_system` |
| `aws_glacier` | **HAS** | `aws_glacier_vault` |
| `aws_global_accelerator` | **HAS** | `aws_global_accelerator_accelerator` |
| `aws_global_accelerator_accelerator` | **HAS** | `aws_global_accelerator_listener` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_alb` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_elb` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_nlb` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_eip` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_instance` |
| `aws_global_accelerator_listener` | **HAS** | `aws_global_accelerator_endpoint_group` |
| `aws_glue` | **HAS** | `aws_glue_job` |
| `aws_glue` | **HAS** | `aws_glue_catalog_database` |
| `aws_glue` | **HAS** | `aws_glue_data_catalog_encryption_settings` |
| `aws_glue` | **HAS** | `aws_glue_security_configuration` |
| `aws_glue` | **HAS** | `aws_glue_connection` |
| `aws_glue` | **HAS** | `aws_glue_session` |
| `aws_glue_connection` | **USES** | `aws_subnet` |
| `aws_glue_data_catalog_encryption_settings` | **USES** | `aws_kms_key` |
| `aws_glue_job` | **USES** | `aws_glue_connection` |
| `aws_glue_security_configuration` | **USES** | `aws_kms_key` |
| `aws_grafana` | **HAS** | `aws_grafana_workspace` |
| `aws_grafana_workspace` | **USES** | `aws_iam_role` |
| `aws_guardduty` | **HAS** | `aws_guardduty_detector` |
| `aws_guardduty_detector` | **IDENTIFIED** | `aws_guardduty_finding` |
| `aws_guardduty_detector` | **HAS** | `aws_guardduty_publishing_destination` |
| `aws_guardduty_publishing_destination` | **USES** | `aws_s3_bucket` |
| `aws_guardduty_publishing_destination` | **USES** | `aws_kms_key` |
| `aws_health` | **HAS** | `aws_health_event` |
| `aws_iam` | **HAS** | `aws_organization_policy` |
| `aws_iam` | **HAS** | `aws_organization_tag_policy` |
| `aws_iam` | **HAS** | `aws_iam_account_password_policy` |
| `aws_iam` | **HAS** | `aws_iam_group` |
| `aws_iam` | **HAS** | `aws_iam_group_policy` |
| `aws_iam` | **HAS** | `aws_iam_policy` |
| `aws_iam` | **HAS** | `aws_iam_role` |
| `aws_iam` | **HAS** | `aws_iam_role_policy` |
| `aws_iam` | **HAS** | `aws_iam_oidc_provider` |
| `aws_iam` | **HAS** | `aws_iam_saml_provider` |
| `aws_iam` | **HAS** | `aws_iam_user` |
| `aws_iam` | **HAS** | `aws_iam_access_key` |
| `aws_iam` | **HAS** | `aws_iam_user_policy` |
| `aws_iam` | **HAS** | `aws_iam_server_certificate` |
| `aws_iam` | **HAS** | `aws_iam_instance_profile` |
| `aws_iam_group` | **ASSIGNED** | `aws_iam_group_policy` |
| `aws_iam_group` | **HAS** | `aws_iam_user` |
| `aws_iam_group` | **ASSIGNED** | `aws_iam_policy` |
| `aws_iam_group_policy` | **ALLOWS** | `aws_resource` |
| `aws_iam_group_policy` | **DENIES** | `aws_resource` |
| `aws_iam_instance_profile` | **USES** | `aws_role` |
| `aws_iam_policy` | **ALLOWS** | `aws_resource` |
| `aws_iam_policy` | **DENIES** | `aws_resource` |
| `aws_iam_policy` | **RESTRICTS** | `aws_iam_role` |
| `aws_iam_policy` | **RESTRICTS** | `aws_iam_user` |
| `aws_iam_role` | **ASSIGNED** | `aws_batch_compute_environment` |
| `aws_iam_role` | **ASSIGNED** | `aws_datasync_location` |
| `aws_iam_role` | **ASSIGNED** | `aws_ecs_task_definition` |
| `aws_iam_role` | **ASSIGNED** | `aws_iam_policy` |
| `aws_iam_role` | **ASSIGNED** | `aws_iam_role_policy` |
| `aws_iam_role` | **ASSIGNED** | `aws_transfer_server` |
| `aws_iam_role` | **ASSIGNED** | `aws_transfer_user` |
| `aws_iam_role_policy` | **ALLOWS** | `aws_resource` |
| `aws_iam_role_policy` | **DENIES** | `aws_resource` |
| `aws_iam_roles_anywhere` | **HAS** | `aws_iam_roles_anywhere_trust_anchor` |
| `aws_iam_roles_anywhere` | **HAS** | `aws_iam_roles_anywhere_profile` |
| `aws_iam_roles_anywhere_profile` | **ALLOWS** | `aws_iam_role` |
| `aws_iam_roles_anywhere_profile` | **ASSIGNED** | `aws_iam_policy` |
| `aws_iam_roles_anywhere_trust_anchor` | **USES** | `aws_acm_pca_certificate_authority` |
| `aws_iam_user` | **HAS** | `aws_bedrock_api_key` |
| `aws_iam_user` | **ASSIGNED** | `aws_iam_policy` |
| `aws_iam_user` | **HAS** | `aws_iam_access_key` |
| `aws_iam_user` | **ASSIGNED** | `mfa_device` |
| `aws_iam_user` | **ASSIGNED** | `aws_iam_user_policy` |
| `aws_iam_user_policy` | **ALLOWS** | `aws_resource` |
| `aws_iam_user_policy` | **DENIES** | `aws_resource` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_component` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_image_pipeline` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_infrastructure_configuration` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_lifecycle_policy` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_container_recipe` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_distribution_configuration` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_workflow` |
| `aws_imagebuilder_image_pipeline` | **USES** | `aws_imagebuilder_infrastructure_configuration` |
| `aws_imagebuilder_image_pipeline` | **USES** | `aws_imagebuilder_distribution_configuration` |
| `aws_imagebuilder_image_pipeline` | **USES** | `aws_imagebuilder_container_recipe` |
| `aws_imagebuilder_image_pipeline` | **CREATED** | `aws_imagebuilder_image` |
| `aws_imagebuilder_image_pipeline` | **USES** | `aws_iam_role` |
| `aws_imagebuilder_lifecycle_policy` | **USES** | `aws_iam_role` |
| `aws_inspector` | **HAS** | `aws_inspector_assessment` |
| `aws_inspector_assessment` | **IDENTIFIED** | `aws_inspector_finding` |
| `aws_inspectorv2` | **SCANS** | `aws_instance` |
| `aws_inspectorv2` | **SCANS** | `aws_ecr_repository` |
| `aws_inspectorv2` | **SCANS** | `aws_ecr_image` |
| `aws_inspectorv2` | **IDENTIFIED** | `aws_inspectorv2_finding` |
| `aws_inspectorv2` | **HAS** | `aws_inspectorv2_filter` |
| `aws_inspectorv2` | **HAS** | `aws_inspectorv2_configuration` |
| `aws_inspectorv2` | **USES** | `aws_vpc_endpoint` |
| `aws_inspectorv2_configuration` | **USES** | `aws_kms_key` |
| `aws_instance` | **USES** | `aws_eip` |
| `aws_instance` | **USES** | `aws_key_pair` |
| `aws_instance` | **USES** | `aws_ami` |
| `aws_instance` | **HAS** | `aws_security_group` |
| `aws_instance` | **USES** | `aws_iam_instance_profile` |
| `aws_instance` | **USES** | `aws_eni` |
| `aws_instance` | **USES** | `aws_ebs_volume` |
| `aws_instance` | **USES** | `aws_dedicated_host` |
| `aws_instance` | **HAS** | `aws_instance_inventory` |
| `aws_instance` | **INSTALLED** | `aws_instance_application` |
| `aws_instance` | **LOGS** | `aws_instance_patch_state` |
| `aws_instance` | **HAS** | `aws_ssm_compliance_summary` |
| `aws_instance` | **HAS** | `aws_ssm_associations` |
| `aws_kinesis` | **HAS** | `aws_kinesis_stream` |
| `aws_kinesis_consumer` | **USES** | `aws_kinesis_stream` |
| `aws_kinesis_stream` | **USES** | `aws_kms_key` |
| `aws_kms` | **HAS** | `aws_kms_key` |
| `aws_lambda` | **HAS** | `aws_lambda_function` |
| `aws_lambda_function` | **HAS** | `aws_security_group` |
| `aws_lambda_function` | **ASSIGNED** | `aws_iam_role` |
| `aws_lambda_function` | **USES** | `aws_signer_signing_profile` |
| `aws_lambda_function` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_launch_template` | **HAS** | `aws_launch_template_version` |
| `aws_launch_template_version` | **USES** | `aws_ami` |
| `aws_lb_listener` | **HAS** | `aws_lb_listener_rule` |
| `aws_lb_listener` | **USES** | `aws_acm_certificate` |
| `aws_lb_listener` | **USES** | `aws_iam_server_certificate` |
| `aws_lb_target_group` | **HAS** | `aws_instance` |
| `aws_lb_target_group` | **HAS** | `aws_lambda_function` |
| `aws_lb_target_group` | **HAS** | `aws_eni` |
| `aws_lexv2` | **HAS** | `aws_lexv2_bot` |
| `aws_lexv2_bot` | **HAS** | `aws_lexv2_bot_alias` |
| `aws_license_manager` | **HAS** | `aws_license_manager_license` |
| `aws_license_manager` | **HAS** | `aws_license_manager_received_license` |
| `aws_marketplace` | **HAS** | `aws_marketplace_entity` |
| `aws_marketplace` | **HAS** | `aws_marketplace_entitlement` |
| `aws_marketplace_entitlement` | **ASSIGNED** | `aws_account` |
| `aws_marketplace_entitlement` | **USES** | `aws_license_manager_received_license` |
| `aws_mq` | **HAS** | `aws_mq_broker` |
| `aws_mq_broker` | **USES** | `aws_kms_key` |
| `aws_mq_broker` | **USES** | `aws_subnet` |
| `aws_mq_broker` | **USES** | `aws_security_group` |
| `aws_msk` | **HAS** | `aws_msk_cluster` |
| `aws_mwaa` | **HAS** | `aws_mwaa_environment` |
| `aws_nat_gateway` | **USES** | `aws_eni` |
| `aws_neptune` | **HAS** | `aws_neptune_database_cluster` |
| `aws_neptune` | **HAS** | `aws_neptune_database_instance` |
| `aws_neptune` | **HAS** | `aws_neptune_analytics_graph` |
| `aws_neptune_analytics_graph` | **USES** | `aws_kms_key` |
| `aws_neptune_analytics_graph` | **CONNECTS** | `aws_vpc_endpoint` |
| `aws_neptune_analytics_graph` | **HAS** | `aws_neptune_analytics_graph_snapshot` |
| `aws_neptune_analytics_graph` | **HAS** | `aws_neptune_analytics_graph_export_task` |
| `aws_neptune_analytics_graph` | **HAS** | `aws_neptune_analytics_graph_import_task` |
| `aws_neptune_analytics_graph_export_task` | **USES** | `aws_kms_key` |
| `aws_neptune_analytics_graph_export_task` | **USES** | `aws_iam_role` |
| `aws_neptune_analytics_graph_import_task` | **USES** | `aws_kms_key` |
| `aws_neptune_analytics_graph_import_task` | **USES** | `aws_iam_role` |
| `aws_neptune_analytics_graph_snapshot` | **USES** | `aws_kms_key` |
| `aws_neptune_database_cluster` | **HAS** | `aws_security_group` |
| `aws_neptune_database_cluster` | **USES** | `aws_kms_key` |
| `aws_neptune_database_cluster` | **USES** | `aws_iam_role` |
| `aws_neptune_database_cluster` | **CONTAINS** | `aws_neptune_database_instance` |
| `aws_neptune_database_instance` | **HAS** | `aws_security_group` |
| `aws_neptune_database_instance` | **USES** | `aws_kms_key` |
| `aws_network_acl` | **PROTECTS** | `aws_subnet` |
| `aws_network_acl` | **ALLOWS** | `aws_resource` |
| `aws_network_acl` | **DENIES** | `aws_resource` |
| `aws_networkfirewall` | **HAS** | `aws_firewall` |
| `aws_networkfirewall` | **HAS** | `aws_firewall_policy` |
| `aws_networkfirewall` | **HAS** | `aws_firewall_rule_group` |
| `aws_networkmanager` | **HAS** | `aws_networkmanager_core_network` |
| `aws_networkmanager_attachment` | **HAS** | `aws_networkmanager_connect_peer` |
| `aws_networkmanager_attachment` | **USES** | `aws_vpc` |
| `aws_networkmanager_attachment` | **USES** | `aws_vpn_connection` |
| `aws_networkmanager_attachment` | **USES** | `aws_directconnect_gateway` |
| `aws_networkmanager_attachment` | **USES** | `aws_ec2_transit_gateway_route_table` |
| `aws_networkmanager_connect_peer` | **USES** | `aws_subnet` |
| `aws_networkmanager_core_network` | **HAS** | `aws_networkmanager_core_network_policy` |
| `aws_networkmanager_core_network` | **HAS** | `aws_networkmanager_attachment` |
| `aws_nlb` | **USES** | `aws_eni` |
| `aws_nlb` | **HAS** | `aws_security_group` |
| `aws_nlb` | **HAS** | `aws_lb_listener` |
| `aws_nlb` | **CONNECTS** | `aws_lb_target_group` |
| `aws_opensearch` | **HAS** | `aws_opensearch_domain` |
| `aws_opensearch_domain` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_organization` | **HAS** | `aws_organization_root` |
| `aws_organization_root` | **HAS** | `aws_organizational_unit` |
| `aws_organizational_unit` | **HAS** | `aws_organizational_unit` |
| `aws_patch_baseline` | **GENERATED** | `aws_instance_patch_state` |
| `aws_patch_group` | **USES** | `aws_patch_baseline` |
| `aws_patch_group` | **HAS** | `aws_instance` |
| `aws_prometheus` | **HAS** | `aws_prometheus_workspace` |
| `aws_prometheus` | **HAS** | `aws_prometheus_scraper` |
| `aws_prometheus_scraper` | **SCANS** | `aws_eks_cluster` |
| `aws_prometheus_scraper` | **USES** | `aws_subnet` |
| `aws_prometheus_scraper` | **USES** | `aws_security_group` |
| `aws_prometheus_scraper` | **USES** | `aws_iam_role` |
| `aws_prometheus_scraper` | **SENDS** | `aws_prometheus_workspace` |
| `aws_prometheus_workspace` | **USES** | `aws_kms_key` |
| `aws_prometheus_workspace` | **HAS** | `aws_cloudwatch_log_group` |
| `aws_quicksight` | **HAS** | `aws_quicksight_data_set` |
| `aws_quicksight` | **HAS** | `aws_quicksight_vpc_connection` |
| `aws_quicksight` | **HAS** | `aws_quicksight_user` |
| `aws_quicksight` | **HAS** | `aws_quicksight_group` |
| `aws_quicksight` | **HAS** | `aws_quicksight_custom_permissions` |
| `aws_quicksight_dashboard` | **USES** | `aws_quicksight_data_set` |
| `aws_quicksight_data_set` | **USES** | `aws_quicksight_data_source` |
| `aws_quicksight_data_source` | **CONNECTS** | `aws_quicksight_vpc_connection` |
| `aws_quicksight_group` | **HAS** | `aws_quicksight_user` |
| `aws_quicksight_user` | **ASSIGNED** | `aws_quicksight_custom_permissions` |
| `aws_ram_principal` | **USES** | `aws_ram_shared_resource` |
| `aws_ram_resource_share` | **GENERATED** | `aws_ram_resource_share_invitation` |
| `aws_ram_resource_share` | **CONTAINS** | `aws_ram_shared_resource` |
| `aws_ram_resource_share` | **ALLOWS** | `aws_ram_principal` |
| `aws_ram_service` | **HAS** | `aws_ram_resource_share` |
| `aws_rds` | **HAS** | `aws_rds_cluster` |
| `aws_rds` | **HAS** | `aws_db_instance` |
| `aws_rds` | **HAS** | `aws_db_subnet_group` |
| `aws_rds` | **HAS** | `aws_db_proxy` |
| `aws_rds_cluster` | **HAS** | `aws_security_group` |
| `aws_rds_cluster` | **USES** | `aws_kms_key` |
| `aws_rds_cluster` | **USES** | `aws_secret` |
| `aws_rds_cluster` | **CONTAINS** | `aws_db_instance` |
| `aws_rds_cluster` | **USES** | `aws_rds_cluster_parameter_group` |
| `aws_rds_cluster` | **HAS** | `aws_db_cluster_snapshot` |
| `aws_redshift` | **HAS** | `aws_redshift_cluster` |
| `aws_redshift_cluster` | **USES** | `aws_kms_key` |
| `aws_redshift_cluster` | **HAS** | `aws_security_group` |
| `aws_redshift_cluster` | **USES** | `aws_redshift_cluster_parameter_group` |
| `aws_redshift_cluster` | **HAS** | `aws_redshift_datashare` |
| `aws_redshift_cluster` | **ASSIGNED** | `aws_iam_role` |
| `aws_redshift_datashare_authorization` | **ALLOWS** | `aws_redshift_datashare` |
| `aws_redshift_serverless` | **HAS** | `aws_redshift_serverless_workgroup` |
| `aws_redshift_serverless` | **HAS** | `aws_redshift_serverless_namespace` |
| `aws_redshift_serverless` | **HAS** | `aws_redshift_serverless_usage_limit` |
| `aws_redshift_serverless_namespace` | **HAS** | `aws_redshift_datashare` |
| `aws_resource` | **USES** | `aws_acm_certificate` |
| `aws_resource` | **VIOLATES** | `aws_config_rule_finding` |
| `aws_resource` | **ALLOWS** | `aws_security_group` |
| `aws_resource` | **HAS** | `aws_inspectorv2_finding` |
| `aws_resource` | **HAS** | `aws_securityhub_finding` |
| `aws_resource_explorer` | **HAS** | `aws_resource_explorer_index` |
| `aws_resource_explorer` | **HAS** | `aws_resource_explorer_view` |
| `aws_resource_explorer` | **USES** | `aws_vpc_endpoint` |
| `aws_route_table` | **USES** | `aws_prefix_list` |
| `aws_route53` | **HAS** | `aws_route53_domain` |
| `aws_route53` | **HAS** | `aws_route53_resolver_rule` |
| `aws_route53` | **HAS** | `aws_route53_zone` |
| `aws_route53_resolver_rule` | **USES** | `aws_vpc` |
| `aws_route53_zone` | **HAS** | `aws_route53_record` |
| `aws_s3` | **HAS** | `aws_s3_bucket` |
| `aws_s3_bucket` | **HAS** | `aws_macie_finding` |
| `aws_s3_bucket` | **HAS** | `aws_s3_access_point` |
| `aws_s3_bucket` | **USES** | `aws_kms_key` |
| `aws_s3_bucket` | **HAS** | `aws_s3_bucket_policy` |
| `aws_s3_bucket` | **NOTIFIES** | `aws_lambda_function` |
| `aws_s3_bucket` | **NOTIFIES** | `aws_sqs_queue` |
| `aws_s3_bucket` | **NOTIFIES** | `aws_sns_topic` |
| `aws_s3_bucket` | **ALLOWS** | `aws_account` |
| `aws_s3_bucket` | **ALLOWS** | `aws_s3` |
| `aws_s3_bucket` | **ALLOWS** | `aws_resource` |
| `aws_s3_bucket` | **DENIES** | `aws_resource` |
| `aws_s3_bucket` | **HAS** | `aws_s3_website_config` |
| `aws_s3_bucket` | **HAS** | `aws_s3_bucket_lifecycle_rule` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_notebook_instance` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_model` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_endpoint` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_domain` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_training_job` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_processing_job` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_transform_job` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_feature_group` |
| `aws_sagemaker_domain` | **USES** | `aws_iam_role` |
| `aws_sagemaker_domain` | **USES** | `aws_kms_key` |
| `aws_sagemaker_domain` | **CONNECTS** | `aws_subnet` |
| `aws_sagemaker_domain` | **CONNECTS** | `aws_vpc` |
| `aws_sagemaker_domain` | **USES** | `aws_efs_file_system` |
| `aws_sagemaker_endpoint` | **USES** | `aws_iam_role` |
| `aws_sagemaker_endpoint` | **USES** | `aws_kms_key` |
| `aws_sagemaker_endpoint` | **USES** | `aws_sagemaker_model` |
| `aws_sagemaker_endpoint` | **CONNECTS** | `aws_subnet` |
| `aws_sagemaker_endpoint` | **USES** | `aws_s3_bucket` |
| `aws_sagemaker_feature_group` | **USES** | `aws_iam_role` |
| `aws_sagemaker_feature_group` | **USES** | `aws_kms_key` |
| `aws_sagemaker_feature_group` | **USES** | `aws_s3_bucket` |
| `aws_sagemaker_processing_job` | **USES** | `aws_iam_role` |
| `aws_sagemaker_processing_job` | **USES** | `aws_kms_key` |
| `aws_sagemaker_processing_job` | **CONNECTS** | `aws_subnet` |
| `aws_sagemaker_processing_job` | **USES** | `aws_s3_bucket` |
| `aws_sagemaker_training_job` | **USES** | `aws_iam_role` |
| `aws_sagemaker_training_job` | **USES** | `aws_kms_key` |
| `aws_sagemaker_training_job` | **CONNECTS** | `aws_subnet` |
| `aws_sagemaker_training_job` | **USES** | `aws_s3_bucket` |
| `aws_sagemaker_transform_job` | **USES** | `aws_sagemaker_model` |
| `aws_sagemaker_transform_job` | **USES** | `aws_kms_key` |
| `aws_sagemaker_transform_job` | **USES** | `aws_s3_bucket` |
| `aws_secret` | **HAS** | `aws_secret_version` |
| `aws_secret` | **USES** | `aws_kms_key` |
| `aws_secretsmanager` | **HAS** | `aws_secret` |
| `aws_security_group` | **PROTECTS** | `aws_batch_compute_environment` |
| `aws_security_group` | **PROTECTS** | `aws_cloudhsm_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_cloudhsm_instance` |
| `aws_security_group` | **PROTECTS** | `aws_instance` |
| `aws_security_group` | **ALLOWS** | `aws_resource` |
| `aws_security_group` | **PROTECTS** | `aws_eni` |
| `aws_security_group` | **USES** | `aws_prefix_list` |
| `aws_security_group` | **ALLOWS** | `aws_prefix_list` |
| `aws_security_group` | **PROTECTS** | `aws_vpc_endpoint` |
| `aws_security_group` | **PROTECTS** | `aws_ecs_service` |
| `aws_security_group` | **PROTECTS** | `aws_efs_mount_target` |
| `aws_security_group` | **PROTECTS** | `aws_eks_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_elasticache_memcached_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_elasticache_cluster_node` |
| `aws_security_group` | **PROTECTS** | `aws_elb` |
| `aws_security_group` | **PROTECTS** | `aws_alb` |
| `aws_security_group` | **PROTECTS** | `aws_nlb` |
| `aws_security_group` | **PROTECTS** | `aws_elasticsearch_domain` |
| `aws_security_group` | **PROTECTS** | `aws_lambda_function` |
| `aws_security_group` | **PROTECTS** | `aws_neptune_database_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_neptune_database_instance` |
| `aws_security_group` | **PROTECTS** | `aws_rds_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_db_instance` |
| `aws_security_group` | **PROTECTS** | `aws_redshift_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_sagemaker_endpoint` |
| `aws_security_group` | **PROTECTS** | `aws_sagemaker_domain` |
| `aws_security_group` | **PROTECTS** | `aws_sagemaker_training_job` |
| `aws_security_group` | **PROTECTS** | `aws_sagemaker_processing_job` |
| `aws_securityhub` | **HAS** | `aws_securityhub_account` |
| `aws_securityhub` | **HAS** | `aws_securityhub_standard` |
| `aws_securityhub_control` | **IDENTIFIED** | `aws_securityhub_finding` |
| `aws_securityhub_finding` | **CONNECTS** | `aws_securityhub_finding` |
| `aws_securityhub_standard` | **HAS** | `aws_securityhub_control` |
| `aws_securityhub_standard` | **IDENTIFIED** | `aws_securityhub_finding` |
| `aws_servicecatalog` | **HAS** | `aws_servicecatalog_portfolio` |
| `aws_servicecatalog` | **HAS** | `aws_servicecatalog_product` |
| `aws_servicecatalog` | **HAS** | `aws_servicecatalog_tag_option` |
| `aws_servicecatalog_portfolio` | **HAS** | `aws_servicecatalog_product` |
| `aws_servicecatalog_portfolio` | **HAS** | `aws_servicecatalog_constraint` |
| `aws_servicecatalog_portfolio` | **HAS** | `aws_servicecatalog_tag_option` |
| `aws_servicecatalog_product` | **HAS** | `aws_servicecatalog_provisioning_artifact` |
| `aws_servicecatalog_product` | **HAS** | `aws_servicecatalog_launch_path` |
| `aws_servicecatalog_product` | **HAS** | `aws_servicecatalog_tag_option` |
| `aws_ses` | **HAS** | `aws_ses_identity` |
| `aws_ses` | **HAS** | `aws_ses_configuration_set` |
| `aws_ses` | **HAS** | `aws_ses_receipt_filter` |
| `aws_ses_identity` | **USES** | `aws_ses_configuration_set` |
| `aws_session_document` | **USES** | `aws_s3_bucket` |
| `aws_session_document` | **USES** | `aws_cloudwatch_log_group` |
| `aws_session_document` | **USES** | `aws_kms_key` |
| `aws_shield` | **HAS** | `aws_shield_subscription` |
| `aws_shield` | **HAS** | `aws_shield_protection_group` |
| `aws_shield` | **HAS** | `aws_shield_protection` |
| `aws_shield_protection` | **PROTECTS** | `aws_resource` |
| `aws_shield_protection_group` | **PROTECTS** | `aws_resource` |
| `aws_shield_protection_group` | **HAS** | `aws_resource` |
| `aws_signer` | **HAS** | `aws_signer_signing_profile` |
| `aws_signer_signing_profile` | **HAS** | `aws_signer_signing_job` |
| `aws_sns` | **HAS** | `aws_sns_topic` |
| `aws_sns_topic` | **HAS** | `aws_sns_subscription` |
| `aws_sns_topic` | **USES** | `aws_kms_key` |
| `aws_sqs` | **HAS** | `aws_sqs_queue` |
| `aws_sqs_queue` | **SENDS** | `aws_sqs_queue` |
| `aws_sqs_queue` | **USES** | `aws_kms_key` |
| `aws_ssm` | **MANAGES** | `aws_instance` |
| `aws_ssm` | **HAS** | `aws_patch_baseline` |
| `aws_ssm` | **HAS** | `aws_patch_group` |
| `aws_ssm` | **MANAGES** | `aws_secure_string_parameter` |
| `aws_ssm` | **HAS** | `aws_session_document` |
| `aws_ssm` | **HAS** | `aws_ssm_document` |
| `aws_ssm` | **HAS** | `aws_ssm_compliance_summary` |
| `aws_ssm` | **HAS** | `aws_ssm_associations` |
| `aws_ssm_service_setting` | **MANAGES** | `aws_ssm` |
| `aws_sso` | **HAS** | `aws_sso_instance` |
| `aws_sso_group` | **ASSIGNED** | `aws_sso_permission_set` |
| `aws_sso_group` | **HAS** | `aws_sso_user` |
| `aws_sso_instance` | **HAS** | `aws_sso_application` |
| `aws_sso_instance` | **HAS** | `aws_sso_permission_set` |
| `aws_sso_instance` | **HAS** | `aws_sso_user` |
| `aws_sso_instance` | **HAS** | `aws_sso_group` |
| `aws_sso_user` | **ASSIGNED** | `aws_sso_permission_set` |
| `aws_states` | **HAS** | `aws_states_state_machine` |
| `aws_states_state_machine` | **USES** | `aws_iam_role` |
| `aws_states_state_machine` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_storage_gateway` | **HAS** | `aws_storage_gateway_gateway` |
| `aws_storage_gateway_file_share` | **USES** | `aws_iam_role` |
| `aws_storage_gateway_file_share` | **USES** | `aws_s3_bucket` |
| `aws_storage_gateway_file_share` | **USES** | `aws_kms_key` |
| `aws_storage_gateway_gateway` | **USES** | `aws_vpc_endpoint` |
| `aws_storage_gateway_gateway` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_storage_gateway_gateway` | **HAS** | `aws_storage_gateway_file_share` |
| `aws_storage_gateway_gateway` | **HAS** | `aws_storage_gateway_volume` |
| `aws_storage_gateway_gateway` | **HAS** | `aws_storage_gateway_tape` |
| `aws_storage_gateway_tape` | **USES** | `aws_kms_key` |
| `aws_storage_gateway_tape_pool` | **CONTAINS** | `aws_storage_gateway_tape` |
| `aws_storage_gateway_volume` | **USES** | `aws_kms_key` |
| `aws_subnet` | **HAS** | `aws_cloudhsm_instance` |
| `aws_subnet` | **HAS** | `aws_instance` |
| `aws_subnet` | **HAS** | `aws_nat_gateway` |
| `aws_subnet` | **USES** | `aws_route_table` |
| `aws_subnet` | **CONNECTS** | `aws_eni` |
| `aws_subnet` | **HAS** | `aws_efs_mount_target` |
| `aws_subnet` | **HAS** | `aws_elasticsearch_domain` |
| `aws_subnet` | **HAS** | `aws_lambda_function` |
| `aws_subnet` | **USES** | `aws_msk_cluster` |
| `aws_subnet` | **HAS** | `aws_workspace` |
| `aws_transfer` | **HAS** | `aws_transfer_server` |
| `aws_transfer_server` | **USES** | `aws_eip` |
| `aws_transfer_server` | **USES** | `aws_api_gateway_rest_api` |
| `aws_transfer_server` | **HAS** | `aws_transfer_user` |
| `aws_transfer_user` | **ALLOWS** | `aws_s3_bucket` |
| `aws_vpc` | **HAS** | `aws_cloudhsm_cluster` |
| `aws_vpc` | **HAS** | `aws_codebuild_project` |
| `aws_vpc` | **HAS** | `aws_vpn_gateway` |
| `aws_vpc` | **HAS** | `aws_internet_gateway` |
| `aws_vpc` | **HAS** | `aws_nat_gateway` |
| `aws_vpc` | **HAS** | `aws_network_acl` |
| `aws_vpc` | **HAS** | `aws_route_table` |
| `aws_vpc` | **HAS** | `aws_security_group` |
| `aws_vpc` | **CONTAINS** | `aws_subnet` |
| `aws_vpc` | **HAS** | `aws_vpc_endpoint` |
| `aws_vpc` | **HAS** | `aws_eks_cluster` |
| `aws_vpc` | **HAS** | `aws_elasticache_memcached_cluster` |
| `aws_vpc` | **HAS** | `aws_elasticache_cluster_node` |
| `aws_vpc` | **HAS** | `aws_elb` |
| `aws_vpc` | **HAS** | `aws_alb` |
| `aws_vpc` | **HAS** | `aws_nlb` |
| `aws_vpc` | **HAS** | `aws_glue_dev_endpoint` |
| `aws_vpc` | **HAS** | `aws_grafana_workspace` |
| `aws_vpc` | **HAS** | `aws_neptune_database_instance` |
| `aws_vpc` | **HAS** | `aws_db_instance` |
| `aws_vpc` | **HAS** | `aws_db_subnet_group` |
| `aws_vpc` | **HAS** | `aws_redshift_serverless_workgroup` |
| `aws_vpc` | **HAS** | `aws_redshift_cluster` |
| `aws_vpc` | **HAS** | `aws_s3_access_point` |
| `aws_vpc` | **HAS** | `aws_transfer_server` |
| `aws_vpc` | **CONNECTS** | `aws_vpc_lattice_service_network` |
| `aws_vpc` | **HAS** | `aws_opensearch_domain` |
| `aws_vpc_endpoint` | **HAS** | `aws_security_group` |
| `aws_vpc_endpoint` | **USES** | `aws_subnet` |
| `aws_vpc_endpoint` | **USES** | `aws_eni` |
| `aws_vpc_endpoint` | **CONNECTS** | `aws_auditmanager` |
| `aws_vpc_endpoint` | **CONNECTS** | `aws_vpc_lattice_service_network` |
| `aws_vpc_endpoint_service` | **ALLOWS** | `aws_resource` |
| `aws_vpc_endpoint_service` | **CONNECTS** | `aws_nlb` |
| `aws_vpc_endpoint_service` | **CONNECTS** | `aws_elb` |
| `aws_vpc_endpoint_service` | **CONNECTS** | `aws_vpc_endpoint` |
| `aws_vpc_lattice` | **HAS** | `aws_vpc_lattice_service` |
| `aws_vpc_lattice` | **HAS** | `aws_vpc_lattice_service_network` |
| `aws_vpc_lattice` | **HAS** | `aws_vpc_lattice_target_group` |
| `aws_vpc_lattice_listener_rule` | **DEFINES** | `aws_vpc_lattice_listener` |
| `aws_vpc_lattice_listener_rule` | **TRIGGERS** | `aws_vpc_lattice_target_group` |
| `aws_vpc_lattice_service` | **CONNECTS** | `aws_vpc_lattice_listener` |
| `aws_vpc_lattice_service_network` | **CONNECTS** | `aws_vpc_lattice_service` |
| `aws_vpc_lattice_target_group` | **HAS** | `aws_lambda_function` |
| `aws_vpc_lattice_target_group` | **HAS** | `aws_alb` |
| `aws_vpn_connection` | **CONNECTS** | `aws_customer_gateway` |
| `aws_vpn_gateway` | **CONNECTS** | `aws_vpn_connection` |
| `aws_waf` | **HAS** | `aws_waf_web_acl` |
| `aws_waf_v2_rule_group` | **HAS** | `aws_waf_v2_web_acl_rule` |
| `aws_waf_v2_web_acl` | **PROTECTS** | `aws_api_gateway_stage` |
| `aws_waf_v2_web_acl` | **PROTECTS** | `aws_cognito_user_pool` |
| `aws_waf_v2_web_acl` | **PROTECTS** | `aws_cloudfront_distribution` |
| `aws_waf_v2_web_acl` | **PROTECTS** | `aws_alb` |
| `aws_waf_v2_web_acl` | **HAS** | `aws_waf_v2_web_acl_rule` |
| `aws_waf_v2_web_acl` | **HAS** | `aws_waf_v2_web_acl_firewall_manager_rule_group` |
| `aws_waf_v2_web_acl` | **LOGS** | `aws_s3_bucket` |
| `aws_waf_v2_web_acl` | **LOGS** | `aws_firehose_delivery_stream` |
| `aws_waf_v2_web_acl` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_waf_v2_web_acl_rule` | **USES** | `aws_waf_v2_ip_set` |
| `aws_waf_v2_web_acl_rule` | **USES** | `aws_waf_v2_rule_group` |
| `aws_waf_web_acl` | **PROTECTS** | `aws_api_gateway_stage` |
| `aws_waf_web_acl` | **PROTECTS** | `aws_cloudfront_distribution` |
| `aws_wafv2` | **HAS** | `aws_waf_v2_web_acl` |
| `aws_wafv2` | **HAS** | `aws_waf_v2_ip_set` |
| `aws_wafv2` | **HAS** | `aws_waf_v2_rule_group` |
| `aws_workspace` | **USES** | `aws_workspaces_bundle` |
| `aws_workspaces` | **HAS** | `aws_workspace` |
| `aws_xray` | **HAS** | `aws_xray_group` |
| `aws_xray` | **HAS** | `aws_xray_encryption_config` |
| `aws_xray` | **HAS** | `aws_xray_resource_policy` |
| `aws_xray_encryption_config` | **USES** | `aws_kms_key` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `aws_accessanalyzer_finding` | **IDENTIFIED** | `aws_resource` | FORWARD |
| `aws_account` | **HAS** | `aws_account` | FORWARD |
| `aws_account` | **ALLOWS** | `aws_ami` | FORWARD |
| `aws_account` | **DENIES** | `aws_ami` | FORWARD |
| `aws_account` | **SHARED** | `aws_db_snapshot` | REVERSE |
| `aws_account` | **SHARED** | `aws_db_cluster_snapshot` | REVERSE |
| `aws_account` | **OWNS** | `aws_sso_instance` | REVERSE |
| `aws_acm_certificate` | **CONNECTS** | `aws_route53_record` | FORWARD |
| `aws_api_gateway_domain_name` | **HAS** | `aws_acm_certificate` | FORWARD |
| `aws_api_gateway_rest_api` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_api_gateway_rest_api` | **DENIES** | `aws_resource` | FORWARD |
| `aws_autoscaling_launch_configuration` | **USES** | `aws_ami` | FORWARD |
| `aws_backup_vault` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_backup_vault` | **DENIES** | `aws_resource` | FORWARD |
| `aws_batch_compute_environment` | **USES** | `aws_ami` | FORWARD |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_s3_bucket` | FORWARD |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_api_gateway_rest_api` | FORWARD |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_api_gateway_domain_name` | FORWARD |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_resource` | FORWARD |
| `aws_cloudtrail` | **LOGS** | `aws_s3_bucket` | FORWARD |
| `aws_cloudtrail` | **LOGS** | `aws_cloudwatch_log_group` | FORWARD |
| `aws_cloudtrail` | **SENDS** | `aws_s3` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_lambda` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_dynamodb` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_s3_bucket` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_lambda_function` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_dynamodb_table` | REVERSE |
| `aws_cloudwatch_event_rule` | **TRIGGERS** | `aws_resource` | FORWARD |
| `aws_codeartifact_domain` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_codeartifact_domain` | **DENIES** | `aws_resource` | FORWARD |
| `aws_codeartifact_repository` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_codeartifact_repository` | **DENIES** | `aws_resource` | FORWARD |
| `aws_datasync_location` | **CONNECTS** | `aws_s3_bucket` | FORWARD |
| `aws_datasync_location` | **CONNECTS** | `aws_efs_file_system` | FORWARD |
| `aws_datasync_location` | **CONNECTS** | `aws_fsx_file_system` | FORWARD |
| `aws_datasync_task` | **USES** | `aws_cloudwatch_log_group` | FORWARD |
| `aws_dynamodb_table` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_dynamodb_table` | **DENIES** | `aws_resource` | FORWARD |
| `aws_ec2` | **HAS** | `aws_ec2_transit_gateway` | FORWARD |
| `aws_ec2_transit_gateway_vpc_attachment` | **USES** | `aws_vpc` | FORWARD |
| `aws_ecr_repository` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_ecr_repository` | **DENIES** | `aws_resource` | REVERSE |
| `aws_ecs_task` | **USES** | `aws_eni` | FORWARD |
| `aws_efs_file_system` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_efs_file_system` | **DENIES** | `aws_resource` | FORWARD |
| `aws_elasticsearch_domain` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_elasticsearch_domain` | **DENIES** | `aws_resource` | REVERSE |
| `aws_firewall_rule_group` | **USES** | `aws_prefix_list` | FORWARD |
| `aws_fms_resource_set` | **HAS** | `aws_resource` | FORWARD |
| `aws_glacier_vault` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_glacier_vault` | **DENIES** | `aws_resource` | FORWARD |
| `aws_glue_catalog_database` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_glue_catalog_database` | **DENIES** | `aws_resource` | FORWARD |
| `aws_iam_group_policy` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_iam_group_policy` | **DENIES** | `aws_resource` | FORWARD |
| `aws_iam_policy` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_iam_policy` | **DENIES** | `aws_resource` | FORWARD |
| `aws_iam_role` | **ASSIGNED** | `aws_auditmanager_setting` | REVERSE |
| `aws_iam_role` | **ASSIGNED** | `aws_auditmanager_delegation` | REVERSE |
| `aws_iam_role` | **ASSIGNED** | `aws_datasync_location` | FORWARD |
| `aws_iam_role` | **TRUSTS** | `aws_resource` | FORWARD |
| `aws_iam_role` | **TRUSTS** | `external_resource` | FORWARD |
| `aws_iam_role` | **USES** | `aws_neptune_analytics_graph_export_task` | REVERSE |
| `aws_iam_role` | **USES** | `aws_neptune_analytics_graph_import_task` | REVERSE |
| `aws_iam_role_policy` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_iam_role_policy` | **DENIES** | `aws_resource` | FORWARD |
| `aws_iam_saml_provider` | **IS** | `external_resource` | FORWARD |
| `aws_iam_user_policy` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_iam_user_policy` | **DENIES** | `aws_resource` | FORWARD |
| `aws_inspectorv2_finding` | **IS** | `cve` | FORWARD |
| `aws_instance` | **USES** | `aws_ami` | FORWARD |
| `aws_instance_patch_state` | **GENERATED** | `aws_patch_baseline` | REVERSE |
| `aws_kinesis_stream` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_kinesis_stream` | **DENIES** | `aws_resource` | FORWARD |
| `aws_kms_key` | **USES** | `aws_auditmanager_setting` | REVERSE |
| `aws_kms_key` | **USES** | `aws_eventbridge_event_bus` | REVERSE |
| `aws_kms_key` | **USES** | `aws_cloudwatch_log_group` | REVERSE |
| `aws_kms_key` | **USES** | `aws_dynamodb_table` | REVERSE |
| `aws_kms_key` | **USES** | `aws_ebs_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_ebs_volume` | REVERSE |
| `aws_kms_key` | **USES** | `aws_efs_file_system` | REVERSE |
| `aws_kms_key` | **USES** | `aws_elasticache_redis_cluster` | REVERSE |
| `aws_kms_key` | **USES** | `aws_elasticache_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_glue_security_configuration` | REVERSE |
| `aws_kms_key` | **USES** | `aws_guardduty_publishing_destination` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_database_cluster` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_database_instance` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_analytics_graph` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_analytics_graph_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_analytics_graph_export_task` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_analytics_graph_import_task` | REVERSE |
| `aws_kms_key` | **USES** | `aws_rds_cluster` | REVERSE |
| `aws_kms_key` | **USES** | `aws_db_instance` | REVERSE |
| `aws_kms_key` | **USES** | `aws_db_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_db_cluster_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_redshift_cluster` | REVERSE |
| `aws_kms_key` | **USES** | `aws_s3_bucket` | REVERSE |
| `aws_kms_key` | **USES** | `aws_sns_topic` | REVERSE |
| `aws_kms_key` | **USES** | `aws_xray_encryption_config` | REVERSE |
| `aws_kms_key` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_kms_key` | **DENIES** | `aws_resource` | FORWARD |
| `aws_lambda_function` | **USES** | `aws_lambda_layer` | FORWARD |
| `aws_lambda_function` | **USES** | `aws_signer_signing_profile` | FORWARD |
| `aws_lambda_function` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_lambda_function` | **DENIES** | `aws_resource` | FORWARD |
| `aws_launch_template_version` | **USES** | `aws_ami` | FORWARD |
| `aws_lb_target_group` | **HAS** | `aws_eip` | FORWARD |
| `aws_lexv2_bot` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_lexv2_bot` | **DENIES** | `aws_resource` | FORWARD |
| `aws_lexv2_bot_alias` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_lexv2_bot_alias` | **DENIES** | `aws_resource` | FORWARD |
| `aws_nat_gateway` | **USES** | `aws_eip` | FORWARD |
| `aws_network_acl` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_network_acl` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_network_acl` | **DENIES** | `aws_resource` | FORWARD |
| `aws_network_acl` | **DENIES** | `aws_resource` | REVERSE |
| `aws_opensearch_domain` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_opensearch_domain` | **DENIES** | `aws_resource` | REVERSE |
| `aws_organization_policy` | **ENFORCES** | `aws_organization_root` | FORWARD |
| `aws_organization_policy` | **ENFORCES** | `aws_account` | FORWARD |
| `aws_organization_policy` | **ENFORCES** | `aws_organizational_unit` | FORWARD |
| `aws_organization_root` | **HAS** | `aws_account` | FORWARD |
| `aws_organizational_unit` | **HAS** | `aws_account` | FORWARD |
| `aws_patch_group` | **USES** | `aws_patch_baseline` | FORWARD |
| `aws_prometheus_scraper` | **SCANS** | `aws_eks_cluster` | FORWARD |
| `aws_prometheus_scraper` | **USES** | `aws_subnet` | FORWARD |
| `aws_prometheus_scraper` | **USES** | `aws_security_group` | FORWARD |
| `aws_prometheus_scraper` | **USES** | `aws_iam_role` | FORWARD |
| `aws_prometheus_scraper` | **SENDS** | `aws_prometheus_workspace` | FORWARD |
| `aws_prometheus_workspace` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_prometheus_workspace` | **DENIES** | `aws_resource` | FORWARD |
| `aws_ram_shared_resource` | **IS** | `aws_resource` | FORWARD |
| `aws_resource` | **USES** | `aws_acm_certificate` | REVERSE |
| `aws_route_table` | **USES** | `aws_prefix_list` | FORWARD |
| `aws_route53_record` | **CONNECTS** | `aws_acm_certificate` | REVERSE |
| `aws_route53_record` | **CONNECTS** | `aws_ses` | FORWARD |
| `aws_route53_record` | **CONNECTS** | `aws_resource` | FORWARD |
| `aws_s3_bucket` | **USES** | `aws_auditmanager_setting` | REVERSE |
| `aws_s3_bucket` | **HAS** | `aws_s3_access_point` | REVERSE |
| `aws_s3_bucket` | **PUBLISHES** | `aws_s3_bucket` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `aws_account` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `aws_account` | REVERSE |
| `aws_s3_bucket` | **ALLOWS** | `everyone` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `everyone` | REVERSE |
| `aws_s3_bucket` | **ALLOWS** | `aws_authenticated_users` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `aws_authenticated_users` | REVERSE |
| `aws_s3_bucket` | **ALLOWS** | `aws_s3` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `aws_s3` | REVERSE |
| `aws_s3_bucket` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_s3_bucket` | **DENIES** | `aws_resource` | REVERSE |
| `aws_secret` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_secret` | **DENIES** | `aws_resource` | FORWARD |
| `aws_security_group` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_security_group` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_security_group` | **USES** | `aws_prefix_list` | FORWARD |
| `aws_security_group` | **ALLOWS** | `aws_prefix_list` | FORWARD |
| `aws_servicecatalog_portfolio` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_ses_identity` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_ses_identity` | **DENIES** | `aws_resource` | FORWARD |
| `aws_sns_subscription` | **HAS** | `aws_resource` | FORWARD |
| `aws_sns_topic` | **USES** | `aws_auditmanager_setting` | REVERSE |
| `aws_sns_topic` | **NOTIFIES** | `aws_resource` | FORWARD |
| `aws_sns_topic` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_sns_topic` | **DENIES** | `aws_resource` | REVERSE |
| `aws_sqs_queue` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_sqs_queue` | **DENIES** | `aws_resource` | REVERSE |
| `aws_sso_group` | **ASSIGNED** | `aws_account` | FORWARD |
| `aws_sso_permission_set` | **ASSIGNED** | `aws_iam_policy` | FORWARD |
| `aws_sso_permission_set` | **ASSIGNED** | `aws_account` | FORWARD |
| `aws_sso_user` | **ASSIGNED** | `aws_account` | FORWARD |
| `aws_vpc` | **LOGS** | `aws_cloudwatch_log_group` | FORWARD |
| `aws_vpc` | **LOGS** | `aws_s3_bucket` | FORWARD |
| `aws_vpc` | **CONNECTS** | `aws_vpc` | FORWARD |
| `aws_vpc` | **CONNECTS** | `aws_vpc` | REVERSE |
| `aws_vpc_endpoint` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_vpc_endpoint` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_vpc_endpoint` | **DENIES** | `aws_resource` | FORWARD |
| `aws_vpc_endpoint` | **DENIES** | `aws_resource` | REVERSE |

### Aws Api Gateway Stage Method Setting

`aws_api_gateway_stage_method_setting` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cacheTtlInSeconds` | `number` |  |  |
| `isAuthorizationForCacheControlRequired` | `boolean` |  |  |
| `isCacheDataEncrypted` | `boolean` |  |  |
| `isCachingEnabled` | `boolean` |  |  |
| `isDataTraceEnabled` | `boolean` |  |  |
| `isMetricsEnabled` | `boolean` |  |  |
| `loggingLevel` | `string` |  |  |
| `methodPath` | `string` |  |  |
| `throttlingBurstLimit` | `number` |  |  |
| `throttlingRateLimit` | `number` |  |  |
| `unauthorizedCacheControlHeaderStrategy` | `string` |  |  |

---

### Aws Appconfig Account Settings

`aws_appconfig_account_settings` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns these settings. |  |
| 

`deletionProtectionPeriodInMinutes` \*

 | `number` **|** `null` | The interval, in minutes, during which AppConfig monitors for configuration retrieval before allowing deletion of a configuration profile or environment. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | Whether deletion protection is enabled for the account in this region, preventing deletion of actively-used environments and configuration profiles. |  |
| 

`isVendedMetricsEnabled` \*

 | `boolean` **|** `null` | Whether AppConfig publishes vended CloudWatch metrics for the account in this region. |  |
| 

`region` \*

 | `string` | AWS region these account settings apply to. |  |

---

### Aws Appconfig Application

`aws_appconfig_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the application. |  |
| 

`arn` \*

 | `string` | The ARN of the AppConfig application. |  |
| 

`region` \*

 | `string` | AWS region where the application is deployed. |  |

---

### Aws Appconfig Configuration Profile

`aws_appconfig_configuration_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationId` \*

 | `string` | The ID of the parent AppConfig application. |  |
| 

`arn` \*

 | `string` | The ARN of the AppConfig configuration profile. |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key used to encrypt configuration data at rest. |  |
| 

`kmsKeyIdentifier` \*

 | `string` **|** `null` | KMS key identifier (alias or key ID) used for encryption. |  |
| 

`locationUri` \*

 | `string` **|** `null` | URI pointing to the source of configuration data (S3 URI, SSM parameter, or hosted). |  |
| 

`region` \*

 | `string` | AWS region where the profile is deployed. |  |
| 

`retrievalRoleArn` \*

 | `string` **|** `null` | IAM role ARN that AppConfig uses to retrieve configuration from the location URI. |  |
| 

`type` \*

 | `string` **|** `null` | The type of the configuration profile (AWS.AppConfig.FeatureFlags or AWS.Freeform). |  |
| 

`validatorTypes` \*

 | `array` **|** `null` | List of validator types attached to this profile (JSON\_SCHEMA, LAMBDA). |  |

---

### Aws Appconfig Deployment

`aws_appconfig_deployment` inherits from [Deployment](/data-model/schemas/Deployment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationId` \*

 | `string` | The ID of the parent AppConfig application. |  |
| 

`arn` \*

 | `string` | The ARN of the AppConfig deployment. |  |
| 

`configurationLocationUri` \*

 | `string` **|** `null` | URI of the configuration source used in this deployment. |  |
| 

`configurationName` \*

 | `string` **|** `null` | Name of the configuration profile used in this deployment. |  |
| 

`deploymentNumber` \*

 | `number` | The sequence number of this deployment within the environment. |  |
| 

`deploymentStrategyId` \*

 | `string` **|** `null` | ID of the deployment strategy used for this deployment. |  |
| 

`environmentId` \*

 | `string` | The ID of the environment to which the configuration was deployed. |  |
| 

`extensionId` \*

 | `string` **|** `null` | ID of the AppConfig extension associated with this deployment. |  |
| 

`finalBakeTimeInMinutes` \*

 | `number` **|** `null` | Bake time in minutes applied during this deployment. |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key used to encrypt configuration data for this deployment. |  |
| 

`kmsKeyIdentifier` \*

 | `string` **|** `null` | KMS key identifier used during this deployment. |  |
| 

`region` \*

 | `string` | AWS region where the deployment was executed. |  |
| 

`versionLabel` \*

 | `string` **|** `null` | Customer-defined version label for the configuration version deployed. |  |

---

### Aws Appconfig Deployment Strategy

`aws_appconfig_deployment_strategy` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the AppConfig deployment strategy. |  |
| 

`finalBakeTimeInMinutes` \*

 | `number` **|** `null` | Additional time in minutes to monitor after a deployment completes before it is considered successful. |  |
| 

`region` \*

 | `string` | AWS region where the deployment strategy is defined. |  |
| 

`replicateTo` \*

 | `string` **|** `null` | Whether to replicate the deployment strategy to AWS Systems Manager (SSM\_DOCUMENT) or not (NONE). |  |

---

### Aws Appconfig Environment

`aws_appconfig_environment` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alarmArn` \*

 | `string` **|** `null` | ARN of the CloudWatch alarm monitoring this environment. |  |
| 

`alarmRoleArn` \*

 | `string` **|** `null` | IAM role ARN used by AppConfig to evaluate CloudWatch alarms for this environment. |  |
| 

`applicationId` \*

 | `string` | The ID of the parent AppConfig application. |  |
| 

`arn` \*

 | `string` | The ARN of the AppConfig environment. |  |
| 

`region` \*

 | `string` | AWS region where the environment is deployed. |  |
| 

`state` \*

 | `string` **|** `null` | The current state of the environment (e.g. READY\_FOR\_DEPLOYMENT, DEPLOYING, ROLLED\_BACK). |  |

---

### Aws Appconfig Hosted Configuration Version

`aws_appconfig_hosted_configuration_version` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationId` \*

 | `string` | The ID of the parent AppConfig application. |  |
| 

`arn` \*

 | `string` | The ARN of the hosted configuration version. |  |
| 

`configurationProfileId` \*

 | `string` | The ID of the configuration profile this version belongs to. |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key used to encrypt this hosted configuration version. |  |
| 

`region` \*

 | `string` | AWS region where the hosted configuration version is stored. |  |
| 

`versionNumber` \*

 | `number` | The version number of this hosted configuration version. |  |

---

### Aws Athena Work Group

`aws_athena_work_group` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`additionalConfiguration` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`bytesScannedCutoffPerQuery` \*

 | `number` **|** `null` |  |  |
| 

`customerContentEncryptionKmsKey` \*

 | `string` **|** `null` |  |  |
| 

`encrypted` \*

 | `boolean` |  |  |
| 

`encryptionKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`engineVersionEffective` \*

 | `string` **|** `null` |  |  |
| 

`engineVersionSelected` \*

 | `string` **|** `null` |  |  |
| 

`executionRole` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterApplicationArn` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isEnforceWorkGroupConfiguration` \*

 | `boolean` **|** `null` |  |  |
| 

`isIdentityCenterEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isMinimumEncryptionEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isPublishCloudWatchMetricsEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isRequesterPaysEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resultAclConfiguration` \*

 | `string` **|** `null` |  |  |
| 

`resultEncryptionKmsKey` \*

 | `string` **|** `null` |  |  |
| 

`resultEncryptionOption` \*

 | `string` **|** `null` |  |  |
| 

`resultExpectedBucketOwner` \*

 | `string` **|** `null` |  |  |
| 

`resultOutputLocation` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`webLink` \*

 | `string` |  |  |

---

### Aws Auditmanager Assessment

`aws_auditmanager_assessment` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`assessmentReportDestination` \*

 | `string` **|** `null` |  |  |
| 

`awsAccountEmailAddress` \*

 | `string` **|** `null` |  |  |
| 

`awsAccountId` \*

 | `string` **|** `null` |  |  |
| 

`awsAccountName` \*

 | `string` **|** `null` |  |  |
| 

`complianceType` \*

 | `string` **|** `null` |  |  |
| 

`delegationsCount` \*

 | `number` |  |  |
| 

`frameworkArn` \*

 | `string` **|** `null` |  |  |
| 

`frameworkDescription` \*

 | `string` **|** `null` |  |  |
| 

`frameworkId` \*

 | `string` **|** `null` |  |  |
| 

`frameworkName` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`rolesCount` \*

 | `number` |  |  |
| 

`scopeAwsAccounts` \*

 | `array` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |

---

### Aws Auditmanager Control

`aws_auditmanager_control` inherits from [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`actionPlanInstructions` \*

 | `string` **|** `null` |  |  |
| 

`actionPlanTitle` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`controlMappingSourcesCount` \*

 | `number` |  |  |
| 

`controlSources` \*

 | `string` **|** `null` |  |  |
| 

`createdBy` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lastUpdatedBy` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`testingInformation` \*

 | `string` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Aws Auditmanager Delegation

`aws_auditmanager_delegation` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`assessmentId` \*

 | `string` **|** `null` |  |  |
| 

`assessmentName` \*

 | `string` **|** `null` |  |  |
| 

`controlSetName` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Auditmanager Evidence Folder

`aws_auditmanager_evidence_folder` inherits from [DataObject](/data-model/schemas/DataObject.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assessmentId` \*

 | `string` |  |  |
| 

`assessmentReportSelectionCount` \*

 | `number` |  |  |
| 

`author` \*

 | `string` **|** `null` |  |  |
| 

`controlId` \*

 | `string` |  |  |
| 

`controlName` \*

 | `string` **|** `null` |  |  |
| 

`controlSetId` \*

 | `string` |  |  |
| 

`dataSource` \*

 | `string` **|** `null` |  |  |
| 

`evidenceAwsServiceSourceCount` \*

 | `number` |  |  |
| 

`evidenceByTypeComplianceCheckCount` \*

 | `number` |  |  |
| 

`evidenceByTypeComplianceCheckIssuesCount` \*

 | `number` |  |  |
| 

`evidenceByTypeConfigurationDataCount` \*

 | `number` |  |  |
| 

`evidenceByTypeManualCount` \*

 | `number` |  |  |
| 

`evidenceByTypeUserActivityCount` \*

 | `number` |  |  |
| 

`evidenceResourcesIncludedCount` \*

 | `number` |  |  |
| 

`firstEvidenceAddedOn` \*

 | `number` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`totalEvidence` \*

 | `number` |  |  |

---

### Aws Auditmanager Framework

`aws_auditmanager_framework` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`complianceType` \*

 | `string` **|** `null` |  |  |
| 

`controlsCount` \*

 | `number` |  |  |
| 

`controlSetIds` \*

 | `array` **|** `null` |  |  |
| 

`controlSetsCount` \*

 | `number` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`logo` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Auditmanager Setting

`aws_auditmanager_setting` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`defaultAssessmentReportsDestination` \*

 | `string` **|** `null` |  |  |
| 

`defaultAssessmentReportsDestinationBucketName` \*

 | `string` **|** `null` |  |  |
| 

`defaultAssessmentReportsDestinationType` \*

 | `string` **|** `null` |  |  |
| 

`defaultExportDestination` \*

 | `string` **|** `null` |  |  |
| 

`defaultExportDestinationBucketName` \*

 | `string` **|** `null` |  |  |
| 

`defaultExportDestinationType` \*

 | `string` **|** `null` |  |  |
| 

`defaultProcessOwnerRoleArns` \*

 | `array` **|** `null` |  |  |
| 

`deregistrationDeleteResources` \*

 | `string` **|** `null` |  |  |
| 

`evidenceFinderBackfillStatus` \*

 | `string` **|** `null` |  |  |
| 

`evidenceFinderEnablementStatus` \*

 | `string` **|** `null` |  |  |
| 

`evidenceFinderError` \*

 | `string` **|** `null` |  |  |
| 

`evidenceFinderEventDataStoreArn` \*

 | `string` **|** `null` |  |  |
| 

`isAwsOrgEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isDefaultKmsKey` \*

 | `boolean` **|** `null` |  |  |
| 

`isEvidenceFinderEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`snsTopicArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Bedrock Agent

`aws_bedrock_agent` inherits from [Function](/data-model/schemas/Function.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentCollaboration` \*

 | `string` **|** `null` | Multi-agent collaboration mode (e.g., DISABLED, SUPERVISOR) |  |
| `agentId` | `string` | Unique identifier for the Bedrock agent |  |
| `arn` | `string` | ARN of the Bedrock agent |  |
| 

`customerEncryptionKeyArn` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt agent resources |  |
| 

`displayName` \*

 | `string` | Display name of the Bedrock agent |  |
| 

`foundationModel` \*

 | `string` **|** `null` | Foundation model identifier used by the agent |  |
| 

`guardrailId` \*

 | `string` **|** `null` | ID of the Bedrock guardrail associated with this agent |  |
| 

`hasInstruction` \*

 | `boolean` **|** `null` | Whether the agent has a system instruction configured; true if instruction text is present |  |
| 

`idleSessionTTLInSeconds` \*

 | `number` **|** `null` | Time in seconds before an idle session expires |  |
| 

`instruction` \*

 | `string` **|** `null` | System instruction prompt given to the agent |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the agent is encrypted with a customer-managed KMS key; false means AWS-managed encryption |  |
| 

`isGuardrailAssociated` \*

 | `boolean` **|** `null` | Whether a guardrail is associated with this agent; true means content filtering is active |  |
| 

`isMemoryEnabled` \*

 | `boolean` **|** `null` | Whether the agent retains memory across sessions |  |
| 

`name` \*

 | `string` | Name of the Bedrock agent |  |
| 

`orchestrationType` \*

 | `string` **|** `null` | Orchestration strategy used by the agent (e.g., DEFAULT, CUSTOM\_ORCHESTRATION) |  |
| `preparedOn` | `number` | Timestamp (epoch ms) when the agent was last prepared |  |
| 

`region` \*

 | `string` | AWS region where the agent is deployed |  |
| 

`roleArn` \*

 | `string` **|** `null` | ARN of the IAM role assumed by the agent for API calls |  |

---

### Aws Bedrock Agent Action Group

`aws_bedrock_agent_action_group` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`actionGroupExecutor` \*

 | `string` **|** `null` | Type of executor for the action group (e.g., LAMBDA, RETURN\_CONTROL) |  |
| `actionGroupId` | `string` | Unique identifier for the action group |  |
| `agentId` | `string` | ID of the parent Bedrock agent that owns this action group |  |
| 

`apiSchemaS3Uri` \*

 | `string` **|** `null` | S3 URI of the OpenAPI schema defining the action group API |  |
| 

`apiSchemaType` \*

 | `string` **|** `null` | Type of API schema used (e.g., S3, INLINE) |  |
| 

`displayName` \*

 | `string` | Display name of the action group |  |
| 

`functionCount` \*

 | `number` **|** `null` | Number of functions defined in the action group |  |
| 

`functionNames` \*

 | `array` **|** `null` | Names of functions defined in the action group function schema |  |
| 

`isLambdaBacked` \*

 | `boolean` **|** `null` | Whether this action group executes via a Lambda function; true means external code execution |  |
| 

`isReturnControl` \*

 | `boolean` **|** `null` | Whether the action group returns control to the caller instead of executing directly |  |
| 

`lambdaFunctionArn` \*

 | `string` **|** `null` | ARN of the Lambda function invoked by this action group |  |
| 

`name` \*

 | `string` | Name of the action group |  |
| 

`parentActionGroupSignature` \*

 | `string` **|** `null` | Signature of a built-in parent action group (e.g., AMAZON.UserInput, AMAZON.CodeInterpreter) |  |
| 

`region` \*

 | `string` | AWS region where the action group is defined |  |

---

### Aws Bedrock Agent Runtime

`aws_bedrock_agent_runtime` inherits from [Workload](/data-model/schemas/Workload.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentRuntimeId` \*

 | `string` **|** `null` |  |  |
| 

`agentRuntimeVersion` \*

 | `string` **|** `null` |  |  |
| `arn` | `string` |  |  |
| 

`failureReason` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isPublicNetwork` \*

 | `boolean` **|** `null` |  |  |
| 

`isVpcConfigured` \*

 | `boolean` **|** `null` |  |  |
| 

`networkMode` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`serverProtocol` \*

 | `string` **|** `null` |  |  |
| 

`subnetIds` \*

 | `array` **|** `null` |  |  |

---

### Aws Bedrock Api Key

`aws_bedrock_api_key` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`apiKeyId` \*

 | `string` | IAM ServiceSpecificCredentialId — unique identifier for the API key |  |
| 

`isAutoCreatedUser` \*

 | `boolean` **|** `null` | True when the owning IAM user was auto-created by AWS for this key (UserName starts with "BedrockAPIKey-") |  |
| 

`isExpired` \*

 | `boolean` **|** `null` | True when the API key has reached its expiration date |  |
| 

`isNeverExpiring` \*

 | `boolean` **|** `null` | True when the API key was created without an expiration date — long-lived credential risk |  |
| 

`region` \*

 | `string` | Region label - API keys are global; set to "global" for the entity |  |
| 

`serviceCredentialAlias` \*

 | `string` **|** `null` | Public, non-secret prefix of the bearer token; safe to display |  |
| 

`serviceName` \*

 | `string` | AWS service the credential is scoped to (always bedrock.amazonaws.com) |  |
| 

`serviceUserName` \*

 | `string` **|** `null` | Service-side username generated by IAM for the key |  |
| `status` | `string` | Lifecycle status — Active, Inactive, or Expired |  |
| 

`userName` \*

 | `string` | IAM user that owns the API key |  |

---

### Aws Bedrock Code Interpreter

`aws_bedrock_code_interpreter` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`codeInterpreterId` \*

 | `string` **|** `null` |  |  |
| 

`failureReason` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isPublicNetwork` \*

 | `boolean` **|** `null` |  |  |
| 

`isSandboxed` \*

 | `boolean` **|** `null` |  |  |
| 

`isVpcConfigured` \*

 | `boolean` **|** `null` |  |  |
| 

`networkMode` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`subnetIds` \*

 | `array` **|** `null` |  |  |

---

### Aws Bedrock Custom Model

`aws_bedrock_custom_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the custom model |  |
| 
`baseModelArn` \*

 | `string` **|** `null` | ARN of the foundation model used as the base for customization |  |
| 

`customizationType` \*

 | `string` **|** `null` | Type of customization applied (e.g., FINE\_TUNING, CONTINUED\_PRE\_TRAINING) |  |
| 

`displayName` \*

 | `string` | Display name of the custom model |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the custom model is encrypted with a customer-managed KMS key; false means AWS-managed encryption |  |
| 

`jobArn` \*

 | `string` **|** `null` | ARN of the model customization job that produced this model |  |
| `modelId` | `string` | Unique identifier for the custom model |  |
| 

`modelKmsKeyArn` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt the custom model |  |
| 

`name` \*

 | `string` | Name of the custom model |  |
| 

`outputDataConfigS3Uri` \*

 | `string` **|** `null` | S3 URI where training output artifacts are stored |  |
| 

`region` \*

 | `string` | AWS region where the custom model is stored |  |
| 

`trainingDataConfigS3Uri` \*

 | `string` **|** `null` | S3 URI of the training dataset used to create the custom model |  |

---

### Aws Bedrock Evaluation Job

`aws_bedrock_evaluation_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationType` \*

 | `string` **|** `null` |  |  |
| `arn` | `string` |  |  |
| 

`customerEncryptionKeyId` \*

 | `string` **|** `null` |  |  |
| 

`evaluationDatasets` \*

 | `array` **|** `null` |  |  |
| 

`evaluationMetrics` \*

 | `array` **|** `null` |  |  |
| 

`failureMessages` \*

 | `array` **|** `null` |  |  |
| 

`isAutomatedEvaluation` \*

 | `boolean` **|** `null` |  |  |
| 

`isHumanEvaluation` \*

 | `boolean` **|** `null` |  |  |
| 

`isModelInference` \*

 | `boolean` **|** `null` |  |  |
| 

`isRagInference` \*

 | `boolean` **|** `null` |  |  |
| 

`jobDescription` \*

 | `string` **|** `null` |  |  |
| 

`jobName` \*

 | `string` **|** `null` |  |  |
| 

`jobType` \*

 | `string` **|** `null` |  |  |
| `lastModifiedOn` | `number` | Timestamp (epoch ms) when the evaluation job was last modified |  |
| 

`modelIdentifiers` \*

 | `array` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`outputDataConfigS3Uri` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`taskType` \*

 | `string` **|** `null` |  |  |

---

### Aws Bedrock Flow

`aws_bedrock_flow` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the Bedrock flow |  |
| 
`connectionCount` \*

 | `number` **|** `null` | Number of connections between nodes in the flow |  |
| 

`customerEncryptionKeyArn` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt flow resources |  |
| 

`displayName` \*

 | `string` | Display name of the flow |  |
| `flowId` | `string` | Unique identifier for the flow |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the flow is encrypted with a customer-managed KMS key; false means AWS-managed encryption |  |
| 

`name` \*

 | `string` | Name of the flow |  |
| 

`nodeCount` \*

 | `number` **|** `null` | Number of nodes in the flow definition |  |
| 

`region` \*

 | `string` | AWS region where the flow is deployed |  |
| 

`roleArn` \*

 | `string` **|** `null` | ARN of the IAM role assumed by the flow during execution |  |
| 

`version` \*

 | `string` **|** `null` | Version identifier of the flow |  |

---

### Aws Bedrock Foundation Model

`aws_bedrock_foundation_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the foundation model |  |
| 
`customizationsSupported` \*

 | `array` **|** `null` | Customization types supported (e.g., FINE\_TUNING, CONTINUED\_PRE\_TRAINING) |  |
| 

`displayName` \*

 | `string` | Display name of the foundation model |  |
| 

`inferenceTypesSupported` \*

 | `array` **|** `null` | Inference types the model supports (e.g., ON\_DEMAND, PROVISIONED) |  |
| 

`inputModalities` \*

 | `array` **|** `null` | Input modalities supported by the model (e.g., TEXT, IMAGE, EMBEDDING) |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether the model lifecycle status is ACTIVE and available for use |  |
| 

`isFineTuneable` \*

 | `boolean` **|** `null` | Whether the model can be fine-tuned with custom training data |  |
| 

`isStreamingSupported` \*

 | `boolean` **|** `null` | Whether the model supports streaming inference responses |  |
| `modelId` | `string` | Unique model identifier (e.g., anthropic.claude-3-sonnet-20240229-v1:0) |  |
| 

`modelLifecycleStatus` \*

 | `string` **|** `null` | Lifecycle status of the model (e.g., ACTIVE, LEGACY) |  |
| 

`modelName` \*

 | `string` **|** `null` | Human-readable name of the model (e.g., Claude 3 Sonnet) |  |
| 

`name` \*

 | `string` | Name of the foundation model |  |
| 

`outputModalities` \*

 | `array` **|** `null` | Output modalities supported by the model (e.g., TEXT, IMAGE, EMBEDDING) |  |
| 

`providerName` \*

 | `string` **|** `null` | Name of the model provider (e.g., Anthropic, Amazon, Meta) |  |
| 

`region` \*

 | `string` | AWS region where the model is available |  |

---

### Aws Bedrock Guardrail

`aws_bedrock_guardrail` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the Bedrock guardrail |  |
| 
`blockedInputMessaging` \*

 | `string` **|** `null` | Message returned to users when their input is blocked by the guardrail |  |
| 

`blockedOutputsMessaging` \*

 | `string` **|** `null` | Message returned to users when model output is blocked by the guardrail |  |
| 

`blockedTopicCount` \*

 | `number` **|** `null` | Number of topics configured as blocked in the topic policy |  |
| 

`contentFilterTypes` \*

 | `array` **|** `null` | Types of content filters enabled (e.g., SEXUAL, VIOLENCE, HATE, INSULTS) |  |
| 

`displayName` \*

 | `string` | Display name of the guardrail |  |
| 

`failureRecommendations` \*

 | `array` **|** `null` | Recommendations for resolving guardrail creation or update failures |  |
| 

`groundingThreshold` \*

 | `number` **|** `null` | Minimum grounding score (0-1) required for responses to pass the grounding filter |  |
| `guardrailId` | `string` | Unique identifier for the guardrail |  |
| 

`guardrailProfileArn` \*

 | `string` **|** `null` | ARN of the cross-region guardrail profile for multi-region deployments |  |
| 

`isContentFilterEnabled` \*

 | `boolean` **|** `null` | Whether content filtering is enabled to block harmful content categories |  |
| 

`isContextualGroundingEnabled` \*

 | `boolean` **|** `null` | Whether contextual grounding checks are enabled to reduce hallucination |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the guardrail is encrypted with a customer-managed KMS key; false means AWS-managed encryption |  |
| 

`isPiiDetectionEnabled` \*

 | `boolean` **|** `null` | Whether PII detection is enabled to identify or block personally identifiable information |  |
| 

`isPromptAttackDetectionEnabled` \*

 | `boolean` **|** `null` | Whether prompt attack (injection) detection is enabled to protect against adversarial inputs |  |
| 

`isSensitiveInfoFilterEnabled` \*

 | `boolean` **|** `null` | Whether sensitive information filtering (PII/regex) is enabled |  |
| 

`isTopicPolicyEnabled` \*

 | `boolean` **|** `null` | Whether topic-based blocking policies are configured |  |
| 

`isWordFilterEnabled` \*

 | `boolean` **|** `null` | Whether word-based filtering is enabled to block specific terms |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt guardrail data |  |
| 

`managedWordListTypes` \*

 | `array` **|** `null` | Types of managed word lists applied (e.g., PROFANITY) |  |
| 

`name` \*

 | `string` | Name of the guardrail |  |
| 

`piiEntityTypes` \*

 | `array` **|** `null` | PII entity types detected or blocked (e.g., EMAIL, PHONE, SSN) |  |
| 

`regexPatternCount` \*

 | `number` **|** `null` | Number of custom regex patterns configured for sensitive data detection |  |
| 

`region` \*

 | `string` | AWS region where the guardrail is deployed |  |
| 

`relevanceThreshold` \*

 | `number` **|** `null` | Minimum relevance score (0-1) required for responses to pass the relevance filter |  |
| 

`statusReasons` \*

 | `array` **|** `null` | Reasons explaining the current guardrail status |  |
| `version` | `string` | Version of the guardrail (e.g., DRAFT or a numeric version) |  |

---

### Aws Bedrock Inference Profile

`aws_bedrock_inference_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the inference profile |  |
| 
`displayName` \*

 | `string` | Display name of the inference profile |  |
| `inferenceProfileId` | `string` | Unique identifier for the inference profile |  |
| 

`modelArns` \*

 | `array` **|** `null` | ARNs of the models routed to by this inference profile |  |
| 

`name` \*

 | `string` | Name of the inference profile |  |
| 

`region` \*

 | `string` | AWS region where the inference profile is configured |  |
| 

`type` \*

 | `string` **|** `null` | Type of inference profile (e.g., SYSTEM\_DEFINED, APPLICATION) |  |

---

### Aws Bedrock Knowledge Base

`aws_bedrock_knowledge_base` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the Bedrock knowledge base |  |
| 
`displayName` \*

 | `string` | Display name of the knowledge base |  |
| 

`embeddingModelArn` \*

 | `string` **|** `null` | ARN of the embedding model used to vectorize documents |  |
| 

`failureReasons` \*

 | `array` **|** `null` | Reasons why the knowledge base failed to create or update |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether the knowledge base is in an active and usable state |  |
| 

`isOpenSearchBacked` \*

 | `boolean` **|** `null` | Whether the knowledge base uses OpenSearch Serverless as its vector store |  |
| `knowledgeBaseId` | `string` | Unique identifier for the knowledge base |  |
| 

`knowledgeBaseType` \*

 | `string` **|** `null` | Type of the knowledge base (e.g., VECTOR, KENDRA) |  |
| 

`name` \*

 | `string` | Name of the knowledge base |  |
| 

`region` \*

 | `string` | AWS region where the knowledge base is deployed |  |
| 

`roleArn` \*

 | `string` **|** `null` | ARN of the IAM role used by the knowledge base to access data sources |  |
| 

`storageConfigurationArn` \*

 | `string` **|** `null` | ARN of the vector store resource used for storage |  |
| 

`storageType` \*

 | `string` **|** `null` | Type of vector store backing the knowledge base (e.g., OPENSEARCH\_SERVERLESS, PINECONE, RDS) |  |

---

### Aws Bedrock Knowledge Base Data Source

`aws_bedrock_knowledge_base_data_source` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`chunkingStrategy` \*

 | `string` **|** `null` | Strategy used to chunk documents (e.g., FIXED\_SIZE, NONE, HIERARCHICAL) |  |
| `dataSourceId` | `string` | Unique identifier for the data source |  |
| 

`dataSourceType` \*

 | `string` **|** `null` | Type of data source (e.g., S3, WEB, CONFLUENCE) |  |
| 

`displayName` \*

 | `string` | Display name of the data source |  |
| 

`failureReason` \*

 | `string` **|** `null` | Reason why the data source failed to sync or create |  |
| 

`isS3Backed` \*

 | `boolean` **|** `null` | Whether the data source reads from an S3 bucket |  |
| 

`isWebCrawler` \*

 | `boolean` **|** `null` | Whether the data source crawls web content |  |
| `knowledgeBaseId` | `string` | ID of the parent knowledge base this data source belongs to |  |
| 

`name` \*

 | `string` | Name of the data source |  |
| 

`region` \*

 | `string` | AWS region where the data source is configured |  |
| 

`s3BucketArn` \*

 | `string` **|** `null` | ARN of the S3 bucket used as the data source |  |
| 

`s3InclusionPrefixes` \*

 | `array` **|** `null` | S3 key prefixes that scope which objects are included in the data source |  |

---

### Aws Bedrock Model Customization Job

`aws_bedrock_model_customization_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`baseModelArn` \*

 | `string` **|** `null` |  |  |
| 

`customizationType` \*

 | `string` **|** `null` |  |  |
| `endTime` | `number` |  |  |
| 

`failureMessage` \*

 | `string` **|** `null` |  |  |
| 

`jobName` \*

 | `string` **|** `null` |  |  |
| `lastModifiedOn` | `number` | Timestamp (epoch ms) when the customization job was last modified |  |
| 

`name` \*

 | `string` |  |  |
| 

`outputDataConfigS3Uri` \*

 | `string` **|** `null` |  |  |
| 

`outputModelArn` \*

 | `string` **|** `null` |  |  |
| 

`outputModelName` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`trainingDataConfigS3Uri` \*

 | `string` **|** `null` |  |  |
| 

`validationDataConfigS3Uris` \*

 | `array` **|** `null` |  |  |

---

### Aws Bedrock Model Invocation Logging

`aws_bedrock_model_invocation_logging` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cloudWatchLogGroupName` \*

 | `string` **|** `null` | Name of the CloudWatch log group receiving invocation logs |  |
| 

`isCloudWatchLoggingEnabled` \*

 | `boolean` **|** `null` | Whether model invocation logs are delivered to CloudWatch Logs |  |
| 

`isEmbeddingDataLogged` \*

 | `boolean` **|** `null` | Whether embedding data is included in invocation logs |  |
| 

`isImageDataLogged` \*

 | `boolean` **|** `null` | Whether image input and output data is included in invocation logs |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` | Whether any model invocation logging is enabled; false means no invocation data is captured |  |
| 

`isS3LoggingEnabled` \*

 | `boolean` **|** `null` | Whether model invocation logs are delivered to an S3 bucket |  |
| 

`isTextDataLogged` \*

 | `boolean` **|** `null` | Whether text input and output data is included in invocation logs |  |
| 

`region` \*

 | `string` | AWS region where logging is configured |  |
| 

`s3BucketName` \*

 | `string` **|** `null` | Name of the S3 bucket where invocation logs are stored |  |
| 

`s3KeyPrefix` \*

 | `string` **|** `null` | S3 key prefix for organizing invocation log files |  |

---

### Aws Bedrock Provisioned Throughput

`aws_bedrock_provisioned_throughput` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the provisioned throughput |  |
| 
`commitmentDuration` \*

 | `string` **|** `null` | Commitment duration for the provisioned throughput (e.g., OneMonth, SixMonths) |  |
| `commitmentExpirationTime` | `number` | Timestamp (epoch ms) when the commitment period expires |  |
| 

`desiredModelUnits` \*

 | `number` **|** `null` | Desired number of model units for the provisioned throughput |  |
| 

`displayName` \*

 | `string` | Display name of the provisioned throughput |  |
| 

`failureMessage` \*

 | `string` **|** `null` | Error message if the provisioned throughput failed to create or update |  |
| 

`foundationModelArn` \*

 | `string` **|** `null` | ARN of the underlying foundation model |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether the provisioned throughput is currently in service and accepting requests |  |
| `lastModifiedOn` | `number` | Timestamp (epoch ms) when the provisioned throughput was last modified |  |
| 

`modelArn` \*

 | `string` **|** `null` | ARN of the model associated with this provisioned throughput |  |
| 

`modelUnits` \*

 | `number` **|** `null` | Number of model units currently provisioned |  |
| 

`name` \*

 | `string` | Name of the provisioned throughput |  |
| `provisionedModelId` | `string` | Unique identifier for the provisioned model throughput |  |
| 

`region` \*

 | `string` | AWS region where the provisioned throughput is deployed |  |

---

### Aws Cloudmap Namespace

`aws_cloudmap_namespace` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`creatorRequestId` \*

 | `string` **|** `null` |  |  |
| 

`hostedZoneId` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isHttpNamespace` \*

 | `boolean` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceCount` \*

 | `number` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Aws Cloudmap Service

`aws_cloudmap_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`creatorRequestId` \*

 | `string` **|** `null` |  |  |
| 

`dnsRecordTtl` \*

 | `number` **|** `null` |  |  |
| 

`dnsRecordType` \*

 | `string` **|** `null` |  |  |
| 

`healthCheckFailureThreshold` \*

 | `number` **|** `null` |  |  |
| 

`healthCheckResourcePath` \*

 | `string` **|** `null` |  |  |
| 

`healthCheckType` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`instanceCount` \*

 | `number` **|** `null` |  |  |
| 

`isHealthCheckEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`namespaceId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`routingPolicy` \*

 | `string` **|** `null` |  |  |

---

### Aws Cloudmap Service Instance

`aws_cloudmap_service_instance` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`creatorRequestId` \*

 | `string` **|** `null` |  |  |
| 

`customAttributesCount` \*

 | `number` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`instanceId` \*

 | `string` **|** `null` |  |  |
| 

`port` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceId` \*

 | `string` |  |  |

---

### Aws Cloudwatch Log Group Metrics

`aws_cloudwatch_log_group_metrics` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`collectedOn` \*

 | `number` |  |  |
| 

`dailyDeliveryErrors` \*

 | `number` **|** `null` |  |  |
| 

`dailyDeliveryThrottling` \*

 | `number` **|** `null` |  |  |
| 

`dailyEMFParsingErrors` \*

 | `number` **|** `null` |  |  |
| 

`dailyEMFValidationErrors` \*

 | `number` **|** `null` |  |  |
| 

`dailyForwardedBytes` \*

 | `number` **|** `null` |  |  |
| 

`dailyForwardedLogEvents` \*

 | `number` **|** `null` |  |  |
| 

`dailyIncomingBytes` \*

 | `number` **|** `null` |  |  |
| 

`dailyIncomingLogEvents` \*

 | `number` **|** `null` |  |  |
| 

`dailyLogEventsWithFindings` \*

 | `number` **|** `null` |  |  |
| 

`dailyTransformationErrors` \*

 | `number` **|** `null` |  |  |
| 

`dailyTransformedBytes` \*

 | `number` **|** `null` |  |  |
| 

`dailyTransformedLogEvents` \*

 | `number` **|** `null` |  |  |
| 

`endedOn` \*

 | `number` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`logGroupName` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`period` \*

 | `number` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`startedOn` \*

 | `number` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Cloudwatch Log Metric Filter

`aws_cloudwatch_log_metric_filter` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`defaultValue` \*

 | `number` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`filterName` \*

 | `string` |  |  |
| 

`filterPattern` \*

 | `string` **|** `null` |  |  |
| 

`isApplyOnTransformedLogs` \*

 | `boolean` **|** `null` |  |  |
| 

`logGroupName` \*

 | `string` |  |  |
| 

`metricName` \*

 | `string` **|** `null` |  |  |
| 

`metricNamespace` \*

 | `string` **|** `null` |  |  |
| 

`metricTransformationCount` \*

 | `number` **|** `null` |  |  |
| 

`metricValue` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`pattern` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`unit` \*

 | `string` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Codeartifact Domain

`aws_codeartifact_domain` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The AWS account id ingesting the domain. |  |
| 

`arn` \*

 | `string` | The ARN of the domain. |  |
| 

`assetSizeBytes` \*

 | `number` **|** `null` | The total size, in bytes, of all assets in the domain. |  |
| 

`domainOwner` \*

 | `string` **|** `null` | The 12-digit account number of the AWS account that owns the domain. |  |
| 

`encryptionKeyArn` \*

 | `string` **|** `null` | The ARN of the KMS key used to encrypt assets in the domain. |  |
| 

`hasResourcePolicy` \*

 | `boolean` **|** `null` | True when a domain permissions policy is attached, false when none is attached, and null when the policy could not be read. |  |
| 

`isCrossAccountAccessAllowed` \*

 | `boolean` **|** `null` | True when the domain permissions policy grants access to a principal outside the ingesting account; false when it does not (including when no policy is attached); null when the policy could not be read. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | True when the domain permissions policy grants access to any principal; false when it does not (including when no policy is attached); null when the policy could not be read. |  |
| 

`region` \*

 | `string` | The AWS region the domain resides in. |  |
| 

`repositoryCount` \*

 | `number` **|** `null` | The number of repositories in the domain. |  |
| 

`resourcePolicyPrincipalAccountIds` \*

 | `array` **|** `null` | Distinct external account ids referenced as principals in the domain permissions policy. |  |
| 

`resourcePolicyRevision` \*

 | `string` **|** `null` | The current revision of the domain permissions policy. |  |
| 

`s3BucketArn` \*

 | `string` **|** `null` | The ARN of the S3 bucket that stores the package assets in the domain. |  |

---

### Aws Codeartifact Package

`aws_codeartifact_package` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The AWS account id ingesting the package. |  |
| 

`domainName` \*

 | `string` **|** `null` | The name of the domain that contains the package. |  |
| 

`format` \*

 | `string` | The package format (e.g. npm, pypi, maven, nuget, generic). |  |
| 

`isUpstreamAllowed` \*

 | `boolean` **|** `null` | True when package versions may be pulled from an upstream source. |  |
| 

`namespace` \*

 | `string` **|** `null` | The namespace of the package (e.g. Maven groupId or npm scope). |  |
| 

`packageName` \*

 | `string` | The name of the package. |  |
| 

`publishRestriction` \*

 | `string` **|** `null` | Whether publishing new package versions is ALLOW or BLOCK. |  |
| 

`region` \*

 | `string` | The AWS region the package resides in. |  |
| 

`repositoryName` \*

 | `string` **|** `null` | The name of the repository that contains the package. |  |
| 

`upstreamRestriction` \*

 | `string` **|** `null` | Whether pulling package versions from upstream is ALLOW or BLOCK. |  |

---

### Aws Codeartifact Package Group

`aws_codeartifact_package_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The AWS account id ingesting the package group. |  |
| 

`arn` \*

 | `string` | The ARN of the package group. |  |
| 

`contactInfo` \*

 | `string` **|** `null` | The contact information of the package group. |  |
| 

`domainName` \*

 | `string` **|** `null` | The name of the domain that contains the package group. |  |
| 

`domainOwner` \*

 | `string` **|** `null` | The 12-digit account number that owns the domain. |  |
| 

`externalUpstreamRestrictionMode` \*

 | `string` **|** `null` | The origin restriction mode (ALLOW, BLOCK, or INHERIT) for retaining package versions from external, public repositories. |  |
| 

`internalUpstreamRestrictionMode` \*

 | `string` **|** `null` | The origin restriction mode (ALLOW, BLOCK, or INHERIT) for retaining package versions from internal upstream repositories. |  |
| 

`parentPattern` \*

 | `string` **|** `null` | The pattern of the parent package group. |  |
| 

`pattern` \*

 | `string` | The pattern the package group matches. |  |
| 

`publishRestrictionMode` \*

 | `string` **|** `null` | The origin restriction mode (ALLOW, BLOCK, or INHERIT) for publishing package versions to the group. |  |
| 

`region` \*

 | `string` | The AWS region the package group resides in. |  |

---

### Aws Codeartifact Repository

`aws_codeartifact_repository` inherits from [Repository](/data-model/schemas/Repository.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The AWS account id ingesting the repository. |  |
| 

`administratorAccount` \*

 | `string` **|** `null` | The account that manages the repository. |  |
| 

`arn` \*

 | `string` | The ARN of the repository. |  |
| 

`domainName` \*

 | `string` **|** `null` | The name of the domain that contains the repository. |  |
| 

`domainOwner` \*

 | `string` **|** `null` | The 12-digit account number that owns the domain. |  |
| 

`endpointGeneric` \*

 | `string` **|** `null` | The generic endpoint URL of the repository. |  |
| 

`endpointMaven` \*

 | `string` **|** `null` | The Maven endpoint URL of the repository. |  |
| 

`endpointNpm` \*

 | `string` **|** `null` | The npm endpoint URL of the repository. |  |
| 

`endpointNuget` \*

 | `string` **|** `null` | The NuGet endpoint URL of the repository. |  |
| 

`endpointPypi` \*

 | `string` **|** `null` | The PyPI endpoint URL of the repository. |  |
| 

`externalConnectionNames` \*

 | `array` **|** `null` | The names of the external connections (e.g. public:npmjs) the repository proxies. |  |
| 

`externalConnectionStatus` \*

 | `string` **|** `null` | The status of the external connection when a single connection is configured. |  |
| 

`hasExternalConnections` \*

 | `boolean` **|** `null` | True when the repository has at least one external connection. |  |
| 

`hasResourcePolicy` \*

 | `boolean` **|** `null` | True when a repository permissions policy is attached, false when none is attached, and null when the policy could not be read. |  |
| 

`isCrossAccountAccessAllowed` \*

 | `boolean` **|** `null` | True when the repository permissions policy grants access to a principal outside the ingesting account; false when it does not (including when no policy is attached); null when the policy could not be read. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | True when the repository permissions policy grants access to any principal; false when it does not (including when no policy is attached); null when the policy could not be read. |  |
| 

`region` \*

 | `string` | The AWS region the repository resides in. |  |
| 

`resourcePolicyPrincipalAccountIds` \*

 | `array` **|** `null` | Distinct external account ids referenced as principals in the repository permissions policy. |  |
| 

`resourcePolicyRevision` \*

 | `string` **|** `null` | The current revision of the repository permissions policy. |  |
| 

`upstreamRepositoryNames` \*

 | `array` **|** `null` | The names of the upstream repositories. |  |

---

### Aws Codedeploy Application

`aws_codedeploy_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`applicationId` \*

 | `string` **|** `null` |  |  |
| 

`applicationName` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`computePlatform` \*

 | `string` **|** `null` |  |  |
| 

`gitHubAccountName` \*

 | `string` **|** `null` |  |  |
| 

`isLinkedToGitHub` \*

 | `boolean` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Codedeploy Deployment Config

`aws_codedeploy_deployment_config` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`canaryInterval` \*

 | `number` **|** `null` |  |  |
| 

`canaryPercentage` \*

 | `number` **|** `null` |  |  |
| 

`computePlatform` \*

 | `string` **|** `null` |  |  |
| 

`deploymentConfigId` \*

 | `string` **|** `null` |  |  |
| 

`deploymentConfigName` \*

 | `string` |  |  |
| 

`firstZoneMonitorDurationInSeconds` \*

 | `number` **|** `null` |  |  |
| 

`isBuiltIn` \*

 | `boolean` |  |  |
| 

`linearInterval` \*

 | `number` **|** `null` |  |  |
| 

`linearPercentage` \*

 | `number` **|** `null` |  |  |
| 

`minimumHealthyHostsPerZoneType` \*

 | `string` **|** `null` |  |  |
| 

`minimumHealthyHostsPerZoneValue` \*

 | `number` **|** `null` |  |  |
| 

`minimumHealthyHostsType` \*

 | `string` **|** `null` |  |  |
| 

`minimumHealthyHostsValue` \*

 | `number` **|** `null` |  |  |
| 

`monitorDurationInSeconds` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`trafficRoutingType` \*

 | `string` **|** `null` |  |  |

---

### Aws Codedeploy Deployment Group

`aws_codedeploy_deployment_group` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`alarmNames` \*

 | `array` **|** `null` |  |  |
| 

`applicationKey` \*

 | `string` |  |  |
| 

`applicationName` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`autoRollbackEvents` \*

 | `array` **|** `null` |  |  |
| 

`autoScalingGroups` \*

 | `array` **|** `null` |  |  |
| 

`blueGreenTerminateAction` \*

 | `string` **|** `null` |  |  |
| 

`blueGreenTerminationWaitTime` \*

 | `number` **|** `null` |  |  |
| 

`computePlatform` \*

 | `string` **|** `null` |  |  |
| 

`deploymentConfigName` \*

 | `string` **|** `null` |  |  |
| 

`deploymentGroupId` \*

 | `string` **|** `null` |  |  |
| 

`deploymentGroupName` \*

 | `string` |  |  |
| 

`deploymentOption` \*

 | `string` **|** `null` |  |  |
| 

`deploymentType` \*

 | `string` **|** `null` |  |  |
| 

`ecsClusterName` \*

 | `string` **|** `null` |  |  |
| 

`ecsServiceName` \*

 | `string` **|** `null` |  |  |
| 

`elbNames` \*

 | `array` **|** `null` |  |  |
| 

`greenFleetProvisioningAction` \*

 | `string` **|** `null` |  |  |
| 

`isAlarmsEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAutoRollbackEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isIgnorePollAlarmFailure` \*

 | `boolean` **|** `null` |  |  |
| 

`isTerminationHookEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`lastAttemptedDeploymentId` \*

 | `string` **|** `null` |  |  |
| 

`lastAttemptedDeploymentStatus` \*

 | `string` **|** `null` |  |  |
| 

`lastSuccessfulDeploymentId` \*

 | `string` **|** `null` |  |  |
| 

`lastSuccessfulDeploymentStatus` \*

 | `string` **|** `null` |  |  |
| 

`outdatedInstancesStrategy` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`targetGroupNames` \*

 | `array` **|** `null` |  |  |
| 

`triggerNames` \*

 | `array` **|** `null` |  |  |
| 

`triggerTargetArns` \*

 | `array` **|** `null` |  |  |

---

### Aws Codeguru Profiling Group

`aws_codeguru_profiling_group` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`computePlatform` \*

 | `string` **|** `null` |  |  |
| 

`isProfilingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`latestAgentPingOn` \*

 | `number` **|** `null` |  |  |
| 

`latestProfileReceivedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Codeguru Reviewer Repository Association

`aws_codeguru_reviewer_repository_association` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`associationId` \*

 | `string` **|** `null` |  |  |
| 

`connectionArn` \*

 | `string` **|** `null` |  |  |
| 

`encryptedKeyRef` \*

 | `string` **|** `null` |  |  |
| 

`encryptionOption` \*

 | `string` **|** `null` |  |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`providerType` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`s3BucketName` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`stateReason` \*

 | `string` **|** `null` |  |  |

---

### Aws Cognito Identity Pool

`aws_cognito_identity_pool` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`developerProviderName` \*

 | `null` **|** `string` |  |  |
| 

`identityPoolId` \*

 | `null` **|** `string` |  |  |
| 

`isClassicFlowAllowed` \*

 | `null` **|** `boolean` |  |  |
| 

`isUnauthenticatedIdentitiesAllowed` \*

 | `null` **|** `boolean` |  |  |
| 

`openIdConnectProviderArns` \*

 | `null` **|** `array` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`samlProviderArns` \*

 | `null` **|** `array` |  |  |

---

### Aws Cognito User Pool

`aws_cognito_user_pool` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountTakeoverHighActionEvent` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverHighActionNotify` \*

 | `null` **|** `boolean` |  |  |
| 

`accountTakeoverLowActionEvent` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverLowActionNotify` \*

 | `null` **|** `boolean` |  |  |
| 

`accountTakeoverMediumActionEvent` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverMediumActionNotify` \*

 | `null` **|** `boolean` |  |  |
| 

`accountTakeoverNotifyFrom` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverNotifyReplyTo` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverNotifySourceArn` \*

 | `null` **|** `string` |  |  |
| 

`adminCreateUserConfigAllowAdminCreateUserOnly` \*

 | `null` **|** `boolean` |  |  |
| 

`adminCreateUserConfigUnusedAccountValidityDays` \*

 | `null` **|** `number` |  |  |
| 

`arn` \*

 | `null` **|** `string` |  |  |
| 

`compromisedCredentialsEventAction` \*

 | `null` **|** `string` |  |  |
| 

`compromisedCredentialsEventFilter` \*

 | `null` **|** `array` |  |  |
| 

`customDomain` \*

 | `null` **|** `string` |  |  |
| 

`deletionProtection` \*

 | `null` **|** `string` |  |  |
| 

`deviceConfigurationChallengeRequiredOnNewDevice` \*

 | `null` **|** `boolean` |  |  |
| 

`deviceConfigurationDeviceOnlyRememberedOnUserPrompt` \*

 | `null` **|** `boolean` |  |  |
| 

`domain` \*

 | `null` **|** `string` |  |  |
| 

`emailConfigurationEmailSendingAccount` \*

 | `null` **|** `string` |  |  |
| 

`estimatedNumberOfUsers` \*

 | `null` **|** `number` |  |  |
| 

`mfaConfiguration` \*

 | `null` **|** `string` |  |  |
| 

`policiesPasswordPolicyMinimumLength` \*

 | `null` **|** `number` |  |  |
| 

`policiesPasswordPolicyRequireLowercase` \*

 | `null` **|** `boolean` |  |  |
| 

`policiesPasswordPolicyRequireNumbers` \*

 | `null` **|** `boolean` |  |  |
| 

`policiesPasswordPolicyRequireSymbols` \*

 | `null` **|** `boolean` |  |  |
| 

`policiesPasswordPolicyRequireUppercase` \*

 | `null` **|** `boolean` |  |  |
| 

`policiesPasswordPolicyTemporaryPasswordValidityDays` \*

 | `null` **|** `number` |  |  |
| 

`policiesSignInPolicyAllowedFirstAuthFactors` \*

 | `null` **|** `array` |  |  |
| 

`region` \*

 | `null` **|** `string` |  |  |
| 

`riskConfigurationLastModifiedOn` \*

 | `null` **|** `number` |  |  |
| 

`riskExceptionBlockedIPRangeList` \*

 | `null` **|** `array` |  |  |
| 

`riskExceptionSkippedIPRangeList` \*

 | `null` **|** `array` |  |  |
| 

`smsConfigurationExternalId` \*

 | `null` **|** `string` |  |  |
| 

`smsConfigurationFailure` \*

 | `null` **|** `string` |  |  |
| 

`smsConfigurationSnsCallerArn` \*

 | `null` **|** `string` |  |  |
| 

`smsConfigurationSnsRegion` \*

 | `null` **|** `string` |  |  |
| 

`userAttributeUpdateSettingsAttributesRequireVerificationBeforeUpdate` \*

 | `null` **|** `array` |  |  |
| 

`usernameConfigurationCaseSensitive` \*

 | `null` **|** `boolean` |  |  |
| 

`userPoolAddOnsAdvancedSecurityAdditionalFlowsTypeCustomAuthMode` \*

 | `null` **|** `string` |  |  |
| 

`userPoolAddOnsAdvancedSecurityMode` \*

 | `null` **|** `string` |  |  |
| 

`verificationMessageTemplateDefaultEmailOption` \*

 | `null` **|** `string` |  |  |

---

### Aws Cognito User Pool Client

`aws_cognito_user_pool_client` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessTokenValidity` | `number` |  |  |
| `accountId` | `string` |  |  |
| `allowedOAuthFlows` | `array` of `string`s |  |  |
| `allowedOAuthScopes` | `array` of `string`s |  |  |
| `analyticsConfigurationApplicationId` | `string` |  |  |
| `analyticsConfigurationExternalId` | `string` |  |  |
| `analyticsConfigurationRoleArn` | `string` |  |  |
| `authSessionValidity` | `number` |  |  |
| `callbackURLs` | `array` of `string`s |  |  |
| `clientSecret` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `defaultRedirectURI` | `string` |  |  |
| `explicitAuthFlows` | `array` of `string`s |  |  |
| 
`id` \*

 | `string` |  |  |
| `idTokenValidity` | `number` |  |  |
| `isAnalyticsConfigurationUserDataShared` | `boolean` |  |  |
| `isOAuthFlowsUserPoolClientAllowed` | `boolean` |  |  |
| `isPropagateAdditionalUserContextDataEnabled` | `boolean` |  |  |
| `isTokenRevocationEnabled` | `boolean` |  |  |
| `lastModifiedOn` | `number` |  |  |
| `logoutURLs` | `array` of `string`s |  |  |
| `preventUserExistenceErrors` | `string` |  |  |
| `readAttributes` | `array` of `string`s |  |  |
| `refreshTokenValidity` | `number` |  |  |
| 

`region` \*

 | `string` |  |  |
| `supportedIdentityProviders` | `array` of `string`s |  |  |
| `tokenValidityUnitsAccessToken` | `string` |  |  |
| `tokenValidityUnitsIdToken` | `string` |  |  |
| `tokenValidityUnitsRefreshToken` | `string` |  |  |
| `userPoolId` | `string` |  |  |
| `writeAttributes` | `array` of `string`s |  |  |

---

### Aws Cognito User Pool User

`aws_cognito_user_pool_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdOn` | `number` |  |  |
| `isEnabled` | `boolean` |  |  |
| `lastModifiedOn` | `number` |  |  |
| `mfaDeilveryMediums` | `array` of `string`s |  |  |
| `mfaDeliveryAttributes` | `array` of `string`s |  |  |
| 
`region` \*

 | `string` |  |  |
| `userStatus` | `string` |  |  |

---

### Aws Config Rule Finding

`aws_config_rule_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`annotation` \*

 | `string` **|** `null` |  |  |
| 

`configRuleArn` \*

 | `string` **|** `null` |  |  |
| 

`configRuleInvokedOn` \*

 | `number` **|** `null` |  |  |
| 

`configRuleName` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceArn` \*

 | `string` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceType` \*

 | `string` |  |  |
| 

`resultRecordedOn` \*

 | `number` **|** `null` |  |  |

---

### Aws Datasync Location

`aws_datasync_location` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`efsFileSystemArn` \*

 | `null` **|** `string` |  |  |
| 

`fsxFileSystemArn` \*

 | `null` **|** `string` |  |  |
| 

`isEfsLocation` \*

 | `null` **|** `boolean` |  |  |
| 

`isFsxLocation` \*

 | `null` **|** `boolean` |  |  |
| 

`isOnPremisesLocation` \*

 | `null` **|** `boolean` |  |  |
| 

`isS3Location` \*

 | `null` **|** `boolean` |  |  |
| 

`locationType` \*

 | `string` |  |  |
| 

`locationUri` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`s3BucketAccessRoleArn` \*

 | `null` **|** `string` |  |  |

---

### Aws Datasync Task

`aws_datasync_task` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`cloudWatchLogGroupArn` \*

 | `null` **|** `string` |  |  |
| 

`createdOn` \*

 | `number` |  |  |
| 

`currentTaskExecutionArn` \*

 | `null` **|** `string` |  |  |
| 

`destinationLocationArn` \*

 | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isCloudWatchLoggingEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`isScheduled` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`overwriteMode` \*

 | `null` **|** `string` |  |  |
| 

`posixPermissions` \*

 | `null` **|** `string` |  |  |
| 

`preserveDeletedFiles` \*

 | `null` **|** `string` |  |  |
| 

`preserveDevices` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`securityDescriptorCopyFlags` \*

 | `null` **|** `array` |  |  |
| 

`sourceLocationArn` \*

 | `string` |  |  |
| 

`transferMode` \*

 | `null` **|** `string` |  |  |
| 

`verifyMode` \*

 | `null` **|** `string` |  |  |
| 

`webLink` \*

 | `string` |  |  |

---

### Aws Dedicated Host

`aws_dedicated_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allocatedOn` | `number` |  |  |
| `allowsMultipleInstanceTypes` | `string` |  | **Any of**:
-   `off`

-   `on`

 |
| `assetId` | `string` |  |  |
| `autoPlacement` | `string` |  | **Any of**:

-   `off`

-   `on`

 |
| `availabilityZone` | `string` |  |  |
| `cores` | `number` |  |  |
| `hostId` | `string` |  |  |
| `hostMaintenance` | `string` |  | **Any of**:

-   `off`

-   `on`

 |
| `hostRecovery` | `string` |  | **Any of**:

-   `off`

-   `on`

 |
| `hostReservationId` | `string` |  |  |
| `instanceFamily` | `string` |  |  |
| `instanceType` | `string` |  |  |
| `memberOfServiceLinkedResourceGroup` | `boolean` |  |  |
| `outpostArn` | `string` |  |  |
| `ownerId` | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| `releasedOn` | `number` |  |  |
| `sockets` | `number` |  |  |
| `state` | `string` |  | **Any of**:

-   `available`

-   `pending`

-   `permanent-failure`

-   `released`

-   `released-permanent-failure`

-   `under-assessment`

 |
| `totalVCpus` | `number` |  |  |

---

### Aws Devops Guru Anomaly

`aws_devops_guru_anomaly` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`anomalyEndedOn` \*

 | `number` **|** `null` |  |  |
| 

`anomalyId` \*

 | `string` |  |  |
| 

`anomalyReportedEndedOn` \*

 | `number` **|** `null` |  |  |
| 

`anomalyReportedStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`anomalyStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`anomalyType` \*

 | `string` **|** `null` |  |  |
| 

`associatedInsightId` \*

 | `string` **|** `null` |  |  |
| 

`limitValue` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`sourceResourceName` \*

 | `string` **|** `null` |  |  |
| 

`sourceResourceType` \*

 | `string` **|** `null` |  |  |
| 

`sourceService` \*

 | `string` **|** `null` |  |  |
| 

`stackNames` \*

 | `array` **|** `null` |  |  |

---

### Aws Devops Guru Insight

`aws_devops_guru_insight` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`associatedResourceArns` \*

 | `array` **|** `null` |  |  |
| 

`insightEndedOn` \*

 | `number` **|** `null` |  |  |
| 

`insightId` \*

 | `string` |  |  |
| 

`insightStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`insightType` \*

 | `string` **|** `null` |  |  |
| 

`predictionEndedOn` \*

 | `number` **|** `null` |  |  |
| 

`predictionStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceNames` \*

 | `array` **|** `null` |  |  |
| 

`stackNames` \*

 | `array` **|** `null` |  |  |

---

### Aws Devops Guru Notification Channel

`aws_devops_guru_notification_channel` inherits from [Channel](/data-model/schemas/Channel.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`channelId` \*

 | `string` |  |  |
| 

`messageTypes` \*

 | `array` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`severities` \*

 | `array` **|** `null` |  |  |
| 

`snsTopicArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Elasticsearch Domain

`aws_elasticsearch_domain` inherits from [Database](/data-model/schemas/Database.md), [DataStore](/data-model/schemas/DataStore.md), [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessPolicies` \*

 | `string` **|** `null` | Raw JSON string of the IAM resource-based access policy attached to the Elasticsearch domain. |  |
| 

`atRestEncryptionEnabled` \*

 | `boolean` **|** `null` | Deprecated. Whether encryption at rest is enabled. Use encryptedAtRest instead. | **deprecated**: true |
| 

`encryptionAtRestKmsKeyId` \*

 | `string` **|** `null` | Identifier of the AWS KMS key used to encrypt data at rest in the Elasticsearch domain. May be a key ID, alias, or ARN depending on how the domain was configured. |  |
| 

`isAppLoggingEnabled` \*

 | `boolean` **|** `null` | Whether application log (ES\_APPLICATION\_LOGS) publishing to CloudWatch Logs is enabled. |  |
| 

`isAuditLoggingEnabled` \*

 | `boolean` **|** `null` | Whether audit log (AUDIT\_LOGS) publishing to CloudWatch Logs is enabled for this domain. |  |
| 

`isSlowIndexLoggingEnabled` \*

 | `boolean` **|** `null` | Whether slow index log (INDEX\_SLOW\_LOGS) publishing to CloudWatch Logs is enabled. |  |
| 

`region` \*

 | `string` | The AWS region the Elasticsearch domain resides in. |  |
| 

`transitEncryptionEnabled` \*

 | `boolean` **|** `null` | Deprecated. Whether node-to-node (in-transit) encryption is enabled. Use encryptedInTransit instead. | **deprecated**: true |

---

### Aws Emr Security Configuration

`aws_emr_security_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | Synthesized ARN of the EMR security configuration (also the entity \_key). |  |
| 

`isAtRestEncryptionEnabled` \*

 | `boolean` | Whether at-rest encryption is enabled. |  |
| 

`isEncryptionConfigured` \*

 | `boolean` | Whether an encryption configuration block is present. |  |
| 

`isInTransitEncryptionEnabled` \*

 | `boolean` | Whether in-transit encryption is enabled. |  |
| 

`isKerberosConfigured` \*

 | `boolean` | Whether Kerberos authentication is configured. |  |
| 

`isKerberosCrossRealmTrustConfigured` \*

 | `boolean` | Whether a cross-realm trust is configured (presence only). |  |
| 

`isLocalDiskEbsEncryptionEnabled` \*

 | `boolean` | Whether EBS encryption is enabled for local disks. |  |
| 

`isLocalDiskEncryptionConfigured` \*

 | `boolean` | Whether a local-disk encryption block is present. |  |
| 

`isSecureNamespaceConfigured` \*

 | `boolean` | Whether Lake Formation secure-namespace info is present. |  |
| 

`isTlsCertificateConfigured` \*

 | `boolean` | Whether an in-transit TLS certificate configuration is present. |  |
| 

`kerberosADDomainJoinUser` \*

 | `string` **|** `null` | Active Directory domain-join user for Kerberos. |  |
| 

`kerberosProvider` \*

 | `string` **|** `null` | Kerberos provider (ClusterDedicatedKdc, ExternalKdc). |  |
| 

`kerberosRealm` \*

 | `string` **|** `null` | Kerberos realm. |  |
| 

`lakeFormationQueryEngineRoleArn` \*

 | `string` **|** `null` | IAM role ARN used by the Lake Formation query engine. |  |
| 

`localDiskEncryptionAwsKmsKeyArn` \*

 | `string` **|** `null` | KMS key ARN used for local-disk encryption, if any. |  |
| 

`localDiskEncryptionKeyProviderType` \*

 | `string` **|** `null` | Local-disk encryption key provider type. |  |
| 

`region` \*

 | `string` | AWS region the security configuration was ingested from. |  |
| 

`s3EncryptionAwsKmsKeyArn` \*

 | `string` **|** `null` | KMS key ARN used for S3 encryption, if any. |  |
| 

`s3EncryptionKeyProviderType` \*

 | `string` **|** `null` | S3 encryption key provider type (AWS\_KMS, SERVICE\_DEFAULT). |  |
| 

`s3EncryptionMode` \*

 | `string` **|** `null` | S3 encryption mode (SSE-S3, SSE-KMS, CSE-KMS, CSE-Custom). |  |
| 

`secureNamespaceClusterId` \*

 | `string` **|** `null` | ID of the EKS cluster backing the Lake Formation secure namespace (EMR on EKS). |  |
| 

`secureNamespaceName` \*

 | `string` **|** `null` | Lake Formation secure namespace name. |  |
| 

`tlsCertificateProviderType` \*

 | `string` **|** `null` | TLS certificate provider type (PEM, Custom). |  |
| 

`tlsPrivateCertificateSecretArn` \*

 | `string` **|** `null` | Secrets Manager ARN of the private TLS certificate. |  |
| 

`tlsPublicCertificateSecretArn` \*

 | `string` **|** `null` | Secrets Manager ARN of the public TLS certificate. |  |

---

### Aws Emr Serverless Application

`aws_emr_serverless_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationId` \*

 | `string` |  |  |
| 

`applicationType` \*

 | `string` |  |  |
| 

`architecture` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`autoStopIdleTimeoutMinutes` \*

 | `number` **|** `null` |  |  |
| 

`cloudWatchLoggingEncryptionKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`cloudWatchLogGroupName` \*

 | `string` **|** `null` |  |  |
| 

`encryptedKeyRef` \*

 | `string` **|** `null` |  |  |
| 

`isAutoStartEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAutoStopEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCloudWatchLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` |  |  |
| 

`isLivyEndpointEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isManagedPersistenceEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isStudioEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`managedPersistenceEncryptionKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`maximumCapacityCpu` \*

 | `string` **|** `null` |  |  |
| 

`maximumCapacityDisk` \*

 | `string` **|** `null` |  |  |
| 

`maximumCapacityMemory` \*

 | `string` **|** `null` |  |  |
| 

`networkSecurityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`networkSubnetIds` \*

 | `array` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`releaseLabel` \*

 | `string` |  |  |
| 

`s3MonitoringEncryptionKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`s3MonitoringLogUri` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` |  |  |
| 

`stateDetails` \*

 | `string` **|** `null` |  |  |

---

### Aws Fsx File System

`aws_fsx_file_system` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `null` **|** `string` |  |  |
| 

`createdOn` \*

 | `null` **|** `number` |  |  |
| 

`dnsName` \*

 | `null` **|** `string` |  |  |
| 

`fileSystemType` \*

 | `null` **|** `string` |  |  |
| 

`fileSystemTypeVersion` \*

 | `null` **|** `string` |  |  |
| 

`id` \*

 | `null` **|** `string` |  |  |
| 

`kmsKeyId` \*

 | `null` **|** `string` |  |  |
| 

`lifecycle` \*

 | `null` **|** `string` |  |  |
| 

`lustreAutomaticBackupRetentionDays` \*

 | `null` **|** `number` |  |  |
| 

`lustreDailyAutomaticBackupStartTime` \*

 | `null` **|** `string` |  |  |
| 

`lustreDataCompressionType` \*

 | `null` **|** `string` |  |  |
| 

`lustreDeploymentType` \*

 | `null` **|** `string` |  |  |
| 

`lustreDriveCacheType` \*

 | `null` **|** `string` |  |  |
| 

`lustreIsCopyingTagsToBackups` \*

 | `null` **|** `boolean` |  |  |
| 

`lustreIsEfaEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`lustreMountName` \*

 | `null` **|** `string` |  |  |
| 

`lustrePerUnitStorageThroughput` \*

 | `null` **|** `number` |  |  |
| 

`lustreWeeklyMaintenanceStartTime` \*

 | `null` **|** `string` |  |  |
| 

`networkInterfaceIds` \*

 | `null` **|** `array` |  |  |
| 

`ontapAutomaticBackupRetentionDays` \*

 | `null` **|** `number` |  |  |
| 

`ontapDailyAutomaticBackupStartTime` \*

 | `null` **|** `string` |  |  |
| 

`ontapDeploymentType` \*

 | `null` **|** `string` |  |  |
| 

`ontapEndpointIpAddressRange` \*

 | `null` **|** `string` |  |  |
| 

`ontapHAPairs` \*

 | `null` **|** `number` |  |  |
| 

`ontapPreferredSubnetId` \*

 | `null` **|** `string` |  |  |
| 

`ontapRouteTableIds` \*

 | `null` **|** `array` |  |  |
| 

`ontapThroughputCapacity` \*

 | `null` **|** `number` |  |  |
| 

`ontapThroughputCapacityPerHAPair` \*

 | `null` **|** `number` |  |  |
| 

`ontapWeeklyMaintenanceStartTime` \*

 | `null` **|** `string` |  |  |
| 

`openzfsAutomaticBackupRetentionDays` \*

 | `null` **|** `number` |  |  |
| 

`openzfsDailyAutomaticBackupStartTime` \*

 | `null` **|** `string` |  |  |
| 

`openzfsDeploymentType` \*

 | `null` **|** `string` |  |  |
| 

`openzfsEndpointIpAddress` \*

 | `null` **|** `string` |  |  |
| 

`openzfsEndpointIpAddressRange` \*

 | `null` **|** `string` |  |  |
| 

`openzfsIsCopyingTagsToBackups` \*

 | `null` **|** `boolean` |  |  |
| 

`openzfsIsCopyingTagsToVolumes` \*

 | `null` **|** `boolean` |  |  |
| 

`openzfsPreferredSubnetId` \*

 | `null` **|** `string` |  |  |
| 

`openzfsRootVolumeId` \*

 | `null` **|** `string` |  |  |
| 

`openzfsRouteTableIds` \*

 | `null` **|** `array` |  |  |
| 

`openzfsThroughputCapacity` \*

 | `null` **|** `number` |  |  |
| 

`openzfsWeeklyMaintenanceStartTime` \*

 | `null` **|** `string` |  |  |
| 

`ownerId` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `null` **|** `string` |  |  |
| 

`storageCapacity` \*

 | `null` **|** `number` |  |  |
| 

`storageType` \*

 | `null` **|** `string` |  |  |
| 

`subnetIds` \*

 | `null` **|** `array` |  |  |
| 

`vpcId` \*

 | `null` **|** `string` |  |  |
| 

`windowsActiveDirectoryId` \*

 | `null` **|** `string` |  |  |
| 

`windowsAutomaticBackupRetentionDays` \*

 | `null` **|** `number` |  |  |
| 

`windowsDailyAutomaticBackupStartTime` \*

 | `null` **|** `string` |  |  |
| 

`windowsDeploymentType` \*

 | `null` **|** `string` |  |  |
| 

`windowsIsCopyingTagsToBackups` \*

 | `null` **|** `boolean` |  |  |
| 

`windowsPreferredFileServerIp` \*

 | `null` **|** `string` |  |  |
| 

`windowsPreferredSubnetId` \*

 | `null` **|** `string` |  |  |
| 

`windowsRemoteAdministrationEndpoint` \*

 | `null` **|** `string` |  |  |
| 

`windowsThroughputCapacity` \*

 | `null` **|** `number` |  |  |
| 

`windowsWeeklyMaintenanceStartTime` \*

 | `null` **|** `string` |  |  |

---

### Aws Grafana Workspace

`aws_grafana_workspace` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountAccessType` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`authenticationProviders` \*

 | `array` **|** `null` |  |  |
| 

`dataSources` \*

 | `array` **|** `null` |  |  |
| 

`endpoint` \*

 | `string` **|** `null` |  |  |
| 

`freeTrialExpirationOn` \*

 | `number` **|** `null` |  |  |
| 

`grafanaToken` \*

 | `string` **|** `null` |  |  |
| 

`grafanaVersion` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isEncrypted` \*

 | `boolean` |  |  |
| 

`isFreeTrialConsumed` \*

 | `boolean` **|** `null` |  |  |
| 

`isNetworkAccessRestricted` \*

 | `boolean` **|** `null` |  |  |
| 

`licenseExpirationOn` \*

 | `number` **|** `null` |  |  |
| 

`licenseType` \*

 | `string` **|** `null` |  |  |
| 

`modifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`networkAccessPrefixListIds` \*

 | `array` **|** `null` |  |  |
| 

`networkAccessVpceIds` \*

 | `array` **|** `null` |  |  |
| 

`notificationDestinations` \*

 | `array` **|** `null` |  |  |
| 

`organizationalUnits` \*

 | `array` **|** `null` |  |  |
| 

`organizationRoleName` \*

 | `string` **|** `null` |  |  |
| 

`permissionType` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`samlConfigurationStatus` \*

 | `string` **|** `null` |  |  |
| 

`stackSetName` \*

 | `string` **|** `null` |  |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`vpcSubnetIds` \*

 | `array` **|** `null` |  |  |
| 

`webLink` \*

 | `string` |  |  |
| 

`workspaceId` \*

 | `string` **|** `null` |  |  |
| 

`workspaceRoleArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Guardduty Publishing Destination

`aws_guardduty_publishing_destination` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`destinationArn` \*

 | `string` **|** `null` | ARN of the S3 bucket/folder receiving exported findings. |  |
| 

`destinationId` \*

 | `string` | Identifier of the export destination. |  |
| 

`destinationType` \*

 | `string` **|** `null` | Export target type (currently only S3). |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether exported findings are encrypted with a KMS key (KmsKeyArn present). |  |
| 

`isPublishing` \*

 | `boolean` **|** `null` | Whether the export is actively publishing (Status === PUBLISHING). |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key encrypting exported findings (kept as a flat property in addition to the USES relationship, an intentional ADR-005 exception mirroring inspectorv2 kmsKeyId). |  |
| 

`publishingFailureStartedOn` \*

 | `number` **|** `null` | Epoch ms at which GuardDuty first failed to publish to this destination; non-null indicates an active export failure. |  |
| 

`region` \*

 | `string` | AWS region of the publishing destination. |  |

---

### Aws Iam Roles Anywhere Profile

`aws_iam_roles_anywhere_profile` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`durationSeconds` \*

 | `number` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isInstancePropertiesRequired` \*

 | `boolean` **|** `null` |  |  |
| 

`isRoleSessionNameAccepted` \*

 | `boolean` **|** `null` |  |  |
| 

`managedPolicyArns` \*

 | `array` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArns` \*

 | `array` **|** `null` |  |  |
| 

`sessionPolicy` \*

 | `string` **|** `null` |  |  |
| 

`updatedOn` \*

 | `number` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Iam Roles Anywhere Trust Anchor

`aws_iam_roles_anywhere_trust_anchor` inherits from [Certificate](/data-model/schemas/Certificate.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`areNotificationsEnabled` \*

 | `boolean` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`notificationChannels` \*

 | `array` **|** `null` |  |  |
| 

`notificationEvents` \*

 | `array` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`sourceAcmPcaArn` \*

 | `string` **|** `null` |  |  |
| 

`sourceType` \*

 | `string` **|** `null` |  |  |
| 

`updatedOn` \*

 | `number` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Imagebuilder Component

`aws_imagebuilder_component` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the component. |  |
| 

`arn` \*

 | `string` | The ARN of the Image Builder component. |  |
| 

`changeDescription` \*

 | `string` **|** `null` | The change description of the component for this version. |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the component document is encrypted at rest using a customer-managed KMS key. |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | The KMS key ID used to encrypt the component. |  |
| 

`platform` \*

 | `string` **|** `null` | The platform the component supports (Windows or Linux). |  |
| 

`region` \*

 | `string` | AWS region where the component is defined. |  |
| 

`supportedOsVersions` \*

 | `array` **|** `null` | The operating system versions the component supports. |  |
| 

`type` \*

 | `string` **|** `null` | The type of the component (BUILD or TEST). |  |
| 

`version` \*

 | `string` **|** `null` | The version of the component. |  |

---

### Aws Imagebuilder Container Recipe

`aws_imagebuilder_container_recipe` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the recipe. |  |
| 

`arn` \*

 | `string` | The ARN of the container recipe. |  |
| 

`componentArns` \*

 | `array` **|** `null` | ARNs of the components included in the recipe. |  |
| 

`componentCount` \*

 | `number` **|** `null` | The number of components in the recipe. |  |
| 

`containerType` \*

 | `string` **|** `null` | The type of container produced by the recipe (DOCKER). |  |
| 

`isDockerfileTemplatePresent` \*

 | `boolean` **|** `null` | Whether a Dockerfile template is present in the recipe. |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | KMS key ID used to encrypt the container recipe. |  |
| 

`parentImage` \*

 | `string` **|** `null` | The base image used for the container recipe. |  |
| 

`platform` \*

 | `string` **|** `null` | The platform for the container recipe (Linux or Windows). |  |
| 

`region` \*

 | `string` | AWS region where the recipe is defined. |  |
| 

`targetRepositoryName` \*

 | `string` **|** `null` | The name of the target repository for the container image. |  |
| 

`targetRepositoryService` \*

 | `string` **|** `null` | The service for the target repository (ECR or other). |  |
| 

`version` \*

 | `string` **|** `null` | The version of the container recipe. |  |
| 

`workingDirectory` \*

 | `string` **|** `null` | The working directory used during container image builds. |  |

---

### Aws Imagebuilder Distribution Configuration

`aws_imagebuilder_distribution_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the configuration. |  |
| 

`amiDistributionKmsKeyIds` \*

 | `array` **|** `null` | KMS key IDs used to encrypt distributed AMIs, aggregated across all distributions. |  |
| 

`amiDistributionLaunchPermissionGroupNames` \*

 | `array` **|** `null` | Group names granted launch permission on distributed AMIs. |  |
| 

`amiDistributionLaunchPermissionOrganizationArns` \*

 | `array` **|** `null` | Organization ARNs granted launch permission on distributed AMIs. |  |
| 

`amiDistributionLaunchPermissionUserIds` \*

 | `array` **|** `null` | User IDs granted launch permission on distributed AMIs. |  |
| 

`amiDistributionTargetAccountIds` \*

 | `array` **|** `null` | Target AWS account IDs for AMI distribution. |  |
| 

`arn` \*

 | `string` | The ARN of the distribution configuration. |  |
| 

`containerDistributionTargetAccountIds` \*

 | `array` **|** `null` | Target account IDs for container image distribution. Always null — the SDK does not expose container cross-account sharing (governed by ECR repository policy). |  |
| 

`containerDistributionTargetRepositoryNames` \*

 | `array` **|** `null` | Target repository names for container image distribution, aggregated across all distributions. |  |
| 

`distributionRegions` \*

 | `array` **|** `null` | The AWS regions where images are distributed. |  |
| 

`isSharedCrossAccount` \*

 | `boolean` | Whether any distributed AMI is shared with specific AWS accounts, users, or organizations (distinct from public exposure). |  |
| 

`public` \*

 | `boolean` | Whether any distributed AMI is shared publicly (launchPermission grants the reserved `all` group). |  |
| 

`region` \*

 | `string` | AWS region where the configuration is defined. |  |

---

### Aws Imagebuilder Image

`aws_imagebuilder_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the image. |  |
| 

`arn` \*

 | `string` | The ARN of the Image Builder image build version. |  |
| 

`containerRecipeArn` \*

 | `string` **|** `null` | ARN of the container recipe used to build this image. |  |
| 

`distributionConfigurationArn` \*

 | `string` **|** `null` | ARN of the distribution configuration used for this image. |  |
| 

`ebsKmsKeyIds` \*

 | `array` **|** `null` | KMS key IDs used for EBS block device encryption, collected across every mapped device in the image recipe or container recipe instance configuration. Values may be a key ARN or an alias. Null when no mapped device names a key. |  |
| 

`imageRecipeArn` \*

 | `string` **|** `null` | ARN of the image recipe used to build this image. |  |
| 

`infrastructureConfigurationArn` \*

 | `string` **|** `null` | ARN of the infrastructure configuration used to build this image. |  |
| 

`isEbsEncrypted` \*

 | `boolean` **|** `null` | True when every EBS block device mapped by the build instance declares encryption. Collected from the image recipe (AMI images) or the container recipe instance configuration (container images). Null when the image maps no EBS devices. |  |
| 

`isImageScanningEnabled` \*

 | `boolean` **|** `null` | Whether image scanning was enabled for this build. |  |
| 

`isImageTestsEnabled` \*

 | `boolean` **|** `null` | Whether image tests were enabled for this build. |  |
| 

`osVersion` \*

 | `string` **|** `null` | The OS version of the image. |  |
| 

`outputResourcesAmiIds` \*

 | `array` **|** `null` | AMI IDs produced as output resources. |  |
| 

`outputResourcesContainerImages` \*

 | `array` **|** `null` | Container image URIs produced as output resources. |  |
| 

`platform` \*

 | `string` **|** `null` | The platform of the image (Windows or Linux). |  |
| 

`region` \*

 | `string` | AWS region where the image was built. |  |
| 

`sourcePipelineArn` \*

 | `string` **|** `null` | ARN of the pipeline that created this image, if pipeline-created. |  |
| 

`state` \*

 | `string` **|** `null` | The current build state of the image (from state.status). |  |
| 

`stateReason` \*

 | `string` **|** `null` | The reason for the current state. |  |
| 

`type` \*

 | `string` **|** `null` | The type of image output (AMI or DOCKER). |  |
| 

`version` \*

 | `string` **|** `null` | The semantic version of the image. |  |

---

### Aws Imagebuilder Image Pipeline

`aws_imagebuilder_image_pipeline` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the pipeline. |  |
| 

`arn` \*

 | `string` | The ARN of the image pipeline. |  |
| 

`containerRecipeArn` \*

 | `string` **|** `null` | ARN of the container recipe used by this pipeline (container pipelines). |  |
| 

`distributionConfigurationArn` \*

 | `string` **|** `null` | ARN of the distribution configuration used by this pipeline. |  |
| 

`executionRoleArn` \*

 | `string` **|** `null` | ARN of the IAM role used to execute the pipeline. |  |
| 

`imageRecipeArn` \*

 | `string` **|** `null` | ARN of the image recipe used by this pipeline (AMI pipelines). |  |
| 

`imageTestsConfigurationTimeoutMinutes` \*

 | `number` **|** `null` | The timeout in minutes for image tests. |  |
| 

`infrastructureConfigurationArn` \*

 | `string` **|** `null` | ARN of the infrastructure configuration used by this pipeline. |  |
| 

`isEnhancedImageMetadataEnabled` \*

 | `boolean` **|** `null` | Whether enhanced image metadata is enabled for the pipeline. |  |
| 

`isImageScanningConfigurationEnabled` \*

 | `boolean` **|** `null` | Whether image scanning is enabled for this pipeline. |  |
| 

`isImageTestsConfigurationEnabled` \*

 | `boolean` **|** `null` | Whether image tests are enabled for this pipeline. |  |
| 

`lastRunOn` \*

 | `number` **|** `null` | Timestamp of the last pipeline execution. |  |
| 

`nextRunOn` \*

 | `number` **|** `null` | Timestamp of the next scheduled pipeline execution. |  |
| 

`platform` \*

 | `string` **|** `null` | The platform of the pipeline (Windows or Linux). |  |
| 

`region` \*

 | `string` | AWS region where the pipeline is defined. |  |
| 

`scheduleExpression` \*

 | `string` **|** `null` | The cron expression for the pipeline schedule. |  |
| 

`schedulePipelineExecutionStartCondition` \*

 | `string` **|** `null` | The condition under which the scheduled pipeline runs. |  |
| 

`scheduleTimezone` \*

 | `string` **|** `null` | The timezone for the schedule. |  |

---

### Aws Imagebuilder Infrastructure Configuration

`aws_imagebuilder_infrastructure_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the configuration. |  |
| 

`arn` \*

 | `string` | The ARN of the infrastructure configuration. |  |
| 

`iamInstanceProfileName` \*

 | `string` **|** `null` | The IAM instance profile name attached to the build instance. |  |
| 

`instanceMetadataHttpPutResponseHopLimit` \*

 | `number` **|** `null` | The HTTP PUT response hop limit for IMDSv2. |  |
| 

`instanceMetadataHttpTokens` \*

 | `string` **|** `null` | IMDSv2 token requirement setting (required or optional). |  |
| 

`instanceTypes` \*

 | `array` **|** `null` | The instance types used for the build EC2 instance. |  |
| 

`isTerminateInstanceOnFailure` \*

 | `boolean` **|** `null` | Whether to terminate the build instance on failure. |  |
| 

`keyPair` \*

 | `string` **|** `null` | The EC2 key pair name used for the build instance. |  |
| 

`region` \*

 | `string` | AWS region where the configuration is defined. |  |
| 

`s3LogsBucketName` \*

 | `string` **|** `null` | S3 bucket name for storing build logs. |  |
| 

`s3LogsKeyPrefix` \*

 | `string` **|** `null` | S3 key prefix for build log files. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Security group IDs attached to the build EC2 instance. |  |
| 

`snsTopicArn` \*

 | `string` **|** `null` | ARN of the SNS topic for build notifications. |  |
| 

`subnetId` \*

 | `string` **|** `null` | The subnet ID where the build instance runs. |  |

---

### Aws Imagebuilder Lifecycle Policy

`aws_imagebuilder_lifecycle_policy` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the policy. |  |
| 

`arn` \*

 | `string` | The ARN of the lifecycle policy. |  |
| 

`executionRoleArn` \*

 | `string` **|** `null` | ARN of the IAM role used to execute lifecycle actions. |  |
| 

`lastRunOn` \*

 | `number` **|** `null` | Timestamp of the last policy execution. |  |
| 

`policyDetailActionType` \*

 | `string` **|** `null` | The action type from the first policy detail (DELETE, DEPRECATE, or DISABLE). |  |
| 

`policyDetailFilterType` \*

 | `string` **|** `null` | The filter type from the first policy detail (AGE or COUNT). |  |
| 

`policyDetailFilterUnit` \*

 | `string` **|** `null` | The filter unit from the first policy detail (DAYS, WEEKS, MONTHS, or YEARS). |  |
| 

`policyDetailFilterValue` \*

 | `number` **|** `null` | The filter threshold value from the first policy detail. |  |
| 

`policyDetailRetentionAtLeastCount` \*

 | `number` **|** `null` | The minimum number of images to retain per the first policy detail. |  |
| 

`region` \*

 | `string` | AWS region where the policy is defined. |  |
| 

`resourceType` \*

 | `string` **|** `null` | The type of resource the policy applies to (AMI\_IMAGE or CONTAINER\_IMAGE). |  |

---

### Aws Imagebuilder Workflow

`aws_imagebuilder_workflow` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the workflow. |  |
| 

`arn` \*

 | `string` | The ARN of the Image Builder workflow. |  |
| 

`changeDescription` \*

 | `string` **|** `null` | The change description for this workflow version. |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | KMS key ID used to encrypt the workflow. |  |
| 

`region` \*

 | `string` | AWS region where the workflow is defined. |  |
| 

`type` \*

 | `string` **|** `null` | The type of the workflow (BUILD, TEST, or DISTRIBUTION). |  |
| 

`version` \*

 | `string` **|** `null` | The version of the workflow. |  |
| 

`workflowState` \*

 | `string` **|** `null` | The current state status of the workflow (from state.status). |  |

---

### Aws Inspector Finding

`aws_inspector_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `id` | `string` |  |  |

---

### Aws Inspector Finding

`aws_inspector_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `id` | `string` |  |  |

---

### Aws Inspectorv2 Configuration

`aws_inspectorv2_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`ec2ScanMode` \*

 | `string` **|** `null` | EC2 automated scan mode (EC2\_HYBRID or EC2\_SSM\_AGENT\_BASED). |  |
| 

`ec2ScanModeStatus` \*

 | `string` **|** `null` | Status of the EC2 scan mode setting (PENDING/SUCCESS). |  |
| 

`ecrPullDateRescanDuration` \*

 | `string` **|** `null` | ECR re-scan duration measured from image pull date (e.g. DAYS\_30). |  |
| 

`ecrPullDateRescanMode` \*

 | `string` **|** `null` | ECR pull-date re-scan mode. |  |
| 

`ecrRescanDuration` \*

 | `string` **|** `null` | ECR automated re-scan duration (e.g. DAYS\_30, LIFETIME). |  |
| 

`ecrRescanDurationStatus` \*

 | `string` **|** `null` | Status of changes to the ECR re-scan duration (FAILED/PENDING/SUCCESS). |  |
| 

`ecrRescanDurationUpdatedOn` \*

 | `number` **|** `null` | When the ECR re-scan duration setting was last changed (epoch ms). |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt Inspector Lambda code scan data in this region (the only scan type that supports a customer-managed key; absent when using an AWS-owned key). |  |
| 

`region` \*

 | `string` | The AWS region this configuration applies to. |  |

---

### Aws Inspectorv2 Filter

`aws_inspectorv2_filter` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `string` **|** `null` | The action applied to findings that match the filter (NONE or SUPPRESS). |  |
| 

`arn` \*

 | `string` | The Amazon Resource Number (ARN) associated with this filter. |  |
| 

`criteriaFields` \*

 | `array` **|** `null` | The names of the FilterCriteria fields that are populated on this filter (e.g. "severity", "resourceType"). Only the field names are captured, not their matched values, so this indicates which dimensions the filter constrains but not the specific values it matches or suppresses. |  |
| 

`ownerId` \*

 | `string` **|** `null` | The AWS account ID of the account that created the filter. |  |
| 

`reason` \*

 | `string` **|** `null` | The reason for the filter. |  |
| 

`region` \*

 | `string` **|** `null` | The AWS region the filter was read from. |  |

---

### Aws Inspectorv2 Finding

`aws_inspectorv2_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `id` | `string` |  |  |

---

### Aws Inspectorv2 Finding

`aws_inspectorv2_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `id` | `string` |  |  |

---

### Aws License Manager License

`aws_license_manager_license` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`beneficiary` \*

 | `string` **|** `null` |  |  |
| 

`expiresOn` \*

 | `number` **|** `null` |  |  |
| 

`homeRegion` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`issuerKeyFingerprint` \*

 | `string` **|** `null` |  |  |
| 

`issuerName` \*

 | `string` **|** `null` |  |  |
| 

`productName` \*

 | `string` **|** `null` |  |  |
| 

`productSku` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`validityStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`version` \*

 | `string` **|** `null` |  |  |

---

### Aws License Manager Received License

`aws_license_manager_received_license` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`allowedOperations` \*

 | `array` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`beneficiary` \*

 | `string` **|** `null` |  |  |
| 

`borrowMaxTimeToLiveInMinutes` \*

 | `number` **|** `null` |  |  |
| 

`consumptionRenewType` \*

 | `string` **|** `null` |  |  |
| 

`expiresOn` \*

 | `number` **|** `null` |  |  |
| 

`homeRegion` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isBorrowAllowEarlyCheckIn` \*

 | `boolean` **|** `null` |  |  |
| 

`issuerKeyFingerprint` \*

 | `string` **|** `null` |  |  |
| 

`issuerName` \*

 | `string` **|** `null` |  |  |
| 

`issuerSignKey` \*

 | `string` **|** `null` |  |  |
| 

`productName` \*

 | `string` **|** `null` |  |  |
| 

`productSku` \*

 | `string` **|** `null` |  |  |
| 

`provisionalMaxTimeToLiveInMinutes` \*

 | `number` **|** `null` |  |  |
| 

`receivedStatus` \*

 | `string` **|** `null` |  |  |
| 

`receivedStatusReason` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`validityStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`version` \*

 | `string` **|** `null` |  |  |

---

### Aws Marketplace Entitlement

`aws_marketplace_entitlement` inherits from [Subscription](/data-model/schemas/Subscription.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`customerIdentifier` \*

 | `string` **|** `null` | Entitlement.CustomerIdentifier — opaque buyer handle from ResolveCustomer. |  |
| 

`dimension` \*

 | `string` **|** `null` | Entitlement.Dimension — the capacity dimension this entitlement covers (e.g. Users, DataGB). |  |
| 

`productCode` \*

 | `string` | Marketplace ProductCode used to query GetEntitlements. Equals AWS License Manager GrantedLicense.ProductSKU. |  |
| 

`region` \*

 | `string` | AWS region (always us-east-1 for the AWS Marketplace Entitlement Service). |  |
| 

`valueBoolean` \*

 | `boolean` **|** `null` | Entitlement.Value.BooleanValue when present. |  |
| 

`valueDouble` \*

 | `number` **|** `null` | Entitlement.Value.DoubleValue when present. |  |
| 

`valueInteger` \*

 | `number` **|** `null` | Entitlement.Value.IntegerValue when present. |  |
| 

`valueString` \*

 | `string` **|** `null` | Entitlement.Value.StringValue when present. |  |

---

### Aws Marketplace Entity

`aws_marketplace_entity` inherits from [Product](/data-model/schemas/Product.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | EntityArn from ListEntities, e.g. arn:aws:aws-marketplace:::AmiProduct/prod-xxxx. |  |
| 

`entityId` \*

 | `string` | Opaque catalog entity ID, e.g. prod-xxxx. |  |
| 

`entityType` \*

 | `string` | Marketplace entity discriminator: AmiProduct, ContainerProduct, SaaSProduct, DataProduct, Offer, or ResaleAuthorization. |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` | EntitySummary.LastModifiedDate parsed via parseTimePropertyValue (milliseconds since epoch). |  |
| 

`offerAvailableUntilOn` \*

 | `number` **|** `null` | OfferSummary.AvailabilityEndDate parsed via parseTimePropertyValue. |  |
| 

`offerBuyerAccountIds` \*

 | `array` **|** `null` | OfferSummary.BuyerAccounts — AWS account IDs targeted by a private offer. |  |
| 

`offerOfferSetId` \*

 | `string` **|** `null` | OfferSummary.OfferSetId. |  |
| 

`offerProductId` \*

 | `string` **|** `null` | OfferSummary.ProductId — references another aws\_marketplace\_entity EntityId. |  |
| 

`offerReleasedOn` \*

 | `number` **|** `null` | OfferSummary.ReleaseDate parsed via parseTimePropertyValue. |  |
| 

`offerResaleAuthorizationId` \*

 | `string` **|** `null` | OfferSummary.ResaleAuthorizationId — references a ResaleAuthorization entity EntityId. |  |
| 

`offerState` \*

 | `string` **|** `null` | OfferSummary.State. |  |
| 

`offerTargeting` \*

 | `array` **|** `null` | OfferSummary.Targeting — string targeting tokens (e.g. None, BuyerAccounts, CountryCodes). |  |
| 

`ownershipType` \*

 | `string` | Ownership filter under which the entity was discovered: SELF (owned by calling account) or SHARED (visible via private offer/RAM share). |  |
| 

`productTitle` \*

 | `string` **|** `null` | Product title from {AmiProduct|ContainerProduct|SaaSProduct|DataProduct}Summary.ProductTitle. |  |
| 

`productVisibility` \*

 | `string` **|** `null` | Per-product visibility from the type-specific product sub-summary. |  |
| 

`region` \*

 | `string` | AWS region (always us-east-1 for the AWS Marketplace Catalog Service). |  |
| 

`resaleAvailableUntilOn` \*

 | `number` **|** `null` | ResaleAuthorizationSummary.AvailabilityEndDate parsed via parseTimePropertyValue. |  |
| 

`resaleManufacturerAccountId` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ManufacturerAccountId — counterparty AWS account. |  |
| 

`resaleManufacturerLegalName` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ManufacturerLegalName. |  |
| 

`resaleOfferExtendedStatus` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.OfferExtendedStatus. |  |
| 

`resaleProductId` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ProductId. |  |
| 

`resaleProductName` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ProductName. |  |
| 

`resaleResellerAccountId` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ResellerAccountID — counterparty AWS account. |  |
| 

`resaleResellerLegalName` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ResellerLegalName. |  |
| 

`resaleStatus` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.Status. |  |
| 

`visibility` \*

 | `string` **|** `null` | Top-level entity visibility from ListEntities (e.g. Public, Limited, Restricted). |  |

---

### Aws Networkmanager Attachment

`aws_networkmanager_attachment` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The synthesized attachment ARN (arn:aws:networkmanager::{ownerAccountId}:attachment/{attachmentId}); entity \_key. |  |
| 

`attachmentId` \*

 | `string` | The CloudWAN attachment ID (attachment-…). |  |
| 

`attachmentPolicyRuleNumber` \*

 | `number` **|** `null` | Rule number from the attachment-policies\[\] that bound this attachment to its segment. |  |
| 

`attachmentType` \*

 | `string` **|** `null` | One of VPC | SITE\_TO\_SITE\_VPN | CONNECT | DIRECT\_CONNECT\_GATEWAY | TRANSIT\_GATEWAY\_ROUTE\_TABLE. |  |
| 

`coreNetworkArn` \*

 | `string` **|** `null` | ARN of the owning core network. |  |
| 

`coreNetworkId` \*

 | `string` | The owning core network ID. |  |
| 

`edgeLocation` \*

 | `string` **|** `null` | Edge location the attachment is bound to. |  |
| 

`edgeLocations` \*

 | `array` **|** `null` | Edge locations associated with the attachment — set on Direct Connect Gateway attachments that span multiple edges. |  |
| 

`hasLastModificationErrors` \*

 | `boolean` | True when LastModificationErrors\[\] has one or more entries. |  |
| 

`id` \*

 | `string` | The CloudWAN attachment ID (attachment-…). |  |
| 

`isPendingAcceptance` \*

 | `boolean` | True when the attachment is awaiting acceptance (PENDING\_ATTACHMENT\_ACCEPTANCE or PENDING\_TAG\_ACCEPTANCE). |  |
| 

`lastModificationErrorCodes` \*

 | `array` **|** `null` | Error codes from LastModificationErrors\[\].Code if any. |  |
| 

`networkFunctionGroupName` \*

 | `string` **|** `null` | Network function group binding for service-insertion attachments. |  |
| 

`ownerAccountId` \*

 | `string` **|** `null` | AWS account that owns this attachment — present even when the underlying resource is in a different account. |  |
| 

`proposedNetworkFunctionGroupName` \*

 | `string` **|** `null` | Proposed network-function-group binding from a pending change (drift detection). |  |
| 

`proposedSegmentName` \*

 | `string` **|** `null` | Proposed segment binding from a pending change (drift detection). |  |
| 

`region` \*

 | `string` **|** `null` | Edge location (AWS region) the attachment terminates in — alias of edgeLocation. |  |
| 

`resourceArn` \*

 | `string` **|** `null` | The underlying VPC/VPN/Direct-Connect-Gateway/Transit-Gateway-Route-Table ARN. Kept on the entity to support compliance queries against cross-account targets that may not be ingested. |  |
| 

`routingPolicyLabels` \*

 | `array` **|** `null` | Routing-policy labels associated with this attachment, sourced from ListAttachmentRoutingPolicyAssociations. |  |
| 

`segmentName` \*

 | `string` **|** `null` | Segment the attachment is bound to (compliance pivot). |  |
| 

`state` \*

 | `string` **|** `null` | Lifecycle state. |  |

---

### Aws Networkmanager Connect Peer

`aws_networkmanager_connect_peer` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` | The owning AWS account ID. |  |
| 

`arn` \*

 | `string` | The synthesized connect-peer ARN (arn:aws:networkmanager::{ownerAccountId}:connect-peer/{connectPeerId}); entity \_key. |  |
| 

`bgpPeerAsns` \*

 | `array` **|** `null` | BGP peer ASNs (one per Configuration.BgpConfigurations entry). |  |
| 

`connectAttachmentId` \*

 | `string` | The Connect attachment ID this peer is bound to (relationship pivot). |  |
| 

`connectPeerId` \*

 | `string` | The Connect Peer ID. |  |
| 

`coreNetworkAddress` \*

 | `string` **|** `null` | BGP local address on the core network side. |  |
| 

`coreNetworkId` \*

 | `string` | The owning core network ID. |  |
| 

`edgeLocation` \*

 | `string` **|** `null` | Edge location. |  |
| 

`hasLastModificationErrors` \*

 | `boolean` | True when LastModificationErrors\[\] has one or more entries. |  |
| 

`id` \*

 | `string` | The Connect Peer ID. |  |
| 

`insideCidrBlocks` \*

 | `array` **|** `null` | Inside CIDR blocks (GRE only). |  |
| 

`peerAddress` \*

 | `string` **|** `null` | BGP peer address (customer/appliance side). |  |
| 

`protocol` \*

 | `string` **|** `null` | Encapsulation protocol. | **Any of**:

-   `GRE`

-   `NO_ENCAP`

-   `undefined`

 |
| 

`region` \*

 | `string` **|** `null` | Edge location of this peer (alias of edgeLocation). |  |
| 

`state` \*

 | `string` **|** `null` | Lifecycle state. |  |
| 

`subnetArn` \*

 | `string` **|** `null` | Subnet ARN for NO\_ENCAP peers. Kept on the entity to support cross-account compliance queries. |  |

---

### Aws Networkmanager Core Network

`aws_networkmanager_core_network` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` | The owning AWS account ID derived from the ARN. |  |
| 

`arn` \*

 | `string` | The CloudWAN core network ARN; entity \_key. |  |
| 

`coreNetworkId` \*

 | `string` | The CloudWAN core network ID (e.g. core-network-…). |  |
| 

`edgeAsns` \*

 | `array` **|** `null` | Per-edge BGP ASNs assigned by the core network at each edge location. |  |
| 

`edgeLocations` \*

 | `array` **|** `null` | All edge locations (AWS regions) the core network is deployed to. |  |
| 

`globalNetworkId` \*

 | `string` | The parent NetworkManager global network ID. |  |
| 

`id` \*

 | `string` | The CloudWAN core network ID (e.g. core-network-…). |  |
| 

`latestPolicyVersionId` \*

 | `number` **|** `null` | Policy version ID currently aliased LATEST — used to detect drift versus LIVE. |  |
| 

`livePolicyVersionId` \*

 | `number` **|** `null` | Policy version ID currently aliased LIVE on the core network — the enforced policy. |  |
| 

`networkFunctionGroupNames` \*

 | `array` **|** `null` | Names of network function groups defined for service insertion on the core network. |  |
| 

`region` \*

 | `string` | The control-plane region for the core network (us-west-2 for commercial, us-gov-west-1 for GovCloud). |  |
| 

`segmentNames` \*

 | `array` **|** `null` | Names of segments (logical isolation domains) defined on the core network. |  |
| 

`state` \*

 | `string` **|** `null` | Lifecycle state (AVAILABLE, UPDATING, CREATING, DELETING, …). |  |

---

### Aws Networkmanager Core Network Policy

`aws_networkmanager_core_network_policy` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` | The owning AWS account ID derived from the ARN. |  |
| 

`alias` \*

 | `string` **|** `null` | Alias of this version (LIVE = enforced, LATEST = latest published). | **Any of**:

-   `LIVE`

-   `LATEST`

-   `undefined`

 |
| 

`asnRanges` \*

 | `array` **|** `null` | BGP ASN ranges available to the core network (from core-network-configuration.asn-ranges). |  |
| 

`attachmentPolicyRuleCount` \*

 | `number` **|** `null` | Number of attachment-policy rules — a quick gauge of policy complexity. |  |
| 

`changeSetState` \*

 | `string` **|** `null` | Change-set state (READY\_TO\_EXECUTE, EXECUTING, OUT\_OF\_DATE, FAILED, …). |  |
| 

`coreNetworkId` \*

 | `string` | The owning core network ID. |  |
| 

`hasPolicyErrors` \*

 | `boolean` | True when the policy has one or more PolicyErrors entries (compliance signal). |  |
| 

`id` \*

 | `string` | The policy version ID (string-coerced) — natural AWS resource identifier scoped to the parent core network. |  |
| 

`insideCidrBlocks` \*

 | `array` **|** `null` | Inside CIDR blocks reserved for Connect attachments (from core-network-configuration.inside-cidr-blocks). |  |
| 

`isLive` \*

 | `boolean` | True when this policy version is aliased LIVE. |  |
| 

`isVpnEcmpSupportEnabled` \*

 | `boolean` **|** `null` | Whether VPN ECMP support is enabled on the core network (from core-network-configuration.vpn-ecmp-support). |  |
| 

`networkFunctionGroupNames` \*

 | `array` **|** `null` | All network-function-group names declared in the policy. |  |
| 

`policyErrorCodes` \*

 | `array` **|** `null` | Error codes from PolicyErrors\[\].ErrorCode if any. |  |
| 

`policyVersionId` \*

 | `number` | The policy version (monotonically increasing). |  |
| 

`region` \*

 | `string` | Control-plane region the policy was retrieved from. |  |
| 

`segmentNames` \*

 | `array` **|** `null` | All segment names declared in the policy. |  |

---

### Aws Opensearch Domain

`aws_opensearch_domain` inherits from [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessPolicies` \*

 | `string` **|** `null` | Raw JSON string of the IAM resource-based access policy attached to the OpenSearch domain. |  |
| 

`anonymousAuthDisabledOn` \*

 | `number` **|** `null` |  |  |
| 

`appLoggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`auditLoggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`autoTuneErrorMessage` \*

 | `string` **|** `null` |  |  |
| 

`autoTuneStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`autoTuneState` \*

 | `string` **|** `null` |  |  |
| 

`autoTuneUseOffPeakWindow` \*

 | `boolean` **|** `null` |  |  |
| 

`availabilityZoneCount` \*

 | `number` **|** `null` |  |  |
| 

`availabilityZones` \*

 | `array` **|** `null` |  |  |
| 

`changeProgressDetails` \*

 | `string` **|** `null` |  |  |
| 

`cognitoIdentityPoolId` \*

 | `string` **|** `null` |  |  |
| 

`cognitoRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`cognitoUserPoolId` \*

 | `string` **|** `null` |  |  |
| 

`customEndpoint` \*

 | `string` **|** `null` |  |  |
| 

`customEndpointCertificateArn` \*

 | `string` **|** `null` |  |  |
| 

`domainEndpointV2HostedZoneId` \*

 | `string` **|** `null` |  |  |
| 

`domainId` \*

 | `string` **|** `null` |  |  |
| 

`domainName` \*

 | `string` **|** `null` |  |  |
| 

`domainProcessingStatus` \*

 | `string` **|** `null` |  |  |
| 

`encryptionAtRestKmsKeyId` \*

 | `string` **|** `null` |  |  |
| 

`endpoint` \*

 | `string` **|** `null` |  |  |
| 

`endpoints` \*

 | `string` **|** `null` |  |  |
| 

`endpointV2` \*

 | `string` **|** `null` |  |  |
| 

`engineVersion` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterApplicationArn` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterInstanceArn` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterRolesKey` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterSubjectKey` \*

 | `string` **|** `null` |  |  |
| 

`instanceCount` \*

 | `number` **|** `null` |  |  |
| 

`instanceType` \*

 | `string` **|** `null` |  |  |
| 

`iops` \*

 | `number` **|** `null` |  |  |
| 

`ipAddressType` \*

 | `string` **|** `null` |  |  |
| 

`isAdvancedSecurityEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAnonymousAuthEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAppLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAuditLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAutoSoftwareUpdateEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAutoTuneEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCognitoEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isColdStorageEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCreated` \*

 | `boolean` **|** `null` |  |  |
| 

`isCustomEndpointEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isDedicatedMasterEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isDeleted` \*

 | `boolean` **|** `null` |  |  |
| 

`isEbsEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isEncryptionAtRestEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isHttpsEnforced` \*

 | `boolean` **|** `null` |  |  |
| 

`isInternalUserDatabaseEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isInVpc` \*

 | `boolean` **|** `null` |  |  |
| 

`isJwtEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isMultiAzWithStandbyEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isNodeToNodeEncryptionEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isOffPeakWindowEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isProcessing` \*

 | `boolean` **|** `null` |  |  |
| 

`isSamlEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isSlowIndexLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isSlowSearchLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isUpgradeProcessing` \*

 | `boolean` **|** `null` |  |  |
| 

`isWarmEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isZoneAwarenessEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`jwtRolesKey` \*

 | `string` **|** `null` |  |  |
| 

`jwtSubjectKey` \*

 | `string` **|** `null` |  |  |
| 

`masterInstanceCount` \*

 | `number` **|** `null` |  |  |
| 

`masterInstanceType` \*

 | `string` **|** `null` |  |  |
| 

`modifyingProperties` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`naturalLanguageQueryGenerationCurrentState` \*

 | `string` **|** `null` |  |  |
| 

`naturalLanguageQueryGenerationDesiredState` \*

 | `string` **|** `null` |  |  |
| 

`offPeakWindowStartHours` \*

 | `number` **|** `null` |  |  |
| 

`offPeakWindowStartMinutes` \*

 | `number` **|** `null` |  |  |
| 

`opensearchVersion` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`samlRolesKey` \*

 | `string` **|** `null` |  |  |
| 

`samlSessionTimeoutMinutes` \*

 | `number` **|** `null` |  |  |
| 

`samlSubjectKey` \*

 | `string` **|** `null` |  |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`serviceSoftwareOptions` \*

 | `string` **|** `null` |  |  |
| 

`slowIndexLoggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`slowSearchLoggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`snapshotOptions` \*

 | `string` **|** `null` |  |  |
| 

`subnetIds` \*

 | `array` **|** `null` |  |  |
| 

`throughput` \*

 | `number` **|** `null` |  |  |
| 

`tlsSecurityPolicy` \*

 | `string` **|** `null` |  |  |
| 

`volumeSize` \*

 | `number` **|** `null` |  |  |
| 

`volumeType` \*

 | `string` **|** `null` |  |  |
| 

`vpcId` \*

 | `string` **|** `null` |  |  |
| 

`warmCount` \*

 | `number` **|** `null` |  |  |
| 

`warmType` \*

 | `string` **|** `null` |  |  |

---

### Aws Organization Root

`aws_organization_root` inherits from [Organization](/data-model/schemas/Organization.md), [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the organization root. |  |
| 

`enabledPolicyTypes` \*

 | `array` of `string`s | AWS Organizations policy types currently enabled for this organization root, as reported by ListRoots (for example SERVICE\_CONTROL\_POLICY, RESOURCE\_CONTROL\_POLICY, S3\_POLICY). Policy types absent from this list are not enabled for the root. |  |
| 

`isAiServicesOptOutPolicyEnabled` \*

 | `boolean` | Whether AI services opt-out policies are enabled for this organization root. These policies control whether AWS may store and use customer content submitted to AI services to improve those services. False when the policy type is disabled or is still being enabled. |  |
| 

`isBackupPolicyEnabled` \*

 | `boolean` | Whether backup policies are enabled for this organization root. Backup policies centrally define AWS Backup plans for the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isBedrockPolicyEnabled` \*

 | `boolean` | Whether Amazon Bedrock policies are enabled for this organization root. Bedrock policies centrally enforce Bedrock Guardrails on model inference calls made from the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isChatbotPolicyEnabled` \*

 | `boolean` | Whether chat applications policies are enabled for this organization root. These policies control which chat workspaces (Slack, Microsoft Teams) member accounts may connect to AWS. False when the policy type is disabled or is still being enabled. |  |
| 

`isDeclarativePolicyEc2Enabled` \*

 | `boolean` | Whether declarative policies for EC2 are enabled for this organization root. Declarative EC2 policies centrally enforce EC2 account attributes such as instance metadata defaults, serial console access, image block public access, and allowed AMI providers. False when the policy type is disabled or is still being enabled. |  |
| 

`isInspectorPolicyEnabled` \*

 | `boolean` | Whether Amazon Inspector policies are enabled for this organization root. Inspector policies centrally enable and configure Amazon Inspector scanning across the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isNetworkSecurityDirectorPolicyEnabled` \*

 | `boolean` | Whether AWS Shield network security director policies are enabled for this organization root. These policies centrally enable AWS Shield network security director, which discovers compute, networking, and network security resources and evaluates their configuration against network topology, AWS best practices, and threat intelligence, across the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isResourceControlPolicyEnabled` \*

 | `boolean` | Whether resource control policies (RCPs) are enabled for this organization root. RCPs set the maximum available permissions on resources in the member accounts, regardless of the calling principal's account. False when the policy type is disabled or is still being enabled. |  |
| 

`isS3PolicyEnabled` \*

 | `boolean` | Whether Amazon S3 policies are enabled for this organization root. S3 policies centrally enforce the four S3 Block Public Access settings across the member accounts, overriding account-level configuration. False when the policy type is disabled or is still being enabled. |  |
| 

`isSecurityHubPolicyEnabled` \*

 | `boolean` | Whether Security Hub policies are enabled for this organization root. Security Hub policies centrally configure Security Hub enablement, standards, and controls across the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isServiceControlPolicyEnabled` \*

 | `boolean` | Whether service control policies (SCPs) are enabled for this organization root. SCPs set the maximum available permissions for principals in the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isTagPolicyEnabled` \*

 | `boolean` | Whether tag policies are enabled for this organization root. Tag policies standardise tag keys and values on resources across the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isUpgradeRolloutPolicyEnabled` \*

 | `boolean` | Whether upgrade rollout policies are enabled for this organization root. Upgrade rollout policies centrally control how AWS service upgrades are staged across the member accounts. False when the policy type is disabled or is still being enabled. |  |

---

### Aws Organization Tag Policy

`aws_organization_tag_policy` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `awsManaged` | `boolean` |  |  |
| `content` | `string` |  |  |
| `type` | `string` |  |  |

---

### Aws Prometheus Scraper

`aws_prometheus_scraper` inherits from [Scanner](/data-model/schemas/Scanner.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alias` \*

 | `string` **|** `null` | Customer-assigned alias for the scraper (not unique). |  |
| 

`arn` \*

 | `string` | The full ARN of the scraper. |  |
| 

`destinationWorkspaceArn` \*

 | `string` **|** `null` | destination.ampConfiguration.workspaceArn — the AMP workspace the scraper writes metrics to. Used to build the SENDS relationship. |  |
| 

`eksClusterArn` \*

 | `string` **|** `null` | EKS cluster ARN the scraper collects from. Populated only when sourceType is EKS. |  |
| 

`isCrossAccountScrape` \*

 | `boolean` | True when DescribeScraper.roleConfiguration is present, indicating a cross-account scraping setup (source-account role + target-account role). |  |
| 

`region` \*

 | `string` | AWS region where the scraper runs. |  |
| 

`roleArn` \*

 | `string` | IAM role ARN the managed collector assumes to discover targets and write to the destination workspace. Required by the API. |  |
| 

`scraperId` \*

 | `string` | The AMP scraper identifier (e.g. s-abcd1234-...). |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Security group IDs applied to the scraper ENIs. Pulled from source.eksConfiguration.securityGroupIds or source.vpcConfiguration.securityGroupIds. May be null/empty for EKS (the field is optional on EksConfiguration). |  |
| 

`sourceAccountId` \*

 | `string` **|** `null` | AWS account ID parsed from `sourceRoleArn`. Used by the relationship-builder to construct subnet/security-group ARNs in the source account for cross-account scrapers, so mapped relationships resolve to the correct entities. Null when single-account. |  |
| 

`sourceRoleArn` \*

 | `string` **|** `null` | roleConfiguration.sourceRoleArn — IAM role in the source account used for cross-account scraping. Null when single-account. |  |
| 

`sourceType` \*

 | `string` **|** `null` | Discriminator for the source UNION. EKS when source.eksConfiguration is set, VPC when source.vpcConfiguration is set (MSK), null when neither (forward-compat). |  |
| 

`statusCode` \*

 | `string` **|** `null` | Scraper lifecycle status from DescribeScraper.status.statusCode (CREATING|ACTIVE|DELETING|CREATION\_FAILED|DELETION\_FAILED). |  |
| 

`statusReason` \*

 | `string` **|** `null` | Free-text reason for the current scraper status, populated when statusCode is a \*\_FAILED state. |  |
| 

`subnetIds` \*

 | `array` **|** `null` | Subnet IDs the scraper attaches its ENIs to. Pulled from source.eksConfiguration.subnetIds or source.vpcConfiguration.subnetIds. |  |
| 

`targetRoleArn` \*

 | `string` **|** `null` | roleConfiguration.targetRoleArn — IAM role in the target (workspace) account used for cross-account scraping. Null when single-account. |  |
| 

`webLink` \*

 | `string` **|** `null` | Link to the scraper in the AWS console. |  |

---

### Aws Prometheus Workspace

`aws_prometheus_workspace` inherits from [Logs](/data-model/schemas/Logs.md), [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alias` \*

 | `string` **|** `null` | Customer-assigned alias for the workspace (not unique). |  |
| 

`arn` \*

 | `string` | The full ARN of the workspace. |  |
| 

`configurationStatusCode` \*

 | `string` **|** `null` | Status code from DescribeWorkspaceConfiguration.status.statusCode (e.g. ACTIVE, UPDATING). |  |
| 

`displayName` \*

 | `string` | Human-readable name (alias when set, workspace ID otherwise). |  |
| 

`endpointStatusCode` \*

 | `string` **|** `null` | Workspace lifecycle status from DescribeWorkspace.status.statusCode (CREATING|ACTIVE|UPDATING|DELETING|CREATION\_FAILED). |  |
| 

`hasResourcePolicy` \*

 | `boolean` **|** `null` | True when DescribeResourcePolicy returned an attached policy (workspace is shared cross-account or cross-principal). False when no policy is attached. Null when the Describe call failed. |  |
| 

`isCustomerManagedEncryption` \*

 | `boolean` | True when the workspace is encrypted with a customer-managed KMS key; false when using an AWS-owned key. |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` | True when DescribeLoggingConfiguration returned a configuration with a logGroupArn. False when no configuration is attached. Null when the Describe call failed (e.g. AccessDenied or throttling) — distinguishes "feature off" from "could not determine". |  |
| 

`isQueryLoggingEnabled` \*

 | `boolean` **|** `null` | True when at least one CloudWatch Logs destination is configured for query logging. False when no configuration is attached. Null when the Describe call failed. |  |
| 

`loggingStatusCode` \*

 | `string` **|** `null` | Status code from DescribeLoggingConfiguration.status.statusCode. |  |
| 

`logGroupArn` \*

 | `string` **|** `null` | CloudWatch Logs log group ARN receiving rules/alerting logs; null when logging not configured. |  |
| 

`name` \*

 | `string` | The AMP workspace identifier (used as the entity name). |  |
| 

`policyDocument` \*

 | `string` **|** `null` | The raw JSON IAM policy document attached to the workspace via DescribeResourcePolicy. Used downstream to build IAM principal relationships. Null when no policy. |  |
| 

`prometheusEndpoint` \*

 | `string` **|** `null` | The Prometheus query API endpoint URL exposed by the workspace. |  |
| 

`queryLoggingQspThreshold` \*

 | `number` **|** `null` | Query samples processed (QSP) threshold filter for query logging — only queries above this threshold are logged. |  |
| 

`queryLoggingStatusCode` \*

 | `string` **|** `null` | Status code from DescribeQueryLoggingConfiguration.status.statusCode. |  |
| 

`queryLogGroupArn` \*

 | `string` **|** `null` | CloudWatch Logs log group ARN receiving query logs (first destination). Null when query logging not configured. |  |
| 

`queryLogGroupArns` \*

 | `array` **|** `null` | All CloudWatch Logs log group ARNs configured as query logging destinations (the API allows multiple even though current AWS console only supports one). |  |
| 

`region` \*

 | `string` | AWS region where the workspace lives. |  |
| 

`resourcePolicyStatusCode` \*

 | `string` **|** `null` | Lifecycle of the resource-based policy from DescribeResourcePolicy.policyStatus (CREATING|ACTIVE|UPDATING|DELETING). Null when no policy. |  |
| 

`retentionPeriodInDays` \*

 | `number` **|** `null` | Metric retention period in days from DescribeWorkspaceConfiguration. Null when DescribeWorkspaceConfiguration fails or is unavailable. |  |
| 

`webLink` \*

 | `string` **|** `null` | Link to the workspace in the AWS console. |  |
| 

`workspaceId` \*

 | `string` | The AMP workspace identifier (e.g. ws-abcd1234-...). |  |

---

### Aws Ram Principal

`aws_ram_principal` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`associatedResourceShares` \*

 | `array` **|** `null` |  |  |
| 

`associationStatus` \*

 | `string` **|** `null` |  |  |
| 

`associationStatusMessage` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isExternal` \*

 | `boolean` **|** `null` |  |  |
| 

`isOwnedBySelf` \*

 | `boolean` |  |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`organizationId` \*

 | `string` **|** `null` |  |  |
| 

`principalArn` \*

 | `string` |  |  |
| 

`principalType` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`sourceOwner` \*

 | `string` |  |  |
| 

`vendor` \*

 | `string` |  |  |

---

### Aws Ram Resource Share

`aws_ram_resource_share` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isAllowExternalPrincipals` \*

 | `boolean` **|** `null` |  |  |
| 

`isFeatureSet` \*

 | `string` **|** `null` |  |  |
| 

`isOwnedBySelf` \*

 | `boolean` |  |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`owningAccountId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resourceShareArn` \*

 | `string` **|** `null` |  |  |
| 

`sourceOwner` \*

 | `string` |  |  |
| 

`status` \*

 | `string` |  |  |
| 

`statusMessage` \*

 | `string` **|** `null` |  |  |

---

### Aws Ram Resource Share Invitation

`aws_ram_resource_share_invitation` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`invitationTimestamp` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`receiverAccountId` \*

 | `string` **|** `null` |  |  |
| 

`receiverArn` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resourceShareArn` \*

 | `string` **|** `null` |  |  |
| 

`resourceShareName` \*

 | `string` **|** `null` |  |  |
| 

`senderAccountId` \*

 | `string` **|** `null` |  |  |
| 

`status` \*

 | `string` |  |  |

---

### Aws Ram Shared Resource

`aws_ram_shared_resource` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isOwnedBySelf` \*

 | `boolean` |  |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resourceGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`resourceRegionScope` \*

 | `string` **|** `null` |  |  |
| 

`sourceOwner` \*

 | `string` |  |  |
| 

`status` \*

 | `string` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Aws Redshift Datashare

`aws_redshift_datashare` inherits from [DataCollection](/data-model/schemas/DataCollection.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` **|** `null` |  |  |
| 

`authorizationCount` \*

 | `number` **|** `null` |  |  |
| 

`datashareArn` \*

 | `string` **|** `null` |  |  |
| 

`datashareId` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`isProducerFromOtherAccount` \*

 | `boolean` **|** `null` |  |  |
| 

`isProducerFromOtherRegion` \*

 | `boolean` **|** `null` |  |  |
| 

`isPubliclyAccessibleByConsumers` \*

 | `boolean` **|** `null` |  |  |
| 

`managedBy` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`producerArn` \*

 | `string` **|** `null` |  |  |
| 

`producerType` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Redshift Datashare Authorization

`aws_redshift_datashare_authorization` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`consumerIdentifier` \*

 | `string` **|** `null` |  |  |
| 

`consumerRegion` \*

 | `string` **|** `null` |  |  |
| 

`datashareArn` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`producerAllowedWrites` \*

 | `boolean` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`statusChangedOn` \*

 | `number` **|** `null` |  |  |

---

### Aws Resource Explorer Index

`aws_resource_explorer_index` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the index. |  |
| 

`isAggregator` \*

 | `boolean` **|** `null` | True if this is the aggregator index. |  |
| 

`region` \*

 | `string` | AWS region. |  |
| 

`replicatingFrom` \*

 | `array` **|** `null` | For an AGGREGATOR index: the Regions that replicate their content into this index. |  |
| 

`replicatingTo` \*

 | `array` **|** `null` | For a LOCAL index: the Regions whose content this index replicates to (i.e. the aggregator region). |  |
| 

`state` \*

 | `string` **|** `null` | Index state. |  |
| 

`type` \*

 | `string` **|** `null` | Index type: LOCAL or AGGREGATOR. |  |

---

### Aws Resource Explorer View

`aws_resource_explorer_view` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the view. |  |
| 

`filtersString` \*

 | `string` **|** `null` | Filter expression string. |  |
| 

`includedProperties` \*

 | `array` **|** `null` | Additional resource property names included in results. |  |
| 

`isDefaultView` \*

 | `boolean` **|** `null` | True if this is the account default view. |  |
| 

`ownerAccountId` \*

 | `string` **|** `null` | AWS account ID that owns this view. |  |
| 

`region` \*

 | `string` | AWS region. |  |
| 

`scope` \*

 | `string` **|** `null` | Scope ARN of the view. |  |
| 

`viewName` \*

 | `string` **|** `null` | View name. |  |

---

### Aws S3 Bucket Lifecycle Rule

`aws_s3_bucket_lifecycle_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`abortIncompleteMultipartUploadDays` \*

 | `number` **|** `null` | Days after multipart-upload initiation before the upload is aborted and parts deleted (rule.AbortIncompleteMultipartUpload.DaysAfterInitiation). Storage-cost and security hygiene signal. |  |
| 

`appliesToAllObjects` \*

 | `boolean` | True iff the rule has no filter (no prefix, no tag, no size bounds, no And operator). Wide-scope rules are a key compliance review signal. |  |
| 

`expirationDate` \*

 | `number` **|** `null` | Absolute date (epoch ms) at which current versions expire (rule.Expiration.Date). Most rules use Days OR Date, not both. |  |
| 

`expirationDays` \*

 | `number` **|** `null` | Days after object creation when current versions are expired (rule.Expiration.Days). Maps directly to retention policy in NIST SI-12 / SOC 2 CC6.5 / HIPAA 164.310(d)(2)(i) / PCI DSS 3.1. |  |
| 

`filterAndTagKeys` \*

 | `array` **|** `null` | Tag keys used in the multi-tag conjunction filter (rule.Filter.And.Tags). Parallel-array to filterAndTagValues — same index = same tag. |  |
| 

`filterAndTagValues` \*

 | `array` **|** `null` | Tag values used in the multi-tag conjunction filter. Index-aligned with filterAndTagKeys. |  |
| 

`filterObjectSizeGreaterThan` \*

 | `number` **|** `null` | Minimum object size in bytes for the rule to apply (rule.Filter.ObjectSizeGreaterThan or rule.Filter.And.ObjectSizeGreaterThan). |  |
| 

`filterObjectSizeLessThan` \*

 | `number` **|** `null` | Maximum object size in bytes for the rule to apply (rule.Filter.ObjectSizeLessThan or rule.Filter.And.ObjectSizeLessThan). |  |
| 

`filterPrefix` \*

 | `string` **|** `null` | Object key prefix the rule applies to. Pulled from rule.Prefix (deprecated), rule.Filter.Prefix, or rule.Filter.And.Prefix in that order. Null when no prefix is configured — see appliesToAllObjects for the "applies to every object" signal. |  |
| 

`filterTagKey` \*

 | `string` **|** `null` | Key of the single object tag that scopes this rule (when rule.Filter.Tag is set). |  |
| 

`filterTagValue` \*

 | `string` **|** `null` | Value of the single object tag that scopes this rule (when rule.Filter.Tag is set). |  |
| 

`hasAnyAction` \*

 | `boolean` | True iff the rule has at least one action defined (expiration, transition, noncurrent-version action, or abort-incomplete-multipart-upload). False indicates a misconfiguration — a rule with no action does nothing. |  |
| 

`isAppliedToNoncurrentVersions` \*

 | `boolean` | True iff the rule has any NoncurrentVersion\* action defined. Combined with bucket-level versioningEnabled in J1QL to spot misconfigurations. |  |
| 

`isEnabled` \*

 | `boolean` | Whether the lifecycle rule is currently being enforced (true iff Status === "Enabled"). Disabled rules look like coverage but are not applied — a key compliance signal. |  |
| 

`isExpiredObjectDeleteMarkerEnabled` \*

 | `boolean` **|** `null` | Whether the rule cleans up expired-object delete markers (rule.Expiration.ExpiredObjectDeleteMarker). Used to keep versioned bucket listings tidy. |  |
| 

`noncurrentExpirationDays` \*

 | `number` **|** `null` | Days a version is retained after becoming noncurrent before expiration (rule.NoncurrentVersionExpiration.NoncurrentDays). Critical for compliance on versioned buckets. |  |
| 

`noncurrentExpirationNewerVersions` \*

 | `number` **|** `null` | Number of newer noncurrent versions to retain before expiring older ones (rule.NoncurrentVersionExpiration.NewerNoncurrentVersions). |  |
| 

`noncurrentTransitionCount` \*

 | `number` | Number of noncurrent-version transitions defined on this rule. |  |
| 

`noncurrentTransitionDays` \*

 | `array` **|** `null` | Days after object version becomes noncurrent for each transition (rule.NoncurrentVersionTransitions\[\].NoncurrentDays). Index-aligned with noncurrentTransitionStorageClasses and noncurrentTransitionNewerVersions. A value of -1 indicates NoncurrentDays was missing in the source response. |  |
| 

`noncurrentTransitionNewerVersions` \*

 | `array` **|** `null` | Number of newer noncurrent versions to retain before transitioning, for each noncurrent transition (rule.NoncurrentVersionTransitions\[\].NewerNoncurrentVersions, max 100). Index-aligned. A value of -1 means NewerNoncurrentVersions was not configured for that transition. |  |
| 

`noncurrentTransitionStorageClasses` \*

 | `array` **|** `null` | Destination storage class for each noncurrent-version transition (rule.NoncurrentVersionTransitions\[\].StorageClass). Index-aligned. Empty string indicates the source response omitted StorageClass. |  |
| 

`region` \*

 | `string` **|** `null` | AWS region of the parent S3 bucket. Null for legacy buckets without a recorded region. |  |
| 

`ruleId` \*

 | `string` **|** `null` | AWS-side rule identifier (rule.ID). May be absent on rules created without an explicit ID — in that case the entity key falls back to an index-based synthesis. |  |
| 

`transitionCount` \*

 | `number` | Number of current-version transitions defined on this rule (rule.Transitions?.length ?? 0). Convenience for J1QL. |  |
| 

`transitionDates` \*

 | `array` **|** `null` | Absolute transition dates (epoch ms) for each transition (rule.Transitions\[\].Date). Index-aligned with transitionDays / transitionStorageClasses. A value of 0 at index i indicates that transition i is Days-based rather than Date-based; consult transitionDays\[i\] in that case. Null when there are no transitions. |  |
| 

`transitionDays` \*

 | `array` **|** `null` | Days after object creation for each transition (rule.Transitions\[\].Days). Parallel-array, index-aligned with transitionDates and transitionStorageClasses. A value of -1 at index i indicates that transition i is Date-based rather than Days-based; consult transitionDates\[i\] in that case. Null when there are no transitions. |  |
| 

`transitionStorageClasses` \*

 | `array` **|** `null` | Destination storage class for each transition (rule.Transitions\[\].StorageClass): one of STANDARD\_IA, ONEZONE\_IA, INTELLIGENT\_TIERING, GLACIER, GLACIER\_IR, DEEP\_ARCHIVE. Index-aligned with transitionDays / transitionDates. Empty string indicates the source response omitted StorageClass. |  |

---

### Aws Sagemaker Domain

`aws_sagemaker_domain` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`appNetworkAccessType` \*

 | `string` **|** `null` | Network egress mode for Studio apps: 'PublicInternetOnly' (SageMaker-managed VPC with direct internet access) or 'VpcOnly' (all traffic through the customer VPC). |  |
| 

`appSecurityGroupManagement` \*

 | `string` **|** `null` | Who creates and manages inter-app security groups in VpcOnly mode: 'Service' or 'Customer'. |  |
| 

`arn` \*

 | `string` | The ARN of the SageMaker domain. |  |
| 

`authMode` \*

 | `string` **|** `null` | How users authenticate into Studio: 'SSO' (IAM Identity Center) or 'IAM'. |  |
| 

`defaultSpaceExecutionRoleArn` \*

 | `string` **|** `null` | The default IAM execution role assumed by shared spaces in the domain. |  |
| 

`defaultSpaceSecurityGroupIds` \*

 | `array` **|** `null` | Default security groups applied to shared spaces in the domain. |  |
| 

`defaultUserExecutionRoleArn` \*

 | `string` **|** `null` | The default IAM execution role assumed by user profiles that do not override it. |  |
| 

`defaultUserSecurityGroupIds` \*

 | `array` **|** `null` | Default security groups applied to user-profile apps. |  |
| 

`dockerTrustedAccountIds` \*

 | `array` **|** `null` | AWS account IDs trusted to serve Docker images to this domain in VpcOnly mode — a cross-account trust list. |  |
| 

`domainId` \*

 | `string` | The SageMaker-assigned domain identifier (e.g. d-abc123defghi). |  |
| 

`domainSecurityGroupIds` \*

 | `array` **|** `null` | Domain-level security groups governing traffic between domain-level apps and user apps. |  |
| 

`executionRoleIdentityConfig` \*

 | `string` **|** `null` | Whether the user profile name is stamped onto assumed-role sessions as sts:SourceIdentity ('USER\_PROFILE\_NAME') or not ('DISABLED'). When DISABLED, CloudTrail cannot attribute Studio actions to an individual user. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the domain failed to provision, when applicable. |  |
| 

`homeEfsFileSystemId` \*

 | `string` **|** `null` | The ID of the EFS file system managed by the domain, which stores all user notebooks and code. |  |
| 

`homeEfsFileSystemKmsKeyId` \*

 | `string` **|** `null` | Deprecated by AWS in favour of kmsKeyId; usually absent on modern domains. Absence does not mean unencrypted. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isDockerAccessEnabled` \*

 | `boolean` **|** `null` | Whether local Docker interaction is enabled for Studio apps in this domain, which expands the container-escape surface. |  |
| 

`isPublicInternetAccessEnabled` \*

 | `boolean` | Whether Studio apps in this domain reach the internet directly through the SageMaker-managed VPC rather than being confined to the customer VPC. Describes egress, not inbound reachability. Defaults to true when AppNetworkAccessType is absent, matching the AWS default of PublicInternetOnly. |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key used to encrypt the EFS volume attached to the domain. Absence means an AWS-managed key is used, not that the volume is unencrypted. |  |
| 

`region` \*

 | `string` | The AWS region hosting the domain. |  |
| 

`securityGroupIdForDomainBoundary` \*

 | `string` **|** `null` | The security group authorizing traffic between RSessionGateway apps and the RStudioServerPro app. |  |
| 

`subnetIds` \*

 | `array` **|** `null` | The VPC subnet IDs the domain uses for communication. |  |
| 

`url` \*

 | `string` **|** `null` | The Studio entry-point URL for the domain. |  |
| 

`vpcId` \*

 | `string` **|** `null` | The ID of the VPC the domain uses for communication. |  |

---

### Aws Sagemaker Endpoint

`aws_sagemaker_endpoint` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` |  |  |
| `createdOn` | `number` |  |  |
| `dataCaptureDestinationS3Uri` | `string` | The S3 URI where captured inference payloads are written. |  |
| `dataCaptureKmsKeyId` | `string` | The customer-managed KMS key used to encrypt captured inference data. May be a key ID, key ARN, alias, or alias ARN. Absence means an AWS-managed key is used, not that the data is unencrypted. |  |
| `dataCaptureModes` | `array` of `string`s | Which payloads are captured: 'Input', 'Output', or both. |  |
| `dataCaptureSamplingPercentage` | `number` | Percentage of live inference traffic persisted to S3, which may include sensitive payloads. |  |
| 

`displayName` \*

 | `string` |  |  |
| `endpointConfigName` | `string` |  |  |
| 

`endpointName` \*

 | `string` |  |  |
| `executionRoleArn` | `string` |  |  |
| `failureReason` | `string` |  |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| `isDataCaptureEnabled` | `boolean` | Whether inference request/response payloads are captured to S3. False when no DataCaptureConfig is configured on the endpoint config. |  |
| `kmsKeyId` | `string` |  |  |
| `modelNames` | `array` of `string`s |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| `updatedOn` | `number` |  |  |
| `vpcSecurityGroupIds` | `array` of `string`s |  |  |
| `vpcSubnets` | `array` of `string`s |  |  |
| 

`webLink` \*

 | `string` |  |  |

---

### Aws Sagemaker Feature Group

`aws_sagemaker_feature_group` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the feature group. |  |
| 

`eventTimeFeatureName` \*

 | `string` **|** `null` | The name of the feature holding the event time of each record. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the feature group failed to be created, when applicable. |  |
| 

`featureCount` \*

 | `number` | The number of feature definitions declared on the feature group. |  |
| 

`featureGroupName` \*

 | `string` | The name of the feature group. |  |
| 

`glueCatalog` \*

 | `string` **|** `null` | The Glue data catalog the offline store is registered in, which governs who can query the data through Athena. |  |
| 

`glueDatabase` \*

 | `string` **|** `null` | The Glue database containing the offline store table. |  |
| 

`glueTableName` \*

 | `string` **|** `null` | The Glue table exposing the offline store. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isCustomerManagedKeyEncrypted` \*

 | `boolean` | Whether at least one store is encrypted with a customer-managed KMS key. Both stores are always encrypted at rest with an AWS-managed key when this is false. |  |
| 

`isGlueTableCreationDisabled` \*

 | `boolean` | Whether automatic Glue table creation for the offline store is disabled. |  |
| 

`isOnlineStoreEnabled` \*

 | `boolean` | Whether a low-latency online serving store exists for this feature group. |  |
| 

`offlineStoreBlockedReason` \*

 | `string` **|** `null` | Why replication into the offline store is blocked, when applicable. |  |
| 

`offlineStoreKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the offline S3 store. Absence means an AWS-managed key is used, not that the store is unencrypted. |  |
| 

`offlineStoreResolvedS3Uri` \*

 | `string` **|** `null` | The resolved S3 prefix feature records physically land in. |  |
| 

`offlineStoreS3Uri` \*

 | `string` **|** `null` | The S3 URI the offline store writes feature records to. |  |
| 

`offlineStoreStatus` \*

 | `string` **|** `null` | Whether replication into the offline store is 'Active', 'Blocked' or 'Disabled'. A blocked store silently loses data. |  |
| 

`onlineStoreKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the online store. Absence means an AWS-managed key is used, not that the store is unencrypted. |  |
| 

`onlineStoreStorageType` \*

 | `string` **|** `null` | The storage backing the online store: 'Standard' or 'InMemory'. |  |
| 

`onlineStoreTotalSizeBytes` \*

 | `number` **|** `null` | The total size of the online store in bytes, i.e. the volume of data at risk. |  |
| 

`recordIdentifierFeatureName` \*

 | `string` **|** `null` | The name of the feature that uniquely identifies a record in the feature group. |  |
| 

`region` \*

 | `string` | The AWS region hosting the feature group. |  |
| 

`roleArn` \*

 | `string` **|** `null` | The IAM role Feature Store assumes to persist records into the offline S3 store. |  |
| 

`tableFormat` \*

 | `string` **|** `null` | The table format of the offline store: 'Default' (Glue) or 'Iceberg'. |  |
| 

`ttlDurationUnit` \*

 | `string` **|** `null` | The unit of the default online store record time-to-live: 'Seconds', 'Minutes', 'Hours', 'Days' or 'Weeks'. |  |
| 

`ttlDurationValue` \*

 | `number` **|** `null` | The value of the default online store record time-to-live, expressed in ttlDurationUnit. |  |

---

### Aws Sagemaker Model

`aws_sagemaker_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` |  |  |
| 

`containerCount` \*

 | `number` |  |  |
| 

`createdOn` \*

 | `number` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`executionRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`inferenceExecutionMode` \*

 | `string` **|** `null` |  |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isNetworkIsolationEnabled` \*

 | `boolean` |  |  |
| 

`modelName` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`primaryContainerHostname` \*

 | `string` **|** `null` |  |  |
| 

`primaryContainerImage` \*

 | `string` **|** `null` |  |  |
| 

`primaryContainerMode` \*

 | `string` **|** `null` |  |  |
| 

`primaryContainerModelDataUrl` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`vpcSubnets` \*

 | `array` **|** `null` |  |  |
| 

`webLink` \*

 | `string` |  |  |

---

### Aws Sagemaker Processing Job

`aws_sagemaker_processing_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the SageMaker processing job. |  |
| 

`endedOn` \*

 | `number` **|** `null` | The time processing ended, in milliseconds since the epoch. |  |
| 

`exitMessage` \*

 | `string` **|** `null` | An optional string the processing container wrote on exit, describing the outcome. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the processing job failed, when applicable. |  |
| 

`imageUri` \*

 | `string` **|** `null` | The container image registry path used to run the processing job. Custom or unvetted images are a supply-chain signal. |  |
| 

`instanceCount` \*

 | `number` **|** `null` | The number of ML compute instances used for processing. |  |
| 

`instanceType` \*

 | `string` **|** `null` | The ML compute instance type used for processing. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isInterContainerTrafficEncryptionEnabled` \*

 | `boolean` | Whether traffic between the nodes of a distributed processing job is encrypted in transit. |  |
| 

`isNetworkIsolationEnabled` \*

 | `boolean` | Whether the processing container is isolated from the network, preventing outbound calls from the container. |  |
| 

`outputKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the processing outputs written to S3. Absence means an AWS-managed key is used, not that the output is unencrypted. |  |
| 

`outputS3Uris` \*

 | `array` **|** `null` | The S3 URIs the processing job writes its outputs to. Processing jobs are a common bulk data egress path. |  |
| 

`processingJobName` \*

 | `string` | The name of the processing job. |  |
| 

`region` \*

 | `string` | The AWS region the processing job ran in. |  |
| 

`roleArn` \*

 | `string` **|** `null` | The IAM execution role assumed by the processing job to read input data and write results. |  |
| 

`startedOn` \*

 | `number` **|** `null` | The time processing started, in milliseconds since the epoch. |  |
| 

`volumeKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the ML storage volume attached to the processing instances. Absence means an AWS-managed key is used, not that the volume is unencrypted. |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` | The security group IDs applied to the processing containers inside the customer VPC. |  |
| 

`vpcSubnets` \*

 | `array` **|** `null` | The VPC subnet IDs the processing containers were attached to. Absent when the job ran outside a customer VPC. |  |

---

### Aws Sagemaker Training Job

`aws_sagemaker_training_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the SageMaker training job. |  |
| 

`checkpointS3Uri` \*

 | `string` **|** `null` | The S3 URI training checkpoints are written to — a second, frequently overlooked sink for training data. |  |
| 

`endedOn` \*

 | `number` **|** `null` | The time training ended, in milliseconds since the epoch. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the training job failed, when applicable. |  |
| 

`instanceCount` \*

 | `number` **|** `null` | The number of ML compute instances used for training. |  |
| 

`instanceType` \*

 | `string` **|** `null` | The ML compute instance type used for training. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isInterContainerTrafficEncryptionEnabled` \*

 | `boolean` | Whether traffic between the nodes of a distributed training job is encrypted in transit. |  |
| 

`isManagedSpotTrainingEnabled` \*

 | `boolean` | Whether the job used managed spot instances, which explains interruptions and availability gaps. |  |
| 

`isNetworkIsolationEnabled` \*

 | `boolean` | Whether the training container is isolated from the network, preventing outbound calls from the algorithm container. |  |
| 

`modelArtifactsS3Uri` \*

 | `string` **|** `null` | The S3 URI of the model artifacts actually produced by the training job. |  |
| 

`outputKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the model artifacts written to S3. Absence means an AWS-managed key is used, not that the output is unencrypted. |  |
| 

`outputS3Path` \*

 | `string` **|** `null` | The S3 path the training job writes its model artifacts to. |  |
| 

`region` \*

 | `string` | The AWS region the training job ran in. |  |
| 

`roleArn` \*

 | `string` **|** `null` | The IAM execution role assumed by the training job to read input data and write model artifacts. |  |
| 

`secondaryStatus` \*

 | `string` **|** `null` | The detailed job substatus, which distinguishes cases such as 'Interrupted' and 'MaxRuntimeExceeded'. |  |
| 

`startedOn` \*

 | `number` **|** `null` | The time training started, in milliseconds since the epoch. |  |
| 

`trainingImage` \*

 | `string` **|** `null` | The container image registry path used to train the model. Custom or unvetted images are a supply-chain signal. |  |
| 

`trainingJobName` \*

 | `string` | The name of the training job. |  |
| 

`volumeKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the ML storage volume attached to the training instances. Absence means an AWS-managed key is used, not that the volume is unencrypted. |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` | The security group IDs applied to the training containers inside the customer VPC. |  |
| 

`vpcSubnets` \*

 | `array` **|** `null` | The VPC subnet IDs the training containers were attached to. Absent when the job ran outside a customer VPC. |  |

---

### Aws Sagemaker Transform Job

`aws_sagemaker_transform_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the SageMaker batch transform job. |  |
| 

`dataCaptureDestinationS3Uri` \*

 | `string` **|** `null` | The S3 URI captured batch inference payloads are written to. |  |
| 

`dataCaptureKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting captured batch inference data. Absence means an AWS-managed key is used, not that the data is unencrypted. |  |
| 

`endedOn` \*

 | `number` **|** `null` | The time the transform job ended, in milliseconds since the epoch. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the transform job failed, when applicable. |  |
| 

`inputS3Uri` \*

 | `string` **|** `null` | The S3 URI of the dataset the transform job reads. |  |
| 

`instanceCount` \*

 | `number` **|** `null` | The number of ML compute instances used for the transform job. |  |
| 

`instanceType` \*

 | `string` **|** `null` | The ML compute instance type used for the transform job. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isDataCaptureEnabled` \*

 | `boolean` | Whether inference inputs and outputs are captured to S3. Batch data capture has no explicit enable flag — the presence of the capture configuration is the signal. |  |
| 

`modelName` \*

 | `string` | The name of the SageMaker model used for inference. The model carries the execution role, VPC and network isolation posture of the job. |  |
| 

`outputKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the inference results written to S3. Absence means an AWS-managed key is used, not that the output is unencrypted. |  |
| 

`outputS3Path` \*

 | `string` **|** `null` | The S3 path the transform job writes inference results to. |  |
| 

`region` \*

 | `string` | The AWS region the transform job ran in. |  |
| 

`startedOn` \*

 | `number` **|** `null` | The time the transform job started, in milliseconds since the epoch. |  |
| 

`transformJobName` \*

 | `string` | The name of the batch transform job. |  |
| 

`volumeKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the ML storage volume attached to the transform instances. Absence means an AWS-managed key is used, not that the volume is unencrypted. |  |

---

### Aws Secret

`aws_secret` inherits from [Secret](/data-model/schemas/Secret.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| `encryptionKeyRef` | `string` |  |  |
| `kmsKeyId` | `string` |  |  |
| `lastAccessedDate` | `number` |  |  |
| `lastChangedDate` | `number` |  |  |
| `lastRotatedDate` | `number` |  |  |
| `nextRotationDate` | `number` |  |  |
| `owningService` | `string` |  |  |
| `policyDocument` | `string` |  |  |
| `primaryRegion` | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| `replicationStatus` | `array` of `string`s |  |  |
| `rotateAutomaticallyAfterDays` | `number` |  |  |
| `rotationEnabled` | `boolean` |  |  |
| `rotationLambdaArn` | `string` |  |  |
| `rotationScheduleExpression` | `string` |  |  |
| `rotationWindow` | `string` |  |  |
| `versionIdsToStages` | `string` |  |  |

---

### Aws Secret Version

`aws_secret_version` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `lastAccessedDate` | `number` |  |  |
| 
`versionId` \*

 | `string` |  |  |
| `versionStages` | `array` of `string`s |  |  |

---

### Aws Securityhub Account

`aws_securityhub_account` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`controlFindingGenerator` \*

 | `string` **|** `null` |  |  |
| 

`isAutoEnableControlsEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isEnabled` \*

 | `boolean` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`subscribedOn` \*

 | `number` **|** `null` |  |  |

---

### Aws Securityhub Finding

`aws_securityhub_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `companyName` | `string` |  |  |
| `complianceStatus` | `string` |  |  |
| `confidence` | `number` |  |  |
| `criticality` | `number` |  |  |
| `generatorId` | `string` |  |  |
| `id` | `string` |  |  |
| `productArn` | `string` |  |  |
| `productName` | `string` |  |  |
| `recordState` | `string` |  |  |
| `region` | `string` |  |  |
| `remediationUrl` | `string` |  |  |
| `resourceIds` | `array` of `string`s |  |  |
| `resourceTypes` | `array` of `string`s |  |  |
| `sourceUrl` | `string` |  |  |
| `state` | `string` |  |  |
| `types` | `array` of `string`s |  |  |
| `workflowState` | `string` |  |  |
| `workflowStatus` | `string` |  |  |

---

### Aws Securityhub Finding

`aws_securityhub_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `companyName` | `string` |  |  |
| `complianceStatus` | `string` |  |  |
| `confidence` | `number` |  |  |
| `criticality` | `number` |  |  |
| `generatorId` | `string` |  |  |
| `id` | `string` |  |  |
| `productArn` | `string` |  |  |
| `productName` | `string` |  |  |
| `recordState` | `string` |  |  |
| `region` | `string` |  |  |
| `remediationUrl` | `string` |  |  |
| `resourceIds` | `array` of `string`s |  |  |
| `resourceTypes` | `array` of `string`s |  |  |
| `sourceUrl` | `string` |  |  |
| `state` | `string` |  |  |
| `types` | `array` of `string`s |  |  |
| `workflowState` | `string` |  |  |
| `workflowStatus` | `string` |  |  |

---

### Aws Servicecatalog Constraint

`aws_servicecatalog_constraint` inherits from [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`constraintId` \*

 | `string` | The ID of the Service Catalog constraint. |  |
| 

`constraintParameters` \*

 | `string` **|** `null` | The constraint parameters as a raw JSON string. Structure varies by constraint type. |  |
| 

`productId` \*

 | `string` **|** `null` | The ID of the product this constraint applies to, if product-specific. |  |
| 

`region` \*

 | `string` | AWS region where the constraint is defined. |  |
| 

`type` \*

 | `string` | The type of constraint (LAUNCH, NOTIFICATION, RESOURCE\_UPDATE, STACKSET, TEMPLATE, TAG). |  |

---

### Aws Servicecatalog Launch Path

`aws_servicecatalog_launch_path` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`constraintTypes` \*

 | `array` **|** `null` | The types of constraint applied along this launch path (e.g. LAUNCH, NOTIFICATION, TEMPLATE, STACKSET). The constraint descriptions are not duplicated here; they are carried on the corresponding aws\_servicecatalog\_constraint entities. |  |
| 

`pathId` \*

 | `string` | The ID of the launch path. |  |
| 

`region` \*

 | `string` | AWS region where the launch path is available. |  |

---

### Aws Servicecatalog Portfolio

`aws_servicecatalog_portfolio` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the Service Catalog portfolio. |  |
| 

`portfolioId` \*

 | `string` | The ID of the Service Catalog portfolio. |  |
| 

`providerName` \*

 | `string` **|** `null` | The name of the person or organization who owns the portfolio. |  |
| 

`region` \*

 | `string` | AWS region where the portfolio is defined. |  |

---

### Aws Servicecatalog Product

`aws_servicecatalog_product` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the Service Catalog product. |  |
| 

`distributor` \*

 | `string` **|** `null` | The distributor of the product. |  |
| 

`hasDefaultPath` \*

 | `boolean` **|** `null` | Whether the product has a default launch path. |  |
| 

`productId` \*

 | `string` | The ID of the Service Catalog product. |  |
| 

`region` \*

 | `string` | AWS region where the product is defined. |  |
| 

`supportDescription` \*

 | `string` **|** `null` | The support information about the product, as supplied by the administrator. |  |
| 

`supportEmail` \*

 | `string` **|** `null` | The email address of the support contact for the product. |  |
| 

`supportUrl` \*

 | `string` **|** `null` | The URL for product support. |  |
| 

`type` \*

 | `string` **|** `null` | The product type (e.g. CLOUD\_FORMATION\_TEMPLATE, TERRAFORM\_OPEN\_SOURCE). |  |

---

### Aws Servicecatalog Provisioning Artifact

`aws_servicecatalog_provisioning_artifact` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`artifactId` \*

 | `string` | The ID of the provisioning artifact. |  |
| 

`guidance` \*

 | `string` **|** `null` | The guidance for the provisioning artifact (DEFAULT or DEPRECATED). |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether this provisioning artifact is active. |  |
| 

`region` \*

 | `string` | AWS region where the provisioning artifact is defined. |  |
| 

`sourceRevision` \*

 | `string` **|** `null` | The source revision of the provisioning artifact. |  |
| 

`type` \*

 | `string` **|** `null` | The type of provisioning artifact (CLOUD\_FORMATION\_TEMPLATE, TERRAFORM\_OPEN\_SOURCE, etc.). |  |

---

### Aws Servicecatalog Tag Option

`aws_servicecatalog_tag_option` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isActive` \*

 | `boolean` **|** `null` | Whether this TagOption is active. |  |
| 

`key` \*

 | `string` | The TagOption key. |  |
| 

`region` \*

 | `string` | AWS region where the TagOption is defined. |  |
| 

`tagOptionId` \*

 | `string` | The ID of the TagOption. |  |
| 

`value` \*

 | `string` **|** `null` | The TagOption value. |  |

---

### Aws States State Machine

`aws_states_state_machine` inherits from [Function](/data-model/schemas/Function.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`availabilityZone` \*

 | `string` **|** `null` |  |  |
| 

`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`definition` \*

 | `string` **|** `null` |  |  |
| 

`description` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` **|** `null` |  |  |
| 

`encryptedkeyref` \*

 | `string` **|** `null` |  |  |
| 

`encryptionKmsDataKeyReusePeriodSeconds` \*

 | `number` **|** `null` |  |  |
| 

`encryptionKmsKeyId` \*

 | `string` **|** `null` |  |  |
| 

`encryptionType` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` |  |  |
| 

`isExecutionDataIncluded` \*

 | `boolean` **|** `null` |  |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isTracingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isVariableReferencesPresent` \*

 | `boolean` **|** `null` |  |  |
| 

`label` \*

 | `string` **|** `null` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`loggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`loggingLevel` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`revisionId` \*

 | `string` **|** `null` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`status` \*

 | `string` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |
| 

`variableReferencesCount` \*

 | `number` **|** `null` |  |  |

---

### Aws Storage Gateway File Share

`aws_storage_gateway_file_share` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`auditDestinationArn` \*

 | `null` **|** `string` |  |  |
| 

`authentication` \*

 | `null` **|** `string` |  |  |
| 

`clientList` \*

 | `null` **|** `array` |  |  |
| 

`defaultStorageClass` \*

 | `null` **|** `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`fileShareId` \*

 | `string` |  |  |
| 

`fileShareStatus` \*

 | `null` **|** `string` |  |  |
| 

`gatewayArn` \*

 | `string` |  |  |
| 

`isAccessBasedEnumeration` \*

 | `null` **|** `boolean` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isEncrypted` \*

 | `null` **|** `boolean` |  |  |
| 

`isLoggingEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`isReadOnly` \*

 | `null` **|** `boolean` |  |  |
| 

`isSmbAclEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`locationArn` \*

 | `null` **|** `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`protocol` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `null` **|** `string` |  |  |
| 

`squash` \*

 | `null` **|** `string` |  |  |

---

### Aws Storage Gateway Gateway

`aws_storage_gateway_gateway` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`availabilityZone` \*

 | `null` **|** `string` |  |  |
| 

`category` \*

 | `array` of `string`s |  |  |
| 

`cloudWatchLogGroupArn` \*

 | `null` **|** `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`ec2InstanceId` \*

 | `null` **|** `string` |  |  |
| 

`endpointType` \*

 | `null` **|** `string` |  |  |
| 

`function` \*

 | `array` of `string`s |  |  |
| 

`gatewayId` \*

 | `string` |  |  |
| 

`gatewayState` \*

 | `null` **|** `string` |  |  |
| 

`gatewayTimezone` \*

 | `null` **|** `string` |  |  |
| 

`gatewayType` \*

 | `string` |  |  |
| 

`hostEnvironment` \*

 | `null` **|** `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isLoggingEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`public` \*

 | `boolean` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`softwareVersion` \*

 | `null` **|** `string` |  |  |
| 

`vpcEndpoint` \*

 | `null` **|** `string` |  |  |
| 

`vpcId` \*

 | `null` **|** `string` |  |  |

---

### Aws Storage Gateway Tape

`aws_storage_gateway_tape` inherits from [DataStore](/data-model/schemas/DataStore.md), [Backup](/data-model/schemas/Backup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`completedOn` \*

 | `null` **|** `number` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`gatewayArn` \*

 | `null` **|** `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isArchived` \*

 | `null` **|** `boolean` |  |  |
| 

`isEncrypted` \*

 | `null` **|** `boolean` |  |  |
| 

`isWorm` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`poolId` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`tapeBarcode` \*

 | `string` |  |  |
| 

`tapeSizeInBytes` \*

 | `null` **|** `number` |  |  |
| 

`tapeStatus` \*

 | `string` |  |  |
| 

`tapeUsedInBytes` \*

 | `null` **|** `number` |  |  |

---

### Aws Storage Gateway Tape Pool

`aws_storage_gateway_tape_pool` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`poolId` \*

 | `string` |  |  |
| 

`poolStatus` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`retentionLockTimeInDays` \*

 | `null` **|** `number` |  |  |
| 

`retentionLockType` \*

 | `null` **|** `string` |  |  |
| 

`storageClass` \*

 | `null` **|** `string` |  |  |

---

### Aws Storage Gateway Volume

`aws_storage_gateway_volume` inherits from [DataStore](/data-model/schemas/DataStore.md), [Disk](/data-model/schemas/Disk.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`gatewayArn` \*

 | `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isChapEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`isEncrypted` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`targetArn` \*

 | `null` **|** `string` |  |  |
| 

`volumeDiskId` \*

 | `null` **|** `string` |  |  |
| 

`volumeId` \*

 | `string` |  |  |
| 

`volumeSizeInBytes` \*

 | `null` **|** `number` |  |  |
| 

`volumeStatus` \*

 | `null` **|** `string` |  |  |
| 

`volumeType` \*

 | `string` |  |  |
| 

`volumeUsedInBytes` \*

 | `null` **|** `number` |  |  |

---

### Aws Vpc Lattice Listener

`aws_vpc_lattice_listener` inherits from [NetworkEndpoint](/data-model/schemas/NetworkEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`createdAt` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lastUpdatedAt` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`port` \*

 | `number` **|** `null` |  |  |
| 

`protocol` \*

 | `string` **|** `null` |  | **Any of**:

-   `HTTP`

-   `HTTPS`

-   `TLS_PASSTHROUGH`

-   `undefined`

 |
| 

`region` \*

 | `string` |  |  |
| 

`serviceArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Vpc Lattice Listener Rule

`aws_vpc_lattice_listener_rule` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`createdAt` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isDefault` \*

 | `boolean` **|** `null` |  |  |
| 

`lastUpdatedAt` \*

 | `string` **|** `null` |  |  |
| 

`listenerArn` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`priority` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceArn` \*

 | `string` **|** `null` |  |  |
| 

`statusCode` \*

 | `number` **|** `null` |  |  |
| 

`targetGroupIdentifiers` \*

 | `array` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  | **Any of**:

-   `ForwardMember`

-   `FixedResponseMember`

-   `undefined`

 |

---

### Aws Vpc Lattice Service

`aws_vpc_lattice_service` inherits from [ApplicationEndpoint](/data-model/schemas/ApplicationEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`customDomainName` \*

 | `string` **|** `null` |  |  |
| 

`domainName` \*

 | `string` **|** `null` |  |  |
| 

`hostedZoneId` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Vpc Lattice Service Network

`aws_vpc_lattice_service_network` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`createdAt` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lastUpdatedAt` \*

 | `string` **|** `null` |  |  |
| 

`numberOfAssociatedResourceConfigurations` \*

 | `number` **|** `null` |  |  |
| 

`numberOfAssociatedServices` \*

 | `number` **|** `null` |  |  |
| 

`numberOfAssociatedVPCs` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Vpc Lattice Target Group

`aws_vpc_lattice_target_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`createdAt` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`ipAddressType` \*

 | `string` **|** `null` |  | **Any of**:

-   `IPV4`

-   `IPV6`

-   `undefined`

 |
| 

`lambdaEventStructureVersion` \*

 | `string` **|** `null` |  | **Any of**:

-   `V1`

-   `V2`

-   `undefined`

 |
| 

`lastUpdatedAt` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`port` \*

 | `number` **|** `null` |  |  |
| 

`protocol` \*

 | `string` **|** `null` |  | **Any of**:

-   `NOT_SET`

-   `HTTP`

-   `HTTPS`

-   `TCP`

-   `undefined`

 |
| 

`region` \*

 | `string` |  |  |
| 

`serviceArns` \*

 | `array` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  | **Any of**:

-   `NOT_SET`

-   `ACTIVE`

-   `CREATE_FAILED`

-   `CREATE_IN_PROGRESS`

-   `DELETE_FAILED`

-   `DELETE_IN_PROGRESS`

-   `undefined`

 |
| 

`type` \*

 | `string` **|** `null` |  | **Any of**:

-   `NOT_SET`

-   `ALB`

-   `INSTANCE`

-   `IP`

-   `LAMBDA`

-   `undefined`

 |
| 

`vpcIdentifier` \*

 | `string` **|** `null` |  |  |

---

### Aws Waf V2 Ip Set

`aws_waf_v2_ip_set` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `addresses` | `array` of `string`s |  |  |
| `arn` | `string` |  |  |
| `description` | `string` |  |  |
| `id` | `string` |  |  |
| `ipAddressVersion` | `string` |  | **Any of**:
-   `IPV4`

-   `IPV6`

 |
| `region` | `string` |  |  |

---

### Aws Waf V2 Rule Group

`aws_waf_v2_rule_group` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `capacity` | `number` |  |  |
| `description` | `string` |  |  |
| `id` | `string` |  |  |
| `isVisibilityConfigCloudWatchMetricsEnabled` | `boolean` |  |  |
| `isVisibilityConfigSampledRequestsEnabled` | `boolean` |  |  |
| `labelNamespace` | `string` |  |  |
| `region` | `string` |  |  |
| `ruleCount` | `number` |  |  |
| `scope` | `string` |  |  |
| `visibilityConfigMetricName` | `string` |  |  |
| `webLink` | `string` |  |  |

---

## Release Notes

-   **2026-08-10** — Added the KMS key ARN used for server-side encryption to Database Migration Service S3-type endpoint entities.
-   **2026-08-10** — Tags on AppConfig applications, environments, deployment strategies, configuration profiles, and deployments, along with Backup vaults, restore testing plans, and IAM Roles Anywhere trust anchors and profiles, are now ingested as queryable properties.
-   **2026-08-04** — Added support for AWS EC2 Image Builder, ingesting pipelines, images, components, recipes, distribution configurations, infrastructure configurations, lifecycle policies, and workflows as queryable entities.
-   **2026-07-31** — Tags on Cloud Map namespaces and services are now ingested as queryable properties.
-   **2026-07-28** — OpenSearch and Elasticsearch domains now expose mapped relationships to cross-account AWS principals defined in their access policies.
-   **2026-07-28** — Enhanced GuardDuty data model to include organization configuration details, delegated administrator accounts, and publishing destinations as ingested entities.
-   **2026-07-28** — Added support for AWS EventBridge resources, ingesting event buses, archives, connections, API destinations, and endpoints as queryable entities.
-   **2026-07-27** — Identity Center users and groups are now linked to the member accounts they are assigned access to.
-   **2026-07-23** — Tags are now ingested for API Gateway domain names, API Gateway V2 stages, Batch job definitions, Batch job queues, Batch compute environments, EC2 key pairs, GuardDuty detectors, IAM SAML providers, Network Manager resources, and Redshift cluster parameter groups.
-   **2026-07-22** — RDS clusters now include database insights mode, monitoring interval, monitoring role ARN, and Performance Insights configuration as queryable properties.
-   **2026-07-21** — Docker image tags on ECR images are now ingested as queryable properties.
-   **2026-07-21** — Added support for AWS AppConfig, including applications, environments, deployment strategies, configuration profiles, deployments, and hosted configuration versions.
-   **2026-07-20** — Added Neptune Analytics graph snapshots, export tasks, import tasks, and VPC endpoint connections.
-   **2026-07-20** — Added support for AWS CodeArtifact, including domains, repositories, and packages with permission policy relationships.
-   **2026-07-17** — Added EMR security configurations as queryable entities, with relationships to clusters and VPC endpoints.
-   **2026-07-17** — CloudWatch Event Rule targets (Lambda functions, SNS topics, SQS queues, Step Functions, Kinesis streams, ECS clusters, CodePipeline pipelines, and Firehose delivery streams) are now linked to their rules via mapped relationships.
-   **2026-07-17** — Added AWS Inspector v2 filter and configuration entities, with relationships to KMS keys and VPC endpoints.
-   **2026-07-15** — S3 buckets now include CloudTrail object-level logging status, including whether read and write logging is enabled.
-   **2026-07-07** — ECR image finding ingestion now supports filters for minimum severity and maximum scan age, reducing noise from stale or low-priority findings.
-   **2026-06-17** — S3 bucket lifecycle rules are now ingested as queryable entities, linked to their parent buckets.
-   **2026-06-10** — Security Hub findings ingestion now supports a configurable time window and allows specific workflow statuses to be excluded.
-   **2026-06-03** — ECS task definitions now include resource tags.
-   **2026-04-29** — Security group ingress and egress rules are now stored as structured JSON properties, enabling rule-level querying on firewall entities.
-   **2026-04-08** — Added optional configuration to automatically delete child integration instances when they are no longer needed in AWS Organizations.
-   **2026-04-07** — Added Bedrock AgentCore Agent Runtime ingestion, enabling visibility into deployed agent runtime environments.
-   **2026-03-25** — Added AWS Detective data model, ingesting investigation graphs and member accounts as new entity types.
-   **2026-03-24** — Added ingestion of received and marketplace licenses from AWS License Manager as additional license entity types.
-   **2026-03-19** — Added AWS Transit Gateway route tables and attachments as new entity types, enabling routing configuration visibility across VPC environments.
-   **2026-03-19** — Added Audit Manager settings, delegation status, and KMS key relationships to the Audit Manager service entity.
-   **2026-03-18** — Added AWS X-Ray data model, ingesting sampling rules and groups as new entity types.
-   **2026-03-18** — Promoted EKS cluster authentication mode to cluster entities, exposing the access configuration mode for each cluster.
-   **2026-03-17** — Added AWS Neptune Database & Analytics integration, ingesting Neptune clusters, instances, and serverless resources.
-   **2026-03-11** — Added target group ARNs and load balancer names properties to Auto Scaling group entities.
-   **2026-03-11** — Promoted raw data properties for AWS Transfer Server, Shared Image, and related entities.
-   **2026-03-03** — Extended AWS Athena data model with additional workgroup, data catalog, and named query properties.
-   **2026-02-26** — Added AWS DevOps Guru integration, ingesting anomalies and insights as queryable entities.
-   **2026-02-20** — Added Secrets Manager secret versions as ingested entities, linking each version to its parent secret.
-   **2026-02-20** — Added DKIM signing enabled status and DKIM status properties to SES identity entities, surfacing DKIM signing configuration.
-   **2026-02-20** — Added creation and last-updated timestamps to WorkSpaces bundle entities.
-   **2026-02-20** — Added rule names property to WAFv2 web ACL entities listing all configured WAF v2 rule names; added Kerberos configured and cross-realm trust configured properties to EMR cluster entities.
-   **2026-02-20** — Added multi-AZ property to DMS replication instance entities; added Kerberos realm and AD domain join user properties to EMR cluster entities for Kerberos authentication details.
-   **2026-02-16** — Added AWS Managed Grafana data model, ingesting Grafana workspaces as new entity types.
-   **2026-02-16** — Added AWS Storage Gateway integration, ingesting gateways, file shares, and volumes.
-   **2026-02-12** — Added AWS CodeGuru integration, ingesting CodeGuru Reviewer and Profiler resources.
-   **2026-02-12** — Added KMS key ID, encryption, SMTP SSL, and SMTP port properties to Managed Workflows for Apache Airflow environment entities.
-   **2026-02-09** — Added VPC settings and connect settings parameters to Directory Service directory entities, exposing VPC and AD Connector configurations.
-   **2026-02-06** — Added AWS CodeDeploy integration, ingesting deployment groups, deployments, and applications.
-   **2026-02-04** — Added AWS License Manager integration, ingesting license configurations and received/marketplace licenses as new entity types.
-   **2026-01-27** — Added AWS Bedrock AgentCore Code Interpreter support, ingesting sandbox environments for Bedrock agent execution.
-   **2026-01-13** — Promoted encryption disabled property on CodeBuild project entities.
-   **2025-12-17** — Added ingestion of WAF rule group rules, exposing individual rules within AWS WAF rule groups.
-   **2025-12-11** — Added AWS Cloud Map integration, ingesting namespaces and services as queryable entities.
-   **2025-12-10** — Added WAF rule groups and WAFv2 web ACL to rule group relationships.
-   **2025-12-05** — Promoted additional CloudFront distribution properties including cache behavior and origin settings.
-   **2025-11-21** — Added Amazon DataSync data model, ingesting tasks, locations, and agents as new entity types.
-   **2025-11-14** — Added configuration option to ingest deprecated EC2 AMI images alongside current images.
-   **2025-10-31** — Promoted account state property to AWS account entities, reflecting account suspension or active status.
-   **2025-10-31** — Added mapped relationship from AWS accounts to AMIs owned by the account.
-   **2025-10-27** — Added relationships from API Gateway stages to associated CloudWatch log groups.
-   **2025-10-24** — Added ingestion of EKS cluster version information including Kubernetes version and platform version.
-   **2025-10-14** — Promoted deletion protection enabled property on DynamoDB table entities.
-   **2025-10-14** — Promoted lifecycle delete after days property on Backup recovery point entities.
-   **2025-10-02** — Promoted scheduled deletion date to KMS key entities.
-   **2025-09-24** — Promoted delivery stream configuration parameters to Firehose delivery stream entities.
-   **2025-09-22** — Added AWS account tag retrieval for non-management member accounts.
-   **2025-09-19** — Added additional parameter group parameters property to RDS parameter group entities.
-   **2025-09-12** — Added RDS CloudWatch logging metrics (read/write IOPS, latency, throughput) to RDS database instance entities.
-   **2025-09-10** — Added EKS cluster to IAM OIDC provider trust relationship, linking EKS clusters to their OIDC identity providers.
-   **2025-09-10** — Promoted CPU architecture property to ECS task entities.
-   **2025-09-08** — Added AWS Audit Manager integration, ingesting frameworks, assessments, and controls.
-   **2025-09-05** — Added AWS Resource Access Manager (RAM) integration, ingesting resource shares and associations.
-   **2025-09-04** — Added opt-in configuration to fetch tags for AWS Backup recovery points.
-   **2025-09-04** — Added Backup resource to Config Rule relationships, linking backup-protected resources to their Config Rules.
-   **2025-09-02** — Enhanced EMR integration with additional cluster properties including security configuration and step details.
-   **2025-08-26** — Added ingestion of CloudWatch Log Metric Filters as new entity types.
-   **2025-08-26** — Added AWS SageMaker models ingestion, relating models to SageMaker domains.
-   **2025-08-25** — Added ingestion of Redshift DataShares for both provisioned and serverless clusters.
-   **2025-08-25** — Added Security Hub account entity to represent accounts where Security Hub is enabled.
-   **2025-08-22** — Added contact information properties from the account contact information API to AWS account entities.
-   **2025-08-13** — Added expiration and upload timestamp properties to IAM signing certificate entities.
-   **2025-08-11** — Added tiered storage metrics to S3 bucket entities, including total, standard tier, intelligent tiering, archival, and cold storage bytes for cross-tier capacity visibility.
-   **2025-08-07** — Added proper entity class to CloudFront distribution entities, improving classification consistency in the data model.
-   **2025-08-06** — Added IAM Roles Anywhere integration, ingesting trust anchors and profiles as new entity types.
-   **2025-08-05** — Added CloudWatch metrics ingestion, including custom metrics and metric streams.
-   **2025-08-04** — Added support for Valkey as a Redis-compatible engine in ElastiCache classification.
-   **2025-07-30** — Added AWS Step Functions integration, ingesting state machines and executions.
-   **2025-07-28** — Added ingestion of EC2 Dedicated Hosts as new entity types.
-   **2025-07-18** — Added Bedrock evaluation jobs and custom model jobs as new entity types.
-   **2025-07-18** — Added tag retrieval for IAM Identity Center permission sets.
-   **2025-07-16** — Added OpenSearch domain properties and additional ingestion fields to OpenSearch domain entities.
-   **2025-07-16** — Added image allowed and additional security properties (including public access indicators) to AMI entities.
-   **2025-07-09** — Added ingestion of AWS Organizations tag policies as new entity types.
-   **2025-07-08** — Added Config Rule finding entity type for Config Rule evaluation findings.
-   **2025-07-02** — Added entity class and display name to AWS Backup recovery point entities, improving discoverability and classification.
-   **2025-07-02** — Added ingestion of shared EBS/RDS snapshots across accounts.
-   **2025-07-01** — Added VPN connection ingestion, relating VPN connection entities to customer gateways and virtual private gateways.
-   **2025-07-01** — Added ACM certificate to Cognito user pool protection relationship, linking ACM certificates to Cognito user pools.
-   **2025-06-18** — Added risk configuration properties to Cognito user pool entities including advanced security settings.
-   **2025-06-05** — Added AWS Config Rule resource relationships, linking Config Rules to the AWS resources they evaluate.
-   **2025-06-03** — Added Cognito Identity Pools as new entity types with user pool relationships.
-   **2025-05-15** — Added WAFv2 IP sets as new entity types related to WAF rules.
-   **2025-05-14** — Added improvements to AWS SSO including account assignment relationships.
-   **2025-05-14** — Added GuardDuty detector data source properties exposing which data sources are enabled.
-   **2025-05-13** — Added API Gateway stage method setting entity type for stage method-level settings.
-   **2025-05-13** — Added AWS-managed prefix lists to the EC2 prefix list map, enabling security group and route table relationships to reference managed prefix lists alongside customer-managed ones.
-   **2025-05-12** — Added Cognito user pool clients and user pool users ingestion.
-   **2025-05-12** — Added entity class and display name to S3 bucket target entities used in CloudFront distribution relationships.
-   **2025-05-07** — Added additional AWS resource relationships including subnet-to-NAT-gateway, NLB-to-security-group, and more.
-   **2025-04-24** — Added policy document property to AWS OpenSearch access policy entities.
-   **2025-04-18** — Promoted device and attach time properties on EC2 instance to EBS volume relationships.
-   **2025-04-15** — Added SES as a distinct ingestion source for filtering and cost attribution.
-   **2025-04-14** — Added VPC Lattice service entities (services, service networks, target groups).
-   **2025-04-14** — Added EKS cluster to KMS key relationships for EKS clusters that use KMS encryption.
-   **2025-04-08** — Added IP addresses (from availability zone mappings) to ALB, NLB, and ELB load balancer entities.
-   **2025-04-02** — Added tag ingestion for AWS KMS keys, exposing KMS key tags as queryable properties.
-   **2025-04-02** — Added properties to Route 53 Resolver firewall rule entities including domain list and action details.

---

Source: /integrations/directory/azure

# Azure

Visualize and map Azure cloud resources, and monitor changes through queries and alerts.

## Installation

To install this integration, you will need to configure settings both within Azure and on JupiterOne. Before enabling in JupiterOne, ensure that you have completed the setup within your Azure.

### Azure configuration

To set up this integration, you will need to authorize access by creating a Service Principal (App Registration) in Azure and provide the credentials to JupiterOne.

The integration is triggered by an event containing the information for a specific integration instance. Users configure the integration by providing API credentials obtained through the Azure portal.

Microsoft Entra ID is authenticated and accessed through the [Microsoft Graph API](https://learn.microsoft.com/en-us/graph/auth-v2-service). Azure Resource Manager is authenticated and accessed through [Resource Manager APIs](https://learn.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-api-authentication).

#### Creating the App Registration in Azure

The first step will be to create your App registration in Azure. From your [Azure portal](https://portal.azure.com/), navigate to **Microsoft Entra ID > Manage > App registrations** and continue through the following steps:

1.  Create a new App registration, using the **Name** `JupiterOne`, selecting **Accounts in this organizational directory only**, with **_no_** "Redirect URI".
2.  With the app created, navigate to the new app's **Overview** page.
3.  Copy both the **Application (client) ID** and the **Directory (tenant) ID**.
4.  Navigate to the **Certificates & secrets** section.
5.  Create a new client secret.
6.  Save and copy the generated secret **Value** (not the **Secret ID**).

With the App created, and the values saved, you will next need to configure the API permissions within Microsoft Entra ID.

#### API Permissions

To grant permissions for reading the Microsoft Graph information:

1.  Navigate to API permissions, select **Microsoft Graph > Application Permissions**
2.  Grant the following permission to the application:

-   `Directory.Read.All`
-   `Policy.Read.All`
-   `AuditLog.Read.All`
-   `Device.Read.All`
-   `EntitlementManagement.Read.All`
-   `Policy.Read.ConditionalAccess`

3.  Grant admin consent for this directory for the permissions above.

#### IAM Roles (Azure Management Groups / Subscriptions)

The next step within Azure is granting the `JupiterOne Reader` RBAC subscription role to read Azure Resource Manager information.

To grant the role:

1.  Navigate to the correct scope for your integration.

-   **RECOMMENDED** _If configuring all subscription for a tenant:_ Navigate to Management Groups > the Tenant Root Group.
    
    > If it is not possible to select the Tenant Root Group first navigate to Microsoft Entra ID > Manage > Properties and select **Yes** on **Access management for Azure resources**. See this [elevating access article](https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin) for more information.
    

> **NOTE**
> 
> If using this feature, in JupiterOne on your integration instance, enable the following flags:
> 
> -   Ingest Microsoft Entra ID
> -   Configure Subscription Instances
>     -   Auto-Delete Removed Subscriptions
>         
>         > _If configuring a single Azure Subscription:_ Navigate to **Subscriptions** and choose the subscription from which you want to ingest resources. Please fill the **Subscription ID** field in your integration instance. In Azure, to get the Subscription ID navigate to **Subscriptions** and Copy the ID of the one to be ingested.
>         

2.  Create the custom role "JupiterOne Reader"
3.  Navigate to **Access control (IAM) > Add > Add custom role**.
4.  Input `JupiterOne Reader` for the **Name**.
5.  Navigate to the **JSON** tab, select **Edit**, and input the following _actions_:

Actions to be added

"Microsoft.Advisor/recommendations/read", "Microsoft.ApiManagement/service/apis/read", "Microsoft.ApiManagement/service/read", "Microsoft.Authorization/classicAdministrators/read", "Microsoft.Authorization/locks/read", "Microsoft.Authorization/policyAssignments/read", "Microsoft.Authorization/policyDefinitions/read", "Microsoft.Authorization/policySetDefinitions/read", "Microsoft.Authorization/roleAssignments/read", "Microsoft.Authorization/roleDefinitions/read", "Microsoft.Automation/automationAccounts/read", "Microsoft.Batch/batchAccounts/applications/read", "Microsoft.Batch/batchAccounts/certificates/read", "Microsoft.Batch/batchAccounts/pools/read", "Microsoft.Batch/batchAccounts/read", "Microsoft.BotService/botServices/read", "Microsoft.BotService/botServices/channels/read", "Microsoft.Cache/redis/firewallRules/read", "Microsoft.Cache/redis/linkedServers/read", "Microsoft.Cache/redis/read", "Microsoft.Cdn/profiles/endpoints/read", "Microsoft.Cdn/profiles/read", "Microsoft.CognitiveServices/accounts/read", "Microsoft.Compute/disks/read", "Microsoft.Compute/galleries/images/read", "Microsoft.Compute/galleries/images/versions/read", "Microsoft.Compute/galleries/read", "Microsoft.Compute/images/read", "Microsoft.Compute/virtualMachines/extensions/read", "Microsoft.Compute/virtualMachines/read", "Microsoft.Compute/virtualMachineScaleSets/read", "Microsoft.Consumption/usageDetails/read", "Microsoft.ContainerInstance/containerGroups/read", "Microsoft.ContainerRegistry/registries/read", "Microsoft.ContainerRegistry/registries/webhooks/read", "Microsoft.ContainerService/managedClusters/maintenanceConfigurations/read", "Microsoft.ContainerService/managedClusters/read", "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read", "Microsoft.DBforMariaDB/servers/databases/read", "Microsoft.DBforMariaDB/servers/read", "Microsoft.DBforMySQL/flexibleServers/databases/read", "Microsoft.DBforMySQL/flexibleServers/firewallRules/read", "Microsoft.DBforMySQL/flexibleServers/read", "Microsoft.DBforMySQL/servers/databases/read", "Microsoft.DBforMySQL/servers/firewallRules/read", "Microsoft.DBforMySQL/servers/read", "Microsoft.Databricks/workspaces/read", "Microsoft.DataProtection/backupVaults/read", "Microsoft.DBforPostgreSQL/flexibleServers/databases/read", "Microsoft.DBforPostgreSQL/flexibleServers/firewallRules/read", "Microsoft.DBforPostgreSQL/flexibleServers/read", "Microsoft.DBforPostgreSQL/servers/databases/read", "Microsoft.DBforPostgreSQL/servers/firewallRules/read", "Microsoft.DBforPostgreSQL/servers/read", "Microsoft.Devices/iotHubs/Read", "Microsoft.DocumentDB/databaseAccounts/read", "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/read", "Microsoft.Easm/workspaces/read", "Microsoft.EventGrid/domains/read", "Microsoft.EventGrid/domains/topics/eventSubscriptions/read", "Microsoft.EventGrid/domains/topics/read", "Microsoft.EventGrid/topics/eventSubscriptions/read", "Microsoft.EventGrid/topics/read", "Microsoft.EventHub/clusters/read", "Microsoft.EventHub/namespaces/eventHubs/consumergroups/read", "Microsoft.EventHub/namespaces/eventhubs/read", "Microsoft.EventHub/namespaces/read", "Microsoft.Insights/ActivityLogAlerts/Read", "Microsoft.Insights/DiagnosticSettings/Read", "Microsoft.Insights/LogProfiles/Read", "Microsoft.KeyVault/managedHSMs/read", "Microsoft.KeyVault/vaults/keys/read", "Microsoft.KeyVault/vaults/read", "Microsoft.KeyVault/vaults/secrets/read", "Microsoft.MachineLearningServices/workspaces/read", "Microsoft.MachineLearningServices/workspaces/computes/read", "Microsoft.Management/managementGroups/read", "Microsoft.Network/applicationGateways/read", "Microsoft.Network/applicationSecurityGroups/read", "Microsoft.Network/azurefirewalls/read", "Microsoft.Network/bastionHosts/read", "Microsoft.Network/bgpServiceCommunities/read", "Microsoft.Network/ddosProtectionPlans/read", "Microsoft.Network/dnszones/read", "Microsoft.Network/dnszones/recordsets/read", "Microsoft.Network/expressRouteCircuits/peerings/connections/read", "Microsoft.Network/expressRouteCircuits/peerings/peerConnections/read", "Microsoft.Network/expressRouteCircuits/read", "Microsoft.Network/firewallPolicies/Read", "Microsoft.Network/firewallPolicies/ruleCollectionGroups/Read", "Microsoft.Network/frontDoors/read", "Microsoft.Network/loadBalancers/read", "Microsoft.Network/natGateways/read", "Microsoft.Network/networkInterfaces/read", "Microsoft.Network/networkSecurityGroups/read", "Microsoft.Network/networkWatchers/flowLogs/read", "Microsoft.Network/networkWatchers/read", "Microsoft.Network/privateDnsZones/read", "Microsoft.Network/privateDnsZones/recordsets/read", "Microsoft.Network/privateEndpoints/read", "Microsoft.Network/publicIPAddresses/read", "Microsoft.Network/virtualNetworks/read", "Microsoft.PolicyInsights/policyStates/queryResults/read", "Microsoft.RecoveryServices/vaults/read", "Microsoft.Resources/subscriptions/locations/read", "Microsoft.Resources/subscriptions/read", "Microsoft.Resources/subscriptions/resourceGroups/read", "Microsoft.Security/alerts/read", "Microsoft.Security/assessments/read", "Microsoft.Security/autoProvisioningSettings/read", "Microsoft.Security/iotSecuritySolutions/read", "Microsoft.Security/pricings/read", "Microsoft.Security/securityContacts/read", "Microsoft.Security/settings/read", "Microsoft.ServiceBus/namespaces/queues/read", "Microsoft.ServiceBus/namespaces/read", "Microsoft.ServiceBus/namespaces/topics/read", "Microsoft.ServiceBus/namespaces/topics/subscriptions/read", "Microsoft.Sql/managedInstances/administrators/read", "Microsoft.Sql/managedInstances/databases/read", "Microsoft.Sql/managedInstances/read", "Microsoft.Sql/servers/administrators/read", "Microsoft.Sql/servers/databases/read", "Microsoft.Sql/servers/firewallRules/read", "Microsoft.Sql/servers/read", "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action", "Microsoft.Storage/storageAccounts/blobServices/containers/read", "Microsoft.Storage/storageAccounts/blobServices/read", "Microsoft.Storage/storageAccounts/fileServices/read", "Microsoft.Storage/storageAccounts/fileServices/shares/read", "Microsoft.Storage/storageAccounts/listKeys/action", "Microsoft.Storage/storageAccounts/queueServices/read", "Microsoft.Storage/storageAccounts/read", "Microsoft.Storage/storageAccounts/tableServices/read", "Microsoft.Storage/storageAccounts/tableServices/tables/read", "Microsoft.Subscription/policies/read", "Microsoft.Synapse/workspaces/keys/read", "Microsoft.Synapse/workspaces/read", "Microsoft.Synapse/workspaces/sqlPools/dataMaskingPolicies/read", "Microsoft.Synapse/workspaces/sqlPools/dataMaskingPolicies/rules/read", "Microsoft.Synapse/workspaces/sqlPools/read", "Microsoft.Web/serverfarms/Read", "Microsoft.Web/sites/config/list/action", "Microsoft.Web/sites/config/Read", "Microsoft.Web/sites/functions/read", "Microsoft.Web/sites/Read",

Data Actions to be added

"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"

4.  Click **Save > Review + Create > Create**.
    
5.  Assign Roles to the "JupiterOne" App:
    
    1.  Navigate to **Access control (IAM) > Add > Add role assignment**
    2.  Assign the `JupiterOne Reader` role to the JupiterOne member.
    3.  Navigate to the **Member** tab. Click on **\+ Select Members**, search for the JupiterOne App, click it, and then press **Select**.
    4.  Navigate to the **Review + assign** tab and click **Review + assign**.

#### Key Vaults

_Note:_ Azure allows two ways of retrieving vaults.

1.  If using **Key Vault RBAC**: Repeat step 5 but assing the built-in "Key Vault Reader" Role to your JupiterOne App.
    
2.  If using **Key Vault Access Policy**:
    

The final step in Azure will be granting JupiterOne permissions for the vault keys and secrets (`rm-keyvault-keys` and `rm-keyvault-secrets`).

> **NOTE**
> 
> You are required to grant the permissions to the JupiterOne security principal for each key vault in your account. [Learn more on Azure for assigning a key vault access policy](https://go.microsoft.com/fwlink/?linkid=2125287)

To grant the permissions:

1.  Navigate to **Key Vaults** and select the one you wish to ingest.
2.  Click **Access policies**, then **\+ Create**
3.  On the **Permissions** tab, under **Key permissions** and **Secret Permissions**, select the permissions.

-   Key Permissions
    -   Key Management Operations
        -   List
-   Secret Permissions
    -   Key Management Operations
        -   List

4.  On the Principal tab, assign them to the JupiterOne App.
5.  Navigate to the **Review + Create** tab and click **Create**.

That concludes the setup from within Azure. The last thing to do is initiate the integration from within JupiterOne!

## Data Volume Configuration

Control how much data is ingested from Azure to manage storage and processing.

### Ingestion Windows (Time Ranges)

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Active Device Window** | Maximum number of days in the past a device can be active to be eligible for ingestion. Devices with activity older than this threshold will be excluded. | 30 | 30, 90, 365 days, No limit |

**How it affects data volume:** A longer active device window increases the number of device entities ingested. Setting "No limit" ingests all devices regardless of last activity date.

### Data Filtering Options

| Field | Description | Default |
| --- | --- | --- |
| **Included Defender for cloud Alert Severities** | Select which Defender for Cloud alert severity levels to ingest. | High, Medium |
| **Container Registry Exclude List** | Comma-separated list of container registry names to exclude from repository ingestion. Registries listed here are skipped when the Container registry repositories ingestion source is enabled. | _(none — all registries included)_ |

**How it affects data volume:** Severity filtering reduces Defender alert entities by excluding lower-severity alerts. The Container Registry Exclude List reduces repository ingestion for specific registries.

### Advanced Configuration

| Field | Description | Default |
| --- | --- | --- |
| **Advisor Recommendation Extended Properties to Promote** | A list of Azure Advisor recommendation property names to surface as top-level properties on ingested recommendation entities. Each key is automatically converted to camelCase. Example: `assessmentKey`, `score`, `snake_case_key`. | _(none)_ |

## Configuration in JupiterOne

To add the Azure integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Azure. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Azure account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Azure **Directory (tenant) ID** of the Entra ID to target the Azure API requests.
    
-   The **Application (client) ID** created for JupiterOne and used to authenticate with Azure.
    
-   Enable **Ingest Microsoft Entra ID** to ingest Directory information.
    
    > **NOTE**
    > 
    > The **Ingest Microsoft Entra ID** flag enables the ingestion of `azure_user`, `azure_user_group`, and `azure_service_principal` entities.
    > 
    > This should only be enabled for one integration instance per directory.
    
-   Configure the **Subscription Instances** for your integration:
    
    -   **RECOMMENDED** _If configuring all subscriptions for a tenant_: Select the option **Configure Subscription Instances** to automatically provision new JupiterOne integration instances for each Azure Subscription in this tenant that does not have a "JupiterOne" tag set to `SKIP`. It is recommended that you use this feature when **Ingest Microsoft Entra ID** selected.
    -   _If configuring a single Azure Subscription_: Enter the **Subscription ID** for the subscription you wish to ingest data from. In Azure, to get the Subscription ID, navigate to **Subscriptions** and copy the desired Subscription ID.
    
    With **Configure Subscription Instances** enabled, the following additional options are available:
    
    -   **Auto-delete Removed Subscriptions** — when enabled, automatically deletes JupiterOne integration instances for subscriptions that have been deleted or removed from Azure. Disabled by default.
    -   **Ingest disabled subscriptions** — when enabled, ingests subscriptions that are in a `disabled` state. Disabled by default.
    -   **Auto-delete Child Integrations** — when enabled, automatically deletes child integration instances when the parent integration for this directory is deleted. Enabled by default.

Once all values have been provided, click **Create** to finalize the integration.

### Troubleshooting authentication

If the Azure integration job does not complete, and you encounter a message such as: `[validation_failure] Error occurred while validating integration configuration` in your job log, check the following common configuration errors:

-   **Verify the Application (client) ID and Application (client) Secret:** Make sure that you've verified the proper value for client ID and client secret. The client secret has both a **Value** property and a **Secret ID** property. The **Secret ID** is unused: make sure you haven't accidentally used the **Secret ID** as the **Client ID**.
    
-   **Verify that you've enabled the proper API permissions:** Make sure the required API permissions (described above) are enabled for the application.
    
-   **Verify that the API permissions have been granted as "Application" and not "Delegated":** The integration requires API Permissions of type **Application**. Permissions of type **Delegated** will cause issues in your integration.
    
-   **Verify that your permissions have been "Grant(ed) admin consent for Directory":** If you have added API Permissions to the application, but have not granted Admin Consent, the permissions are not yet active.
    

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (230)

-   `AccessReview.Read.All`
-   `AccessReview.ReadWrite.All`
-   `AccessReview.ReadWrite.Membership`
-   `Microsoft.Advisor/recommendations/read`
-   `Microsoft.ApiManagement/service/apis/read`
-   `Microsoft.ApiManagement/service/backends/read`
-   `Microsoft.ApiManagement/service/namedValues/read`
-   `Microsoft.ApiManagement/service/portalconfigs/read`
-   `Microsoft.ApiManagement/service/portalsettings/read`
-   `Microsoft.ApiManagement/service/products/read`
-   `Microsoft.ApiManagement/service/products/subscriptions/read`
-   `Microsoft.ApiManagement/service/read`
-   `Microsoft.ApiManagement/service/subscriptions/read`
-   `Microsoft.ApiManagement/service/tenant/read`
-   `Microsoft.AppConfiguration/configurationStores/read`
-   `Microsoft.Authorization/classicAdministrators/read`
-   `Microsoft.Authorization/locks/read`
-   `Microsoft.Authorization/policyAssignments/read`
-   `Microsoft.Authorization/policyDefinitions/read`
-   `Microsoft.Authorization/policySetDefinitions/read`
-   `Microsoft.Authorization/roleAssignments/read`
-   `Microsoft.Authorization/roleDefinitions/read`
-   `Microsoft.Automation/automationAccounts/read`
-   `Microsoft.AzureArcData/sqlServerInstances/databases/read`
-   `Microsoft.AzureArcData/sqlServerInstances/read`
-   `Microsoft.Batch/batchAccounts/applications/read`
-   `Microsoft.Batch/batchAccounts/certificates/read`
-   `Microsoft.Batch/batchAccounts/pools/read`
-   `Microsoft.Batch/batchAccounts/read`
-   `Microsoft.BotService/botServices/channels/read`
-   `Microsoft.BotService/botServices/read`
-   `Microsoft.Cache/redis/firewallRules/read`
-   `Microsoft.Cache/redis/linkedServers/read`
-   `Microsoft.Cache/redis/read`
-   `Microsoft.Cache/redisEnterprise/databases/read`
-   `Microsoft.Cache/redisEnterprise/read`
-   `Microsoft.Cdn/profiles/afdEndpoints/read`
-   `Microsoft.Cdn/profiles/afdEndpoints/routes/read`
-   `Microsoft.Cdn/profiles/customDomains/read`
-   `Microsoft.Cdn/profiles/endpoints/read`
-   `Microsoft.Cdn/profiles/originGroups/origins/read`
-   `Microsoft.Cdn/profiles/originGroups/read`
-   `Microsoft.Cdn/profiles/read`
-   `Microsoft.Chaos/experiments/read`
-   `Microsoft.Chaos/targets/capabilities/read`
-   `Microsoft.Chaos/targets/read`
-   `Microsoft.CognitiveServices/accounts/read`
-   `Microsoft.Compute/disks/read`
-   `Microsoft.Compute/galleries/images/read`
-   `Microsoft.Compute/galleries/images/versions/read`
-   `Microsoft.Compute/galleries/read`
-   `Microsoft.Compute/images/read`
-   `Microsoft.Compute/virtualMachineScaleSets/read`
-   `Microsoft.Compute/virtualMachines/extensions/read`
-   `Microsoft.Compute/virtualMachines/read`
-   `Microsoft.Consumption/usageDetails/read`
-   `Microsoft.ContainerInstance/containerGroups/read`
-   `Microsoft.ContainerRegistry/registries/pull/read`
-   `Microsoft.ContainerRegistry/registries/read`
-   `Microsoft.ContainerRegistry/registries/webhooks/read`
-   `Microsoft.ContainerService/fleets/members/read`
-   `Microsoft.ContainerService/fleets/read`
-   `Microsoft.ContainerService/managedClusters/maintenanceConfigurations/read`
-   `Microsoft.ContainerService/managedClusters/read`
-   `Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read`
-   `Microsoft.DBforMariaDB/servers/databases/read`
-   `Microsoft.DBforMariaDB/servers/read`
-   `Microsoft.DBforMySQL/flexibleServers/databases/read`
-   `Microsoft.DBforMySQL/flexibleServers/firewallRules/read`
-   `Microsoft.DBforMySQL/flexibleServers/read`
-   `Microsoft.DBforMySQL/servers/databases/read`
-   `Microsoft.DBforMySQL/servers/firewallRules/read`
-   `Microsoft.DBforMySQL/servers/read`
-   `Microsoft.DBforPostgreSQL/flexibleServers/administrators/read`
-   `Microsoft.DBforPostgreSQL/flexibleServers/advancedThreatProtectionSettings/read`
-   `Microsoft.DBforPostgreSQL/flexibleServers/configurations/read`
-   `Microsoft.DBforPostgreSQL/flexibleServers/databases/read`
-   `Microsoft.DBforPostgreSQL/flexibleServers/firewallRules/read`
-   `Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/read`
-   `Microsoft.DBforPostgreSQL/flexibleServers/read`
-   `Microsoft.DBforPostgreSQL/servers/databases/read`
-   `Microsoft.DBforPostgreSQL/servers/firewallRules/read`
-   `Microsoft.DBforPostgreSQL/servers/read`
-   `Microsoft.DataFactory/factories/integrationRuntimes/read`
-   `Microsoft.DataFactory/factories/linkedservices/read`
-   `Microsoft.DataFactory/factories/managedVirtualNetworks/managedPrivateEndpoints/read`
-   `Microsoft.DataFactory/factories/managedVirtualNetworks/read`
-   `Microsoft.DataFactory/factories/privateEndpointConnections/read`
-   `Microsoft.DataFactory/factories/read`
-   `Microsoft.DataMigration/services/projects/read`
-   `Microsoft.DataMigration/services/read`
-   `Microsoft.DataMigration/services/serviceTasks/read`
-   `Microsoft.DataProtection/backupVaults/read`
-   `Microsoft.DataShare/accounts/read`
-   `Microsoft.Databricks/workspaces/read`
-   `Microsoft.DesktopVirtualization/applicationGroups/desktops/read`
-   `Microsoft.DesktopVirtualization/applicationGroups/read`
-   `Microsoft.DesktopVirtualization/hostPools/read`
-   `Microsoft.DesktopVirtualization/workspaces/read`
-   `Microsoft.Devices/iotHubs/Read`
-   `Microsoft.DocumentDB/databaseAccounts/read`
-   `Microsoft.DocumentDB/databaseAccounts/sqlDatabases/read`
-   `Microsoft.Easm/workspaces/read`
-   `Microsoft.EventGrid/domains/read`
-   `Microsoft.EventGrid/domains/topics/eventSubscriptions/read`
-   `Microsoft.EventGrid/domains/topics/read`
-   `Microsoft.EventGrid/topics/eventSubscriptions/read`
-   `Microsoft.EventGrid/topics/read`
-   `Microsoft.EventHub/clusters/read`
-   `Microsoft.EventHub/namespaces/eventHubs/consumergroups/read`
-   `Microsoft.EventHub/namespaces/eventhubs/read`
-   `Microsoft.EventHub/namespaces/read`
-   `Microsoft.Fabric/capacities/read`
-   `Microsoft.HybridCompute/machines/extensions/read`
-   `Microsoft.HybridCompute/machines/read`
-   `Microsoft.Insights/ActivityLogAlerts/Read`
-   `Microsoft.Insights/DiagnosticSettings/Read`
-   `Microsoft.Insights/LogProfiles/Read`
-   `Microsoft.Insights/components/read`
-   `Microsoft.Insights/eventtypes/values/Read`
-   `Microsoft.KeyVault/managedHSMs/read`
-   `Microsoft.KeyVault/vaults/keys/read`
-   `Microsoft.KeyVault/vaults/read`
-   `Microsoft.KeyVault/vaults/secrets/read`
-   `Microsoft.KeyVault/vaults/secrets/readMetadata/action`
-   `Microsoft.MachineLearningServices/workspaces/computes/read`
-   `Microsoft.MachineLearningServices/workspaces/onlineEndpoints/read`
-   `Microsoft.MachineLearningServices/workspaces/read`
-   `Microsoft.ManagedIdentity/userAssignedIdentities/read`
-   `Microsoft.ManagedServices/registrationAssignments/read`
-   `Microsoft.ManagedServices/registrationDefinitions/read`
-   `Microsoft.Management/managementGroups/read`
-   `Microsoft.Network/applicationGateways/read`
-   `Microsoft.Network/applicationSecurityGroups/read`
-   `Microsoft.Network/azurefirewalls/read`
-   `Microsoft.Network/bastionHosts/read`
-   `Microsoft.Network/bgpServiceCommunities/read`
-   `Microsoft.Network/ddosProtectionPlans/read`
-   `Microsoft.Network/dnszones/read`
-   `Microsoft.Network/dnszones/recordsets/read`
-   `Microsoft.Network/expressRouteCircuits/peerings/connections/read`
-   `Microsoft.Network/expressRouteCircuits/peerings/peerConnections/read`
-   `Microsoft.Network/expressRouteCircuits/read`
-   `Microsoft.Network/firewallPolicies/Read`
-   `Microsoft.Network/firewallPolicies/ruleCollectionGroups/Read`
-   `Microsoft.Network/frontDoors/read`
-   `Microsoft.Network/loadBalancers/read`
-   `Microsoft.Network/natGateways/read`
-   `Microsoft.Network/networkInterfaces/read`
-   `Microsoft.Network/networkSecurityGroups/read`
-   `Microsoft.Network/networkSecurityGroups/securityRules/read`
-   `Microsoft.Network/networkWatchers/flowLogs/read`
-   `Microsoft.Network/networkWatchers/read`
-   `Microsoft.Network/privateDnsZones/read`
-   `Microsoft.Network/privateDnsZones/recordsets/read`
-   `Microsoft.Network/privateDnsZones/virtualNetworkLinks/read`
-   `Microsoft.Network/privateEndpoints/read`
-   `Microsoft.Network/publicIPAddresses/read`
-   `Microsoft.Network/routeTables/read`
-   `Microsoft.Network/trafficmanagerprofiles/read`
-   `Microsoft.Network/virtualHubs/read`
-   `Microsoft.Network/virtualNetworks/read`
-   `Microsoft.Network/virtualWans/read`
-   `Microsoft.Network/vpnGateways/read`
-   `Microsoft.Network/vpnGateways/vpnConnections/vpnLinkConnections/read`
-   `Microsoft.OperationalInsights/workspaces/read`
-   `Microsoft.PolicyInsights/policyStates/queryResults/read`
-   `Microsoft.PowerBI/privateLinkServicesForPowerBI/read`
-   `Microsoft.RecoveryServices/Vaults/backupProtectedItems/read`
-   `Microsoft.RecoveryServices/vaults/read`
-   `Microsoft.Resources/deployments/read`
-   `Microsoft.Resources/subscriptions/locations/read`
-   `Microsoft.Resources/subscriptions/read`
-   `Microsoft.Resources/subscriptions/resourceGroups/read`
-   `Microsoft.ScVmm/virtualMachineInstances/read`
-   `Microsoft.Search/searchServices/listAdminKeys/action`
-   `Microsoft.Search/searchServices/read`
-   `Microsoft.Security/alerts/read`
-   `Microsoft.Security/assessments/read`
-   `Microsoft.Security/autoProvisioningSettings/read`
-   `Microsoft.Security/iotSecuritySolutions/read`
-   `Microsoft.Security/pricings/read`
-   `Microsoft.Security/securityContacts/read`
-   `Microsoft.Security/settings/read`
-   `Microsoft.ServiceBus/namespaces/queues/read`
-   `Microsoft.ServiceBus/namespaces/read`
-   `Microsoft.ServiceBus/namespaces/topics/read`
-   `Microsoft.ServiceBus/namespaces/topics/subscriptions/read`
-   `Microsoft.Sql/managedInstances/administrators/read`
-   `Microsoft.Sql/managedInstances/databases/read`
-   `Microsoft.Sql/managedInstances/read`
-   `Microsoft.Sql/servers/administrators/read`
-   `Microsoft.Sql/servers/databases/read`
-   `Microsoft.Sql/servers/firewallRules/read`
-   `Microsoft.Sql/servers/read`
-   `Microsoft.SqlVirtualMachine/sqlVirtualMachines/read`
-   `Microsoft.Storage/storageAccounts/blobServices/containers/read`
-   `Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action`
-   `Microsoft.Storage/storageAccounts/blobServices/read`
-   `Microsoft.Storage/storageAccounts/fileServices/read`
-   `Microsoft.Storage/storageAccounts/fileServices/shares/read`
-   `Microsoft.Storage/storageAccounts/listKeys/action`
-   `Microsoft.Storage/storageAccounts/queueServices/read`
-   `Microsoft.Storage/storageAccounts/read`
-   `Microsoft.Storage/storageAccounts/tableServices/read`
-   `Microsoft.Storage/storageAccounts/tableServices/tables/read`
-   `Microsoft.StreamAnalytics/clusters/privateEndpoints/read`
-   `Microsoft.StreamAnalytics/clusters/read`
-   `Microsoft.StreamAnalytics/streamingjobs/read`
-   `Microsoft.Subscription/policies/read`
-   `Microsoft.Synapse/workspaces/keys/read`
-   `Microsoft.Synapse/workspaces/read`
-   `Microsoft.Synapse/workspaces/sqlPools/dataMaskingPolicies/read`
-   `Microsoft.Synapse/workspaces/sqlPools/dataMaskingPolicies/rules/read`
-   `Microsoft.Synapse/workspaces/sqlPools/read`
-   `Microsoft.Web/serverfarms/Read`
-   `Microsoft.Web/sites/Read`
-   `Microsoft.Web/sites/config/Read`
-   `Microsoft.Web/sites/config/list/action`
-   `Microsoft.Web/sites/functions/read`
-   `Microsoft.Web/staticSites/Read`
-   `Microsoft.Web/staticSites/basicAuth/read`
-   `Microsoft.Web/staticSites/builds/Read`
-   `Microsoft.Web/staticSites/customDomains/Read`
-   `Microsoft.Web/staticSites/listAppSettings/action`
-   `Oracle.Database/cloudExadataInfrastructures/dbServers/read`
-   `Oracle.Database/cloudExadataInfrastructures/read`
-   `Oracle.Database/cloudVmClusters/dbNodes/read`
-   `Oracle.Database/dbSystems/read`
-   `Oracle.Database/exadbVmClusters/read`

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (8)

-   `Application.Read.All`
-   `AuditLog.Read.All`
-   `Device.Read.All`
-   `Directory.Read.All`
-   `Domain.Read.All`
-   `EntitlementManagement.Read.All`
-   `Policy.Read.All`
-   `Policy.Read.ConditionalAccess`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (8)

-   [https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy](https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy)
-   [https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide](https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide)
-   [https://learn.microsoft.com/en-us/azure/virtual-machines/overview](https://learn.microsoft.com/en-us/azure/virtual-machines/overview)
-   [https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface)
-   [https://learn.microsoft.com/en-us/graph/api/conditionalaccesstemplate-get](https://learn.microsoft.com/en-us/graph/api/conditionalaccesstemplate-get)
-   [https://learn.microsoft.com/en-us/graph/api/resources/authenticationcontextclassreference](https://learn.microsoft.com/en-us/graph/api/resources/authenticationcontextclassreference)
-   [https://learn.microsoft.com/en-us/graph/api/resources/conditionalaccesspolicy](https://learn.microsoft.com/en-us/graph/api/resources/conditionalaccesspolicy)
-   [https://learn.microsoft.com/en-us/graph/api/resources/namedlocation](https://learn.microsoft.com/en-us/graph/api/resources/namedlocation)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (328)

| Step | Permissions | OAuth Scopes |
| --- | --- | --- |
| Access Package Assignment Contains Access Package Assignment Policy | \- | \- |
| Access Package HAS Access Package Assignment | \- | \- |
| Access Reviews | `AccessReview.Read.All`, `AccessReview.ReadWrite.All`, `AccessReview.ReadWrite.Membership` | \- |
| AI Search Service Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| AI Search Services | `Microsoft.Search/searchServices/read`, `Microsoft.Search/searchServices/listAdminKeys/action`, `Microsoft.Resources/subscriptions/resourceGroups/read` | \- |
| API Management APIs | `Microsoft.ApiManagement/service/apis/read` | \- |
| API Management Backends | `Microsoft.ApiManagement/service/backends/read` | \- |
| API Management Named Values | `Microsoft.ApiManagement/service/namedValues/read` | \- |
| API Management Portal Config | `Microsoft.ApiManagement/service/portalconfigs/read` | \- |
| API Management Product Subscription Relationships | `Microsoft.ApiManagement/service/products/subscriptions/read` | \- |
| API Management Products | `Microsoft.ApiManagement/service/products/read` | \- |
| API Management Services | `Microsoft.ApiManagement/service/read`, `Microsoft.ApiManagement/service/portalsettings/read` | \- |
| API Management Services Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| API Management Subscriptions | `Microsoft.ApiManagement/service/subscriptions/read` | \- |
| API Management Tenant Access | `Microsoft.ApiManagement/service/tenant/read` | \- |
| App Configuration Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| App Configuration Stores | `Microsoft.AppConfiguration/configurationStores/read` | \- |
| App Service Apps | `Microsoft.Web/sites/Read`, `Microsoft.Web/sites/config/Read`, `Microsoft.Web/sites/config/list/action` | \- |
| App Service Functions | `Microsoft.Web/sites/functions/read` | \- |
| App Service Plans | `Microsoft.Web/serverfarms/Read` | \- |
| Application Insights Components | `Microsoft.Insights/components/read` | \- |
| Application Insights Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Application Security Group | `Microsoft.Network/applicationSecurityGroups/read` | \- |
| ARM Deployments | `Microsoft.Resources/deployments/read` | \- |
| Automation Account -> Private Endpoint Relationships | `Microsoft.Automation/automationAccounts/read` | \- |
| Automation Accounts | `Microsoft.Automation/automationAccounts/read` | \- |
| Automation Accounts Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Azure Access Package Has Application | \- | \- |
| Azure Application Gateway | `Microsoft.Network/applicationGateways/read` | \- |
| Azure Arc Machine Extensions | `Microsoft.HybridCompute/machines/extensions/read` | \- |
| Azure Arc Machines | `Microsoft.HybridCompute/machines/read` | \- |
| Azure Arc SCVMM Virtual Machine Instances | `Microsoft.ScVmm/virtualMachineInstances/read` | \- |
| Azure Arc SQL Server Databases | `Microsoft.AzureArcData/sqlServerInstances/databases/read` | \- |
| Azure Arc SQL Server Instances | `Microsoft.AzureArcData/sqlServerInstances/read` | \- |
| Azure Bgp Service Communities | `Microsoft.Network/bgpServiceCommunities/read` | \- |
| Azure Consumer Group | `Microsoft.EventHub/namespaces/eventHubs/consumergroups/read` | \- |
| Azure Event Hub | `Microsoft.EventHub/namespaces/eventhubs/read` | \- |
| Azure Group assigned to Access Package | \- | \- |
| Azure Peer Express Route Connection | `Microsoft.Network/expressRouteCircuits/peerings/peerConnections/read` | \- |
| Azure user assigned to Access Package | \- | \- |
| Azure user Created Entitlement Management Access Package Request | \- | \- |
| Bastion Hosts | `Microsoft.Network/bastionHosts/read` | \- |
| Batch Accounts | `Microsoft.Batch/batchAccounts/read` | \- |
| Batch Accounts Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Batch Applications | `Microsoft.Batch/batchAccounts/applications/read` | \- |
| Batch Certificates | `Microsoft.Batch/batchAccounts/certificates/read` | \- |
| Batch Pools | `Microsoft.Batch/batchAccounts/pools/read` | \- |
| Bot Service Bot -> Private Endpoint Relationships | `Microsoft.BotService/botServices/read` | \- |
| Bot Service Bots | `Microsoft.BotService/botServices/read` | \- |
| Bot Service Channels | `Microsoft.BotService/botServices/channels/read` | \- |
| Bot Service Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Build Azure Application Ownership Relationships | \- | `Application.Read.All` |
| Build Ddos Protection Plan Public Ip Relationship | \- | \- |
| Build Ddos Protection Plan Vnet Relationship | \- | \- |
| Build Fabric Capacity–Workspace Relationship | \- | \- |
| Build Fabric Report-Semantic Model Relationships | \- | \- |
| Build Fabric Semantic Model-Data Source Relationships | \- | \- |
| Build Key Vault Service Synapse Keys Relationship | \- | \- |
| Build Power BI Private Link Service–Private Endpoint Relationship | \- | \- |
| Build Resource Group Ddos Protection Plan Relationship | \- | \- |
| Build Synapse Service and key Relationship | \- | \- |
| Build Synapse Service and SQL Pool Relationship | \- | \- |
| Build Synapse Service and Workspace Relationship | \- | \- |
| Build Synapse SQL Pool Data Masking Policy Relationship | \- | \- |
| Build Synapse Sql Pool Data Masking Rule Relationship | \- | \- |
| Build Synapse Workspace and Keys Relationship | \- | \- |
| Build Synapse Workspace and SQL Pool Relationship | \- | \- |
| CDN Endpoints | `Microsoft.Cdn/profiles/endpoints/read` | \- |
| CDN Endpoints Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| CDN Profiles | `Microsoft.Cdn/profiles/read` | \- |
| CDN Profiles Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Chaos Studio Capabilities | `Microsoft.Chaos/targets/capabilities/read` | \- |
| Chaos Studio Experiment Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Chaos Studio Experiments | `Microsoft.Chaos/experiments/read` | \- |
| Chaos Studio Targets | `Microsoft.Chaos/targets/read` | \- |
| Classic Administrators | `Microsoft.Authorization/classicAdministrators/read` | \- |
| Cognitive Services Accounts | `Microsoft.CognitiveServices/accounts/read`, `Microsoft.Resources/subscriptions/resourceGroups/read` | \- |
| Compute Network Relationships | \- | \- |
| Conditional Access Has Conditional Access Auth Context Relationships | \- | \- |
| Conditional Access Has Conditional Access Policy Relationships | \- | \- |
| Conditional Access Has Conditional Access Template Relationships | \- | \- |
| Conditional Access Policy Assigned AD Groups Relationships | \- | \- |
| Conditional Access Policy Assigned AD Users Relationships | \- | \- |
| Conditional Access Policy Contains Named Location Relationships | \- | \- |
| Container Groups | `Microsoft.ContainerInstance/containerGroups/read` | \- |
| Container Registries | `Microsoft.ContainerRegistry/registries/read` | \- |
| Container Registries Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Container Registry Repositories | `Microsoft.ContainerRegistry/registries/pull/read` | \- |
| Container Registry Webhooks | `Microsoft.ContainerRegistry/registries/webhooks/read` | \- |
| CosmosDB SQL Databases | `Microsoft.DocumentDB/databaseAccounts/read`, `Microsoft.DocumentDB/databaseAccounts/sqlDatabases/read` | \- |
| Data Factory -> Private Endpoint Relationships | `Microsoft.DataFactory/factories/privateEndpointConnections/read` | \- |
| Data Factory Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Data Factory Instances | `Microsoft.DataFactory/factories/read` | \- |
| Data Factory Integration Runtimes | `Microsoft.DataFactory/factories/integrationRuntimes/read` | \- |
| Data Factory Linked Services | `Microsoft.DataFactory/factories/linkedservices/read` | \- |
| Data Factory Managed Private Endpoints | `Microsoft.DataFactory/factories/managedVirtualNetworks/managedPrivateEndpoints/read` | \- |
| Data Factory Managed Virtual Networks | `Microsoft.DataFactory/factories/managedVirtualNetworks/read` | \- |
| Data Migration Projects | `Microsoft.DataMigration/services/projects/read` | \- |
| Data Migration Service Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Data Migration Services | `Microsoft.DataMigration/services/read` | \- |
| Data Migration Tasks | `Microsoft.DataMigration/services/serviceTasks/read` | \- |
| Data Protection Backup Vaults | `Microsoft.DataProtection/backupVaults/read` | \- |
| Data Protection Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Data Share Accounts | `Microsoft.DataShare/accounts/read` | \- |
| Data Share Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Databricks Workspaces | `Microsoft.Databricks/workspaces/read` | \- |
| Defender Alerts | `Microsoft.Security/alerts/read` | \- |
| Defender EASM Workspaces | `Microsoft.Easm/workspaces/read` | \- |
| Desktop Virtualization Application Groups | `Microsoft.DesktopVirtualization/applicationGroups/read` | \- |
| Desktop Virtualization Desktops | `Microsoft.DesktopVirtualization/applicationGroups/desktops/read` | \- |
| Desktop Virtualization Host Pool Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Desktop Virtualization Host Pools | `Microsoft.DesktopVirtualization/hostPools/read` | \- |
| Desktop Virtualization Workspace Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Desktop Virtualization Workspaces | `Microsoft.DesktopVirtualization/workspaces/read` | \- |
| DNS Record Sets | `Microsoft.Network/dnszones/recordsets/read` | \- |
| DNS Zones | `Microsoft.Network/dnszones/read` | \- |
| Document Intelligence Accounts | `Microsoft.CognitiveServices/accounts/read`, `Microsoft.Resources/subscriptions/resourceGroups/read` | \- |
| Document Intelligence Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Entitlement Management Access Package Approver IS Azure User | \- | \- |
| Entitlement Management Access Package Assignment Approver | \- | `EntitlementManagement.Read.All` |
| Entitlement Management Resource Application Assigned To Access Catalog | \- | \- |
| Entra ID Authentication Methods Policy | \- | `Policy.Read.All` |
| Entra ID Authentication Strength Policy | \- | `Policy.Read.All` |
| Entra ID Authorization Policy | \- | `Policy.Read.All` |
| Entra ID Device Registration Policy | \- | `Policy.Read.All` |
| Entra ID Group Members | \- | `Directory.Read.All` |
| Entra ID Groups | \- | `Directory.Read.All` |
| Entra ID OAuth2 Permission Grants | \- | `Directory.Read.All` |
| Entra ID Role Definitions | \- | `Directory.Read.All` |
| Entra ID Service Principal Access | \- | `Directory.Read.All` |
| Entra ID Service Principals | \- | `Directory.Read.All` |
| Entra ID Users | \- | `Directory.Read.All` |
| Event Grid Domain Topic Subscriptions | `Microsoft.EventGrid/domains/topics/eventSubscriptions/read` | \- |
| Event Grid Domain Topics | `Microsoft.EventGrid/domains/topics/read` | \- |
| Event Grid Domains | `Microsoft.EventGrid/domains/read` | \- |
| Event Grid Domains Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Event Grid Topic Subscriptions | `Microsoft.EventGrid/topics/eventSubscriptions/read` | \- |
| Event Grid Topics | `Microsoft.EventGrid/topics/read`, `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Event Grid Topics Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Event Hub Cluster | `Microsoft.EventHub/clusters/read` | \- |
| Event Hub Namespace | `Microsoft.EventHub/namespaces/read` | \- |
| Express Route Circuit | `Microsoft.Network/expressRouteCircuits/read` | \- |
| Express Route Circuit Connection | `Microsoft.Network/expressRouteCircuits/peerings/connections/read` | \- |
| Fetch application credentials | \- | \- |
| Fetch Container Maintenance Configurations | `Microsoft.ContainerService/managedClusters/maintenanceConfigurations/read` | \- |
| Fetch Container Services Clusters | `Microsoft.ContainerService/managedClusters/read` | \- |
| Fetch Ddos Protection Plan | `Microsoft.Network/ddosProtectionPlans/read` | \- |
| Fetch Fabric Capacities | `Microsoft.Fabric/capacities/read` | \- |
| Fetch Fabric Capacity Tenant Setting Overrides | \- | \- |
| Fetch Fabric Domain Tenant Setting Overrides | \- | \- |
| Fetch Fabric Domains | \- | \- |
| Fetch Fabric Tenant Settings | \- | \- |
| Fetch Fabric Workspace Artifacts | \- | \- |
| Fetch Fabric Workspace Tenant Setting Overrides | \- | \- |
| Fetch Fabric Workspaces | \- | \- |
| Fetch Front Door AFD Custom Domains | `Microsoft.Cdn/profiles/customDomains/read` | \- |
| Fetch Front Door AFD Endpoints | `Microsoft.Cdn/profiles/afdEndpoints/read` | \- |
| Fetch Front Door AFD Origin Groups | `Microsoft.Cdn/profiles/originGroups/read` | \- |
| Fetch Front Door AFD Origins | `Microsoft.Cdn/profiles/originGroups/origins/read` | \- |
| Fetch Front Door AFD Profiles | `Microsoft.Cdn/profiles/read` | \- |
| Fetch Front Door AFD Routes | `Microsoft.Cdn/profiles/afdEndpoints/routes/read` | \- |
| Fetch FrontDoors | `Microsoft.Network/frontDoors/read` | \- |
| Fetch Power BI Private Link Services | `Microsoft.PowerBI/privateLinkServicesForPowerBI/read` | \- |
| Fetch Synapse Data Masking Policy | `Microsoft.Synapse/workspaces/sqlPools/dataMaskingPolicies/read` | \- |
| Fetch Synapse Data Masking Rule | `Microsoft.Synapse/workspaces/sqlPools/dataMaskingPolicies/rules/read` | \- |
| Fetch Synapse Keys | `Microsoft.Synapse/workspaces/keys/read` | \- |
| Fetch Traffic Manager Profiles | `Microsoft.Network/trafficmanagerprofiles/read` | \- |
| Fetch Trusted Access Roles | `Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read` | \- |
| Fetch Virtual Hubs | `Microsoft.Network/virtualHubs/read` | \- |
| Fetch Virtual WANs | `Microsoft.Network/virtualWans/read` | \- |
| Fetch VPN Connections | `Microsoft.Network/vpnGateways/read` | \- |
| Fetch VPN Gateways | `Microsoft.Network/vpnGateways/read` | \- |
| Fetch VPN Link Connections | `Microsoft.Network/vpnGateways/vpnConnections/vpnLinkConnections/read` | \- |
| Front Door AFD Profile Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Galleries | `Microsoft.Compute/galleries/read` | \- |
| Gallery Shared Image Versions | `Microsoft.Compute/galleries/images/versions/read` | \- |
| Gallery Shared Images | `Microsoft.Compute/galleries/images/read` | \- |
| Group Setting Templates | \- | `Directory.Read.All` |
| Group Settings | \- | `Directory.Read.All` |
| IoT Hub Security Solution Relationships | \- | \- |
| IoT Hubs | `Microsoft.Devices/iotHubs/Read` | \- |
| IoT Security Solutions | `Microsoft.Security/iotSecuritySolutions/read` | \- |
| Key Vault Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Key Vault Keys | `Microsoft.KeyVault/vaults/keys/read` | \- |
| Key Vault Secrets | `Microsoft.KeyVault/vaults/secrets/readMetadata/action`, `Microsoft.KeyVault/vaults/secrets/read` | \- |
| Key Vaults | `Microsoft.KeyVault/vaults/read` | \- |
| Kubernetes Fleet Managers | `Microsoft.ContainerService/fleets/read` | \- |
| Kubernetes Fleet Members | `Microsoft.ContainerService/fleets/members/read` | \- |
| Load Balancer Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Load Balancers | `Microsoft.Network/loadBalancers/read` | \- |
| Load Balancers NIC Relationships | \- | \- |
| Log Analytics Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Log Analytics Workspaces | `Microsoft.OperationalInsights/workspaces/read` | \- |
| Machine Learning Compute | `Microsoft.MachineLearningServices/workspaces/computes/read` | \- |
| Machine Learning Online Endpoints | `Microsoft.MachineLearningServices/workspaces/onlineEndpoints/read` | \- |
| Machine Learning Workspace -> Private Endpoint Relationships | `Microsoft.MachineLearningServices/workspaces/read` | \- |
| Machine Learning Workspace Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Machine Learning Workspaces | `Microsoft.MachineLearningServices/workspaces/read` | \- |
| Managed HSMs | `Microsoft.KeyVault/managedHSMs/read` | \- |
| Managed Identities (User-Assigned) | `Microsoft.ManagedIdentity/userAssignedIdentities/read` | \- |
| Managed Services Registration Assignments | `Microsoft.ManagedServices/registrationAssignments/read` | \- |
| Managed Services Registration Definitions | `Microsoft.ManagedServices/registrationDefinitions/read` | \- |
| Management Groups | `Microsoft.Management/managementGroups/read` | \- |
| MariaDB Databases | `Microsoft.DBforMariaDB/servers/databases/read`, `Microsoft.DBforMariaDB/servers/read` | \- |
| MariaDB Databases Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Monitor Activity Log Alerts | `Microsoft.Insights/ActivityLogAlerts/Read` | \- |
| Monitor Activity Log Events | `Microsoft.Insights/eventtypes/values/Read` | \- |
| Monitor Log Profiles | `Microsoft.Insights/LogProfiles/Read` | \- |
| MySQL Databases | `Microsoft.DBforMySQL/servers/read`, `Microsoft.DBforMySQL/servers/databases/read` | \- |
| MySQL Databases Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| MySQL Flexible Databases | `Microsoft.DBforMySQL/flexibleServers/databases/read` | \- |
| MySQL Flexible Server Firewall Rules | `Microsoft.DBforMySQL/flexibleServers/firewallRules/read` | \- |
| MySQL Flexible Servers | `Microsoft.DBforMySQL/flexibleServers/read` | \- |
| MySQL Server Firewall Rules | `Microsoft.DBforMySQL/servers/firewallRules/read` | \- |
| Network Application Gateway Ip Relationships | \- | \- |
| Network Azure Firewalls | `Microsoft.Network/azurefirewalls/read` | \- |
| Network Azure Firewalls Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Network Firewall IP Relationships | \- | \- |
| Network Firewall Policies | `Microsoft.Network/firewallPolicies/Read` | \- |
| Network Firewall Rules Relationships | `Microsoft.Network/firewallPolicies/ruleCollectionGroups/Read` | \- |
| Network Interfaces | `Microsoft.Network/networkInterfaces/read` | \- |
| Network Load Balancers IP Relationships | \- | \- |
| Network NAT Gateways | `Microsoft.Network/natGateways/read` | \- |
| Network NAT Gateways IP Relationships | \- | \- |
| Network Security Group Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Network Security Group NIC Relationships | \- | \- |
| Network Security Groups | `Microsoft.Network/networkSecurityGroups/read` | \- |
| Network Security Rules | `Microsoft.Network/networkSecurityGroups/securityRules/read` | \- |
| Network Securtiy Group Flow Logs | `Microsoft.Network/networkWatchers/flowLogs/read` | \- |
| Network Watchers | `Microsoft.Network/networkWatchers/read` | \- |
| Oracle DB Nodes | `Oracle.Database/cloudVmClusters/dbNodes/read` | \- |
| Oracle DB Servers | `Oracle.Database/cloudExadataInfrastructures/dbServers/read` | \- |
| Oracle DB Systems | `Oracle.Database/dbSystems/read` | \- |
| Oracle Exadata Infrastructures | `Oracle.Database/cloudExadataInfrastructures/read` | \- |
| Oracle ExaDB VM Clusters | `Oracle.Database/exadbVmClusters/read` | \- |
| Policy Assignments | `Microsoft.Authorization/policyAssignments/read` | \- |
| Policy Definitions | `Microsoft.Authorization/policyDefinitions/read`, `Microsoft.Authorization/policySetDefinitions/read` | \- |
| Policy States | `Microsoft.PolicyInsights/policyStates/queryResults/read` | \- |
| PostgreSQL Databases | `Microsoft.DBforPostgreSQL/servers/databases/read` | \- |
| PostgreSQL Flexible Databases | `Microsoft.DBforPostgreSQL/flexibleServers/databases/read` | \- |
| PostgreSQL Flexible Server Configurations | `Microsoft.DBforPostgreSQL/flexibleServers/configurations/read` | \- |
| PostgreSQL Flexible Server Entra Admins | `Microsoft.DBforPostgreSQL/flexibleServers/administrators/read` | \- |
| PostgreSQL Flexible Server Firewall Rules | `Microsoft.DBforPostgreSQL/flexibleServers/firewallRules/read` | \- |
| PostgreSQL Flexible Server Key Vault Relationships | \- | \- |
| PostgreSQL Flexible Server Private Endpoint Relationships | `Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/read` | \- |
| PostgreSQL Flexible Server Replicas | `Microsoft.DBforPostgreSQL/flexibleServers/read` | \- |
| PostgreSQL Flexible Server Subnet Relationships | \- | \- |
| PostgreSQL Flexible Servers | `Microsoft.DBforPostgreSQL/flexibleServers/read`, `Microsoft.DBforPostgreSQL/flexibleServers/advancedThreatProtectionSettings/read` | \- |
| PostgreSQL Flexible Servers Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| PostgreSQL Server Firewall Rules | `Microsoft.DBforPostgreSQL/servers/firewallRules/read` | \- |
| PostgreSQL Servers | `Microsoft.DBforPostgreSQL/servers/read` | \- |
| PostgreSQL Servers Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Private DNS Record Sets | `Microsoft.Network/privateDnsZones/recordsets/read` | \- |
| Private DNS Virtual Network Links | `Microsoft.Network/privateDnsZones/virtualNetworkLinks/read` | \- |
| Private DNS Zones | `Microsoft.Network/privateDnsZones/read` | \- |
| Private Endpoints | `Microsoft.Network/privateEndpoints/read` | \- |
| Public IP Addresses | `Microsoft.Network/publicIPAddresses/read` | \- |
| Public IP Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Recommendations | `Microsoft.Advisor/recommendations/read` | \- |
| Recovery Services Backup Protected Items | `Microsoft.RecoveryServices/Vaults/backupProtectedItems/read` | \- |
| Recovery Services Vault -> Private Endpoint Relationships | `Microsoft.RecoveryServices/vaults/read` | \- |
| Recovery Services Vaults | `Microsoft.RecoveryServices/vaults/read` | \- |
| Redis Caches | `Microsoft.Cache/redis/read` | \- |
| Redis Enterprise Cluster Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Redis Enterprise Clusters | `Microsoft.Cache/redisEnterprise/read` | \- |
| Redis Enterprise Database Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Redis Enterprise Databases | `Microsoft.Cache/redisEnterprise/databases/read` | \- |
| Redis Firewall Rules | `Microsoft.Cache/redis/firewallRules/read` | \- |
| Redis Linked Servers | `Microsoft.Cache/redis/linkedServers/read` | \- |
| Resource Groups | `Microsoft.Resources/subscriptions/resourceGroups/read` | \- |
| Resource Locks | `Microsoft.Authorization/locks/read` | \- |
| Role Assignments | `Microsoft.Authorization/roleAssignments/read` | \- |
| Role Definitions | `Microsoft.Authorization/roleDefinitions/read` | \- |
| Route Table Routes | \- | \- |
| Route Tables | `Microsoft.Network/routeTables/read` | \- |
| Security Assessments | `Microsoft.Security/assessments/read` | \- |
| Security Center Auto-Provisioning Settings | `Microsoft.Security/autoProvisioningSettings/read` | \- |
| Security Center Pricing Configurations | `Microsoft.Security/pricings/read` | \- |
| Security Center Settings | `Microsoft.Security/settings/read` | \- |
| Security Contacts | `Microsoft.Security/securityContacts/read` | \- |
| Service Bus Namespaces | `Microsoft.ServiceBus/namespaces/read` | \- |
| Service Bus Queues | `Microsoft.ServiceBus/namespaces/queues/read` | \- |
| Service Bus Topic Subscriptions | `Microsoft.ServiceBus/namespaces/topics/subscriptions/read` | \- |
| Service Bus Topics | `Microsoft.ServiceBus/namespaces/topics/read` | \- |
| Skipped Subscriptions | `Microsoft.Resources/subscriptions/read` | \- |
| SQL Databases | `Microsoft.Sql/servers/databases/read` | \- |
| SQL Managed Instance Databases | `Microsoft.Sql/managedInstances/databases/read` | \- |
| SQL Managed Instance Entra ID Admins | `Microsoft.Sql/managedInstances/administrators/read` | \- |
| SQL Managed Instance Private Endpoint Relationships | \- | \- |
| SQL Managed Instances | `Microsoft.Sql/managedInstances/read` | \- |
| SQL Server Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| SQL Server Entra ID Admins | `Microsoft.Sql/servers/administrators/read` | \- |
| SQL Server Firewall Rules | `Microsoft.Sql/servers/firewallRules/read` | \- |
| SQL Servers | `Microsoft.Sql/servers/read` | \- |
| SQL Virtual Machines | `Microsoft.SqlVirtualMachine/sqlVirtualMachines/read` | \- |
| Static Web App Builds | `Microsoft.Web/staticSites/builds/Read` | \- |
| Static Web App Custom Domains | `Microsoft.Web/staticSites/customDomains/Read` | \- |
| Static Web App Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Static Web App Sites | `Microsoft.Web/staticSites/Read`, `Microsoft.Web/staticSites/listAppSettings/action`, `Microsoft.Web/staticSites/basicAuth/read` | \- |
| Storage Accounts | `Microsoft.Storage/storageAccounts/read`, `Microsoft.Storage/storageAccounts/blobServices/read`, `Microsoft.Storage/storageAccounts/queueServices/read`, `Microsoft.Storage/storageAccounts/tableServices/read`, `Microsoft.Storage/storageAccounts/fileServices/read` | \- |
| Storage Accounts Keys | `Microsoft.Storage/storageAccounts/listKeys/action` | \- |
| Storage Blob Services | `Microsoft.Storage/storageAccounts/blobServices/read` | \- |
| Storage Containers | `Microsoft.Storage/storageAccounts/blobServices/containers/read`, `Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action` | \- |
| Storage File Shares | `Microsoft.Storage/storageAccounts/fileServices/shares/read` | \- |
| Storage Queues | `Microsoft.Storage/storageAccounts/queueServices/read` | \- |
| Storage Tables | `Microsoft.Storage/storageAccounts/tableServices/tables/read` | \- |
| Stream Analytics Clusters | `Microsoft.StreamAnalytics/clusters/read` | \- |
| Stream Analytics Jobs | `Microsoft.StreamAnalytics/streamingjobs/read` | \- |
| Stream Analytics Private Endpoints | `Microsoft.StreamAnalytics/clusters/privateEndpoints/read` | \- |
| Subscription Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Subscription Locations | `Microsoft.Resources/subscriptions/locations/read` | \- |
| Subscription Policies | `Microsoft.Subscription/policies/read` | \- |
| Subscription Usage Details | `Microsoft.Consumption/usageDetails/read` | \- |
| Subscriptions | `Microsoft.Resources/subscriptions/read` | \- |
| Synapse Service | \- | \- |
| Synapse SQL Pool | `Microsoft.Synapse/workspaces/sqlPools/read` | \- |
| Synapse Workspaces | `Microsoft.Synapse/workspaces/read` | \- |
| Traffic Manager Profile Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Virtual Hub Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Virtual Machine Disk Images | `Microsoft.Compute/images/read` | \- |
| Virtual Machine Disks | `Microsoft.Compute/disks/read` | \- |
| Virtual Machine Extensions | `Microsoft.Compute/virtualMachines/extensions/read` | \- |
| Virtual Machine Scale Sets | `Microsoft.Compute/virtualMachineScaleSets/read` | \- |
| Virtual Machines | `Microsoft.Compute/virtualMachines/read`, `Microsoft.Network/networkInterfaces/read`, `Microsoft.Network/publicIPAddresses/read` | \- |
| Virtual Network Diagostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| Virtual Networks | `Microsoft.Network/virtualNetworks/read` | \- |
| Virtual WAN Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |
| VPN Gateway Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| \[AD\] Access Review | `azure_access_review` | [Review](https://docs.jupiterone.io/data-model/schemas/Review) |
| \[AD\] Account | `azure_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| \[AD\] Authentication Methods Policy | `azure_authentication_methods_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| \[AD\] Authentication Strength Policy | `azure_authentication_strength_policy` | [PasswordPolicy](https://docs.jupiterone.io/data-model/schemas/PasswordPolicy) |
| \[AD\] Authorization Policy | `azure_authorization_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| \[AD\] Conditional Access | `azure_conditional_access_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[AD\] Conditional Access Authorization Context | `azure_conditional_access_authorization_context` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[AD\] Conditional Access Named location | `azure_conditional_access_named_location` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[AD\] Conditional Access Policy | `azure_conditional_access_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| \[AD\] Conditional Access Template | `azure_conditional_access_template` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| \[AD\] Device Registration Policy | `azure_device_registration_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| \[AD\] Domain | `azure_domain` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[AD\] Group | `azure_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| \[AD\] Group Member | `azure_group_member` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| \[AD\] Group.Unified Setting | `azure_group_unified_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[AD\] Group.Unified Setting Template | `azure_group_unified_setting_template` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[AD\] Group.Unified.Guest Setting | `azure_group_unified_guest_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[AD\] Group.Unified.Guest Setting Template | `azure_group_unified_guest_setting_template` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[AD\] Role Definition | `azure_ad_role_definition` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| \[AD\] Service Principal | `azure_service_principal` | [Service](https://docs.jupiterone.io/data-model/schemas/Service), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| \[AD\] User | `azure_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| \[RM\] Access Role | `azure_kube_trusted_access_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| \[RM\] Advisor Recommendation | `azure_advisor_recommendation` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| \[RM\] AI Search Service | `azure_search_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] API Management API | `azure_api_management_api` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| \[RM\] API Management Backend | `azure_api_management_backend` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| \[RM\] API Management Named Value | `azure_api_management_named_value` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| \[RM\] API Management Portal Config | `azure_api_management_portal_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] API Management Product | `azure_api_management_product` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] API Management Service | `azure_api_management_service` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| \[RM\] API Management Subscription | `azure_api_management_subscription` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| \[RM\] API Management Tenant Access | `azure_api_management_tenant_access` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] App Configuration Store | `azure_app_configuration_store` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] App Service Plan | `azure_app_service_plan` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Application Insights | `azure_application_insights` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| \[RM\] Automation Account | `azure_automation_account` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Azure Arc Machine | `azure_arc_machine` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] Azure Arc Machine Extension | `azure_arc_machine_extension` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| \[RM\] Azure Arc SCVMM Virtual Machine | `azure_scvmm_virtual_machine` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] Azure Arc SQL Server Database | `azure_arc_sql_server_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Azure Arc SQL Server Instance | `azure_arc_sql_server_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Azure Bgp Service Communities | `azure_bgp_service_communities` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Azure Consumer Group | `azure_event_hub_consumer_group` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| \[RM\] Azure Ddos Protection Plans | `azure_ddos_protection_plan` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Azure Event Hub | `azure_event_hub` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Azure Express Route | `azure_expressroute` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Azure Express Route Circuit | `azure_expressroute_circuit` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Azure Express Route Circuit Connections | `azure_expressroute_circuit_connection` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Azure Kubernetes Cluster | `azure_kubernetes_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Azure Managed Disk | `azure_managed_disk` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| \[RM\] Azure Peer Express Route Circuit Connection | `azure_peer_expressroute_circut_connection` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Backup Protected Item | `azure_backup_protected_item` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| \[RM\] Bastion Host | `azure_bastion_host` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] Batch Account | `azure_batch_account` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Batch Application | `azure_batch_application` | [Process](https://docs.jupiterone.io/data-model/schemas/Process) |
| \[RM\] Batch Certificate | `azure_batch_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| \[RM\] Batch Pool | `azure_batch_pool` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Bot Service Bot | `azure_bot_service_bot` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Bot Service Channel | `azure_bot_service_channel` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| \[RM\] CDN Endpoint | `azure_cdn_endpoint` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| \[RM\] CDN Profile | `azure_cdn_profile` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Chaos Studio Capability | `azure_chaos_studio_capability` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Chaos Studio Experiment | `azure_chaos_studio_experiment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| \[RM\] Chaos Studio Target | `azure_chaos_studio_target` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Classic Admin | `azure_classic_admin_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| \[RM\] Cognitive Services Account | `azure_cognitive_services_account` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Container | `azure_container` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| \[RM\] Container Group | `azure_container_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| \[RM\] Container Registry | `azure_container_registry` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Container Registry Webhook | `azure_container_registry_webhook` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| \[RM\] Container Volume | `azure_container_volume` | [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| \[RM\] Cosmos DB Account | `azure_cosmosdb_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account), [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Cosmos DB Database | `azure_cosmosdb_sql_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Data Factory | `azure_data_factory` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Data Factory Integration Runtime | `azure_data_factory_integration_runtime` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| \[RM\] Data Factory Linked Service | `azure_data_factory_linked_service` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Data Factory Managed Private Endpoint | `azure_data_factory_managed_private_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| \[RM\] Data Factory Managed Virtual Network | `azure_data_factory_managed_virtual_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Data Masking Policy | `azure_synapse_masking_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| \[RM\] Data Masking Rule | `azure_synapse_masking_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| \[RM\] Data Migration Project | `azure_datamigration_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| \[RM\] Data Migration Service | `azure_datamigration_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Data Migration Task | `azure_datamigration_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| \[RM\] Data Protection Backup Vault | `azure_data_protection_backup_vault` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Data Share Account | `azure_data_share_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| \[RM\] Databricks Workspace | `azure_databricks_workspace` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Deployment | `azure_rm_deployment` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| \[RM\] Desktop Virtualization Application Group | `azure_desktop_virtualization_application_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| \[RM\] Desktop Virtualization Desktop | `azure_desktop_virtualization_desktop` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[RM\] Desktop Virtualization Host Pool | `azure_desktop_virtualization_host_pool` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[RM\] Desktop Virtualization Workspace | `azure_desktop_virtualization_workspace` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] DNS Record Set | `azure_dns_record_set` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |
| \[RM\] DNS Zone | `azure_dns_zone` | [DomainZone](https://docs.jupiterone.io/data-model/schemas/DomainZone) |
| \[RM\] Document Intelligence Account | `azure_document_intelligence_account` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] EASM Workspace | `azure_easm_workspace` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Event Grid Domain | `azure_event_grid_domain` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Event Grid Domain Topic | `azure_event_grid_domain_topic` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| \[RM\] Event Grid Topic | `azure_event_grid_topic` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| \[RM\] Event Grid Topic Subscription | `azure_event_grid_topic_subscription` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| \[RM\] Event Hub Cluster | `azure_event_hub_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Event Hub Keys | `azure_event_hub_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| \[RM\] Event Hub Namespace | `azure_event_hub_namespace` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| \[RM\] Fabric Capacity | `azure_fabric_capacity` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[RM\] Fabric Dashboard | `azure_fabric_dashboard` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| \[RM\] Fabric Data Source | `azure_fabric_datasource` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Fabric Dataflow | `azure_fabric_dataflow` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| \[RM\] Fabric Datamart | `azure_fabric_datamart` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Fabric Domain | `azure_fabric_domain` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| \[RM\] Fabric Report | `azure_fabric_report` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| \[RM\] Fabric Semantic Model | `azure_fabric_semantic_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| \[RM\] Fabric Tenant Setting | `azure_fabric_tenant_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Fabric Tenant Setting Override | `azure_fabric_tenant_setting_override` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Fabric Workspace | `azure_fabric_workspace` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| \[RM\] Firewall Policy | `azure_network_firewall_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| \[RM\] Front Door AFD Endpoint | `azure_frontdoor_afd_endpoint` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| \[RM\] Front Door Custom Domain | `azure_frontdoor_custom_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| \[RM\] Front Door Origin | `azure_frontdoor_origin` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Front Door Origin Group | `azure_frontdoor_origin_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Front Door Profile | `azure_frontdoor_profile` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Front Door Route | `azure_frontdoor_route` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Function | `azure_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| \[RM\] Function App | `azure_function_app` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| \[RM\] Gallery | `azure_gallery` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| \[RM\] Image | `azure_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| \[RM\] IoT Hub | `azure_iot_hub` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] IoT Security Solution | `azure_iot_security_solution` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Key Vault | `azure_keyvault_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Key Vault Key | `azure_keyvault_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| \[RM\] Key Vault Secret | `azure_keyvault_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| \[RM\] Kubernetes Fleet Manager | `azure_kubernetes_fleet_manager` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Kubernetes Fleet Member | `azure_kubernetes_fleet_member` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[RM\] Kubernetes Service | `azure_kube_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Load Balancer | `azure_lb` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| \[RM\] Log Analytics | `azure_log_analytics_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Log Analytics Workspace | `azure_log_analytics_workspace` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| \[RM\] Machine Learning Compute | `azure_machine_learning_compute` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[RM\] Machine Learning Online Endpoint | `azure_machine_learning_online_endpoint` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Machine Learning Workspace | `azure_machine_learning_workspace` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Managed Cluster | `azure_kube_maintenance_configuration` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Managed HSM | `azure_managed_hsm` | [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |
| \[RM\] Managed Identity | `azure_managed_identity` | [Service](https://docs.jupiterone.io/data-model/schemas/Service), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| \[RM\] Managed Services Registration Assignment | `azure_managed_services_registration_assignment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Managed Services Registration Definition | `azure_managed_services_registration_definition` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| \[RM\] Management Group | `azure_management_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| \[RM\] MariaDB Database | `azure_mariadb_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] MariaDB Server | `azure_mariadb_server` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] Monitor Activity Log Alert | `azure_monitor_activity_log_alert` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| \[RM\] Monitor Activity Log Event | `azure_activity_log_event` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| \[RM\] Monitor Diagnostic Settings Resource | `azure_diagnostic_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Monitor Log Profile | `azure_monitor_log_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] MySQL Database | `azure_mysql_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] MySQL Flexible Database | `azure_mysql_flexible_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] MySQL Flexible Server | `azure_mysql_flexible_server` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] MySQL Flexible Server Firewall Rule | `azure_mysql_flexible_server_firewall_rule` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| \[RM\] MySQL Server | `azure_mysql_server` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] MySQL Server Firewall Rule | `azure_mysql_server_firewall_rule` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| \[RM\] NAT Gateway | `azure_nat_gateway` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Network Firewall | `azure_network_firewall` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| \[RM\] Network Interface | `azure_nic` | [NetworkInterface](https://docs.jupiterone.io/data-model/schemas/NetworkInterface) |
| \[RM\] Network Watcher | `azure_network_watcher` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[RM\] Oracle Cloud Exadata Infrastructure | `azure_oracle_exadata_infrastructure` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Oracle DB Node | `azure_oracle_db_node` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[RM\] Oracle DB Server | `azure_oracle_db_server` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[RM\] Oracle DB System | `azure_oracle_db_system` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| \[RM\] Oracle Exadb VM Cluster | `azure_oracle_exadb_vm_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Policy Assignment | `azure_policy_assignment` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| \[RM\] Policy Definition | `azure_policy_definition` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| \[RM\] Policy Set Definition | `azure_policy_set_definition` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| \[RM\] Policy State | `azure_policy_state` | [Review](https://docs.jupiterone.io/data-model/schemas/Review) |
| \[RM\] PostgreSQL Database | `azure_postgresql_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] PostgreSQL Flexible Database | `azure_postgresql_flexible_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] PostgreSQL Flexible Server | `azure_postgresql_flexible_server` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] PostgreSQL Flexible Server Configuration | `azure_postgresql_flexible_server_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] PostgreSQL Flexible Server Entra Admin | `azure_postgresql_flexible_server_entra_admin` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| \[RM\] PostgreSQL Flexible Server Firewall Rule | `azure_postgresql_flexible_server_firewall_rule` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| \[RM\] PostgreSQL Server | `azure_postgresql_server` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] PostgreSQL Server Firewall Rule | `azure_postgresql_server_firewall_rule` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| \[RM\] Power BI Private Link Service | `azure_powerbi_private_link_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Private DNS Record Set | `azure_private_dns_record_set` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |
| \[RM\] Private DNS Zone | `azure_private_dns_zone` | [DomainZone](https://docs.jupiterone.io/data-model/schemas/DomainZone) |
| \[RM\] Private DNS Zone Virtual Network Link | `azure_private_dns_zone_virtual_network_link` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Private Endpoint | `azure_private_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| \[RM\] Public IP Address | `azure_public_ip` | [IpAddress](https://docs.jupiterone.io/data-model/schemas/IpAddress) |
| \[RM\] Recovery Services Vault | `azure_recovery_services_vault` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Redis Cache | `azure_redis_cache` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Redis Enterprise Cluster | `azure_redis_enterprise_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Redis Enterprise Database | `azure_redis_enterprise_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Redis Firewall Rule | `azure_firewall_rule` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| \[RM\] Resource Group | `azure_resource_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| \[RM\] Resource Lock | `azure_resource_lock` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| \[RM\] Role Assignment | `azure_role_assignment` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| \[RM\] Role Binding | `azure_kube_cluster_role_binding` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| \[RM\] Role Definition | `azure_role_definition` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| \[RM\] Route | `azure_route` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| \[RM\] Route Table | `azure_route_table` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Security Assessment | `azure_security_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| \[RM\] Security Center Auto Provisioning Setting | `azure_security_center_auto_provisioning_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Security Center Setting | `azure_security_center_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Security Center Subscription Pricing | `azure_security_center_subscription_pricing` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Security Contact | `azure_security_center_contact` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[RM\] Security Group | `azure_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| \[RM\] Security Group Flow Logs | `azure_security_group_flow_logs` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| \[RM\] Security Rule | `azure_security_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| \[RM\] Service Bus Namespace | `azure_service_bus_namespace` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Service Bus Queue | `azure_service_bus_queue` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| \[RM\] Service Bus Subscription | `azure_service_bus_subscription` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| \[RM\] Service Bus Topic | `azure_service_bus_topic` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| \[RM\] Shared Image | `azure_shared_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| \[RM\] Shared Image Version | `azure_shared_image_version` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| \[RM\] SQL Database | `azure_sql_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] SQL Managed Instance | `azure_sql_managed_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| \[RM\] SQL Managed Instance Database | `azure_sql_managed_instance_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| \[RM\] SQL Managed Instance Entra ID Admin | `azure_sql_managed_instance_active_directory_admin` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| \[RM\] SQL Pool | `azure_synapse_sql_pool` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] SQL Server | `azure_sql_server` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] SQL Server Entra ID Admin | `azure_sql_server_active_directory_admin` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| \[RM\] SQL Server Firewall Rule | `azure_sql_server_firewall_rule` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| \[RM\] SQL Virtual Machine | `azure_sql_vm` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] Static Web App | `azure_static_site` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| \[RM\] Static Web App Build | `azure_static_site_build` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Static Web App Custom Domain | `azure_static_site_custom_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| \[RM\] Storage Account | `azure_storage_account` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Storage Account Key | `azure_storage_account_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| \[RM\] Storage Blob Service | `azure_storage_blob_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Storage Container | `azure_storage_container` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Storage File Share | `azure_storage_file_share` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Storage Queue | `azure_storage_queue` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| \[RM\] Storage Table | `azure_storage_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| \[RM\] Stream Analytics Cluster | `azure_stream_analytics_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Stream Analytics Job | `azure_stream_analytics_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| \[RM\] Stream Analytics Private Endpoint | `azure_stream_analytics_private_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| \[RM\] Subnet | `azure_subnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Subscription | `azure_subscription` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| \[RM\] Subscription Policy | `azure_subscription_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| \[RM\] Synapse Keys | `azure_synapse_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| \[RM\] Traffic Manager Endpoint | `azure_traffic_manager_endpoint` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Traffic Manager Profile | `azure_traffic_manager_profile` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| \[RM\] Usage Details | `azure_usage_details` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| \[RM\] Virtual Hub | `azure_virtual_hub` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Virtual Machine | `azure_vm` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] Virtual Machine Extension | `azure_vm_extension` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| \[RM\] Virtual Machine Scale Set | `azure_vm_scale_set` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| \[RM\] Virtual Network | `azure_vnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Virtual WAN | `azure_virtual_wan` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] VPN Connection | `azure_vpn_connection` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] VPN Gateway | `azure_vpn_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| \[RM\] VPN Link Connection | `azure_vpn_link_connection` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Web App | `azure_web_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| \[RM\] Workspaces | `azure_synapse_workspace` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Access Package Assignment Approvers | `azure_access_packages_approver` | [Review](https://docs.jupiterone.io/data-model/schemas/Review) |
| Access Package Assignment Policies | `azure_access_packages_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Access Package Assignment Requests | `azure_access_packages_request` | [Requirement](https://docs.jupiterone.io/data-model/schemas/Requirement) |
| Access Package Assignments | `azure_access_packages_service_assignment` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Access Package Catalogs | `azure_access_packages_catalog` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Access Packages | `azure_access_packages_services` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Application Credentials | `azure_application_credential` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Applications | `azure_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Azure Application Gateway | `azure_application_gateway` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Azure Application Security Groups | `azure_application_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Azure Synapse Analytics | `azure_synapse` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Container Registry Repository | `azure_container_registry_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| Device | `azure_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Finding | `azure_defender_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| FrontDoor | `azure_frontdoor` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| FrontDoor Backend Pool | `azure_frontdoor_backend_pool` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| FrontDoor Frontend Endpoint | `azure_frontdoor_frontend_endpoint` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| FrontDoor Routing Rule | `azure_frontdoor_routing_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| FrontDoor Rules Engine | `azure_frontdoor_rules_engine` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| OAuth2 Permission Grant | `azure_oauth2_permission_grant` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Security Assessment Finding | `azure_security_assessment_finding` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Service Principal Key Credential | `azure_service_principal_key_credential` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `ANY_RESOURCE` | **GENERATED** | `azure_shared_image_version` |
| `ANY_RESOURCE` | **HAS** | `azure_security_assessment` |
| `ANY_RESOURCE` | **HAS** | `azure_defender_alert` |
| `ANY_RESOURCE` | **HAS** | `azure_policy_state` |
| `ANY_SCOPE` | **HAS** | `azure_diagnostic_setting` |
| `ANY_SCOPE` | **HAS** | `azure_resource_lock` |
| `ANY_SCOPE` | **HAS** | `azure_advisor_recommendation` |
| `ANY_SCOPE` | **HAS** | `azure_policy_assignment` |
| `azure_access_packages_approver` | **IS** | `azure_user` |
| `azure_access_packages_catalog` | **ASSIGNED** | `azure_application` |
| `azure_access_packages_service_assignment` | **CONTAINS** | `azure_access_packages_policy` |
| `azure_access_packages_services` | **HAS** | `azure_application` |
| `azure_access_packages_services` | **HAS** | `azure_access_packages_service_assignment` |
| `azure_account` | **HAS** | `azure_domain` |
| `azure_account` | **HAS** | `azure_user` |
| `azure_account` | **HAS** | `azure_group` |
| `azure_account` | **HAS** | `azure_oauth2_permission_grant` |
| `azure_account` | **ENFORCES** | `azure_authorization_policy` |
| `azure_account` | **ENFORCES** | `azure_authentication_methods_policy` |
| `azure_account` | **HAS** | `azure_group_unified_setting_template` |
| `azure_account` | **HAS** | `azure_group_unified_guest_setting_template` |
| `azure_account` | **HAS** | `azure_group_unified_setting` |
| `azure_account` | **ENFORCES** | `azure_authentication_strength_policy` |
| `azure_account` | **ENFORCES** | `azure_device_registration_policy` |
| `azure_account` | **HAS** | `azure_access_review` |
| `azure_account` | **HAS** | `azure_keyvault_service` |
| `azure_account` | **HAS** | `azure_subscription_policy` |
| `azure_account` | **HAS** | `azure_management_group` |
| `azure_api_management_product` | **HAS** | `azure_api_management_subscription` |
| `azure_api_management_service` | **HAS** | `azure_api_management_api` |
| `azure_api_management_service` | **HAS** | `azure_api_management_named_value` |
| `azure_api_management_service` | **HAS** | `azure_api_management_product` |
| `azure_api_management_service` | **HAS** | `azure_api_management_subscription` |
| `azure_api_management_service` | **HAS** | `azure_api_management_portal_config` |
| `azure_api_management_service` | **HAS** | `azure_api_management_tenant_access` |
| `azure_api_management_service` | **HAS** | `azure_api_management_backend` |
| `azure_app_configuration_store` | **USES** | `azure_private_endpoint` |
| `azure_app_configuration_store` | **USES** | `azure_managed_identity` |
| `azure_app_configuration_store` | **ASSIGNED** | `azure_managed_identity` |
| `azure_application` | **HAS** | `azure_application_credential` |
| `azure_application_gateway` | **HAS** | `azure_public_ip` |
| `azure_application_insights` | **USES** | `azure_private_endpoint` |
| `azure_application_insights` | **USES** | `azure_log_analytics_workspace` |
| `azure_application_security_group` | **PROTECTS** | `azure_vm` |
| `azure_arc_machine` | **USES** | `azure_arc_machine_extension` |
| `azure_arc_machine` | **HAS** | `azure_scvmm_virtual_machine` |
| `azure_arc_machine` | **HAS** | `azure_arc_sql_server_instance` |
| `azure_arc_sql_server_instance` | **HAS** | `azure_arc_sql_server_database` |
| `azure_authorization_policy` | **USES** | `azure_ad_role_definition` |
| `azure_automation_account` | **HAS** | `azure_private_endpoint` |
| `azure_automation_account` | **USES** | `azure_managed_identity` |
| `azure_automation_account` | **ASSIGNED** | `azure_managed_identity` |
| `azure_backup_protected_item` | **PROTECTS** | `azure_vm` |
| `azure_backup_protected_item` | **PROTECTS** | `azure_storage_file_share` |
| `azure_backup_protected_item` | **PROTECTS** | `azure_storage_account` |
| `azure_backup_protected_item` | **PROTECTS** | `azure_sql_database` |
| `azure_bastion_host` | **USES** | `azure_subnet` |
| `azure_bastion_host` | **USES** | `azure_public_ip` |
| `azure_batch_account` | **HAS** | `azure_batch_pool` |
| `azure_batch_account` | **HAS** | `azure_batch_application` |
| `azure_batch_account` | **HAS** | `azure_batch_certificate` |
| `azure_bgp_service_communities` | **HAS** | `azure_expressroute` |
| `azure_bot_service_bot` | **HAS** | `azure_bot_service_channel` |
| `azure_bot_service_bot` | **USES** | `azure_storage_account` |
| `azure_bot_service_bot` | **HAS** | `azure_private_endpoint` |
| `azure_bot_service_bot` | **USES** | `azure_managed_identity` |
| `azure_bot_service_bot` | **ASSIGNED** | `azure_managed_identity` |
| `azure_cdn_profile` | **HAS** | `azure_cdn_endpoint` |
| `azure_chaos_studio_experiment` | **HAS** | `azure_chaos_studio_target` |
| `azure_chaos_studio_experiment` | **USES** | `azure_managed_identity` |
| `azure_chaos_studio_experiment` | **ASSIGNED** | `azure_managed_identity` |
| `azure_chaos_studio_target` | **HAS** | `azure_chaos_studio_capability` |
| `azure_classic_admin_group` | **HAS** | `azure_user` |
| `azure_cognitive_services_account` | **USES** | `azure_managed_identity` |
| `azure_cognitive_services_account` | **ASSIGNED** | `azure_managed_identity` |
| `azure_conditional_access_policy` | **CONTAINS** | `azure_conditional_access_named_location` |
| `azure_conditional_access_policy` | **ASSIGNED** | `azure_user` |
| `azure_conditional_access_policy` | **ASSIGNED** | `azure_group` |
| `azure_conditional_access_service` | **HAS** | `azure_conditional_access_policy` |
| `azure_conditional_access_service` | **HAS** | `azure_conditional_access_authorization_context` |
| `azure_conditional_access_service` | **HAS** | `azure_conditional_access_template` |
| `azure_container` | **USES** | `azure_container_volume` |
| `azure_container_group` | **HAS** | `azure_container` |
| `azure_container_group` | **HAS** | `azure_container_volume` |
| `azure_container_group` | **USES** | `azure_managed_identity` |
| `azure_container_group` | **ASSIGNED** | `azure_managed_identity` |
| `azure_container_registry` | **HAS** | `azure_container_registry_webhook` |
| `azure_container_registry` | **HAS** | `azure_container_registry_repository` |
| `azure_container_registry` | **USES** | `azure_managed_identity` |
| `azure_container_registry` | **ASSIGNED** | `azure_managed_identity` |
| `azure_container_volume` | **USES** | `azure_storage_file_share` |
| `azure_cosmosdb_account` | **HAS** | `azure_cosmosdb_sql_database` |
| `azure_data_factory` | **HAS** | `azure_data_factory_integration_runtime` |
| `azure_data_factory` | **HAS** | `azure_data_factory_managed_virtual_network` |
| `azure_data_factory` | **HAS** | `azure_data_factory_linked_service` |
| `azure_data_factory` | **USES** | `azure_private_endpoint` |
| `azure_data_factory` | **USES** | `azure_managed_identity` |
| `azure_data_factory` | **ASSIGNED** | `azure_managed_identity` |
| `azure_data_factory_integration_runtime` | **USES** | `azure_data_factory_managed_virtual_network` |
| `azure_data_factory_linked_service` | **USES** | `azure_data_factory_integration_runtime` |
| `azure_data_factory_managed_virtual_network` | **HAS** | `azure_data_factory_managed_private_endpoint` |
| `azure_data_protection_backup_vault` | **USES** | `azure_managed_identity` |
| `azure_data_protection_backup_vault` | **ASSIGNED** | `azure_managed_identity` |
| `azure_data_share_account` | **USES** | `azure_managed_identity` |
| `azure_data_share_account` | **ASSIGNED** | `azure_managed_identity` |
| `azure_databricks_workspace` | **HAS** | `azure_private_endpoint` |
| `azure_databricks_workspace` | **USES** | `azure_vnet` |
| `azure_databricks_workspace` | **USES** | `azure_machine_learning_workspace` |
| `azure_databricks_workspace` | **USES** | `azure_lb` |
| `azure_databricks_workspace` | **USES** | `azure_managed_identity` |
| `azure_databricks_workspace` | **ASSIGNED** | `azure_managed_identity` |
| `azure_datamigration_service` | **HAS** | `azure_datamigration_project` |
| `azure_datamigration_service` | **HAS** | `azure_datamigration_task` |
| `azure_ddos_protection_plan` | **ASSIGNED** | `azure_public_ip` |
| `azure_ddos_protection_plan` | **ASSIGNED** | `azure_vnet` |
| `azure_desktop_virtualization_application_group` | **HAS** | `azure_desktop_virtualization_desktop` |
| `azure_desktop_virtualization_host_pool` | **HAS** | `azure_desktop_virtualization_application_group` |
| `azure_desktop_virtualization_host_pool` | **HAS** | `azure_private_endpoint` |
| `azure_desktop_virtualization_workspace` | **HAS** | `azure_desktop_virtualization_application_group` |
| `azure_desktop_virtualization_workspace` | **HAS** | `azure_private_endpoint` |
| `azure_device_registration_policy` | **ALLOWS** | `azure_user` |
| `azure_device_registration_policy` | **ALLOWS** | `azure_group` |
| `azure_diagnostic_setting` | **USES** | `azure_storage_account` |
| `azure_diagnostic_setting` | **USES** | `azure_log_analytics_workspace` |
| `azure_dns_zone` | **HAS** | `azure_dns_record_set` |
| `azure_document_intelligence_account` | **HAS** | `azure_private_endpoint` |
| `azure_document_intelligence_account` | **USES** | `azure_managed_identity` |
| `azure_document_intelligence_account` | **ASSIGNED** | `azure_managed_identity` |
| `azure_event_grid_domain` | **HAS** | `azure_event_grid_domain_topic` |
| `azure_event_grid_domain_topic` | **HAS** | `azure_event_grid_topic_subscription` |
| `azure_event_grid_topic` | **HAS** | `azure_event_grid_topic_subscription` |
| `azure_event_hub` | **HAS** | `azure_location` |
| `azure_event_hub_cluster` | **ASSIGNED** | `azure_event_hub_namespace` |
| `azure_event_hub_consumer_group` | **HAS** | `azure_event_hub` |
| `azure_event_hub_key` | **USES** | `azure_keyvault_service` |
| `azure_event_hub_namespace` | **HAS** | `azure_event_hub` |
| `azure_event_hub_namespace` | **HAS** | `azure_event_hub_key` |
| `azure_event_hub_namespace` | **USES** | `azure_managed_identity` |
| `azure_event_hub_namespace` | **ASSIGNED** | `azure_managed_identity` |
| `azure_expressroute` | **HAS** | `azure_expressroute` |
| `azure_expressroute` | **HAS** | `azure_peer_expressroute_circut_connection` |
| `azure_expressroute` | **HAS** | `azure_application_gateway` |
| `azure_expressroute` | **HAS** | `azure_expressroute_circuit_connection` |
| `azure_expressroute_circuit` | **HAS** | `azure_peer_expressroute_circut_connection` |
| `azure_expressroute_circuit` | **HAS** | `azure_expressroute_circuit_connection` |
| `azure_fabric_capacity` | **HAS** | `azure_fabric_tenant_setting_override` |
| `azure_fabric_capacity` | **HAS** | `azure_fabric_workspace` |
| `azure_fabric_domain` | **HAS** | `azure_fabric_tenant_setting_override` |
| `azure_fabric_report` | **USES** | `azure_fabric_semantic_model` |
| `azure_fabric_semantic_model` | **USES** | `azure_fabric_datasource` |
| `azure_fabric_tenant_setting_override` | **OVERRIDES** | `azure_fabric_tenant_setting` |
| `azure_fabric_workspace` | **HAS** | `azure_fabric_tenant_setting_override` |
| `azure_fabric_workspace` | **HAS** | `azure_fabric_report` |
| `azure_fabric_workspace` | **HAS** | `azure_fabric_semantic_model` |
| `azure_fabric_workspace` | **HAS** | `azure_fabric_dashboard` |
| `azure_fabric_workspace` | **HAS** | `azure_fabric_dataflow` |
| `azure_fabric_workspace` | **HAS** | `azure_fabric_datamart` |
| `azure_frontdoor` | **HAS** | `azure_frontdoor_rules_engine` |
| `azure_frontdoor` | **HAS** | `azure_frontdoor_routing_rule` |
| `azure_frontdoor` | **HAS** | `azure_frontdoor_backend_pool` |
| `azure_frontdoor` | **HAS** | `azure_frontdoor_frontend_endpoint` |
| `azure_frontdoor_afd_endpoint` | **HAS** | `azure_frontdoor_route` |
| `azure_frontdoor_origin_group` | **HAS** | `azure_frontdoor_origin` |
| `azure_frontdoor_profile` | **HAS** | `azure_frontdoor_afd_endpoint` |
| `azure_frontdoor_profile` | **HAS** | `azure_frontdoor_origin_group` |
| `azure_frontdoor_profile` | **HAS** | `azure_frontdoor_custom_domain` |
| `azure_function_app` | **USES** | `azure_app_service_plan` |
| `azure_function_app` | **HAS** | `azure_function` |
| `azure_function_app` | **USES** | `azure_managed_identity` |
| `azure_function_app` | **ASSIGNED** | `azure_managed_identity` |
| `azure_gallery` | **CONTAINS** | `azure_shared_image` |
| `azure_group` | **HAS** | `azure_user` |
| `azure_group` | **HAS** | `azure_group` |
| `azure_group` | **HAS** | `azure_group_member` |
| `azure_group` | **HAS** | `azure_device` |
| `azure_group` | **HAS** | `azure_ad_role_definition` |
| `azure_group` | **APPROVED** | `azure_access_packages_policy` |
| `azure_group` | **ASSIGNED** | `azure_access_packages_services` |
| `azure_group_unified_guest_setting` | **MANAGES** | `azure_group` |
| `azure_group_unified_setting` | **MANAGES** | `azure_group` |
| `azure_image` | **GENERATED** | `azure_shared_image_version` |
| `azure_iot_hub` | **HAS** | `azure_iot_security_solution` |
| `azure_keyvault_service` | **ALLOWS** | `ANY_PRINCIPAL` |
| `azure_keyvault_service` | **CONTAINS** | `azure_keyvault_key` |
| `azure_keyvault_service` | **CONTAINS** | `azure_keyvault_secret` |
| `azure_keyvault_service` | **USES** | `azure_private_endpoint` |
| `azure_keyvault_service` | **HAS** | `azure_synapse_key` |
| `azure_kube_cluster_role_binding` | **IS** | `kube_cluster_role_binding` |
| `azure_kube_service` | **CONTAINS** | `azure_kube_trusted_access_role` |
| `azure_kubernetes_cluster` | **HAS** | `azure_kube_maintenance_configuration` |
| `azure_kubernetes_cluster` | **CONTAINS** | `azure_kube_cluster_role_binding` |
| `azure_kubernetes_cluster` | **USES** | `azure_managed_identity` |
| `azure_kubernetes_cluster` | **ASSIGNED** | `azure_managed_identity` |
| `azure_kubernetes_fleet_manager` | **HAS** | `azure_kubernetes_fleet_member` |
| `azure_kubernetes_fleet_manager` | **USES** | `azure_managed_identity` |
| `azure_kubernetes_fleet_manager` | **ASSIGNED** | `azure_managed_identity` |
| `azure_kubernetes_fleet_member` | **USES** | `azure_kubernetes_cluster` |
| `azure_lb` | **CONNECTS** | `azure_nic` |
| `azure_lb` | **HAS** | `azure_public_ip` |
| `azure_log_analytics_service` | **HAS** | `azure_log_analytics_workspace` |
| `azure_log_analytics_workspace` | **USES** | `azure_private_endpoint` |
| `azure_machine_learning_workspace` | **USES** | `azure_storage_account` |
| `azure_machine_learning_workspace` | **USES** | `azure_keyvault_service` |
| `azure_machine_learning_workspace` | **USES** | `azure_container_registry` |
| `azure_machine_learning_workspace` | **HAS** | `azure_private_endpoint` |
| `azure_machine_learning_workspace` | **HAS** | `azure_machine_learning_compute` |
| `azure_machine_learning_workspace` | **HAS** | `azure_machine_learning_online_endpoint` |
| `azure_machine_learning_workspace` | **USES** | `azure_managed_identity` |
| `azure_machine_learning_workspace` | **ASSIGNED** | `azure_managed_identity` |
| `azure_managed_hsm` | **MANAGES** | `ANY_PRINCIPAL` |
| `azure_managed_hsm` | **USES** | `azure_private_endpoint` |
| `azure_managed_services_registration_assignment` | **USES** | `azure_managed_services_registration_definition` |
| `azure_management_group` | **CONTAINS** | `azure_management_group` |
| `azure_mariadb_server` | **HAS** | `azure_mariadb_database` |
| `azure_monitor_activity_log_alert` | **MONITORS** | `ANY_SCOPE` |
| `azure_monitor_log_profile` | **USES** | `azure_storage_account` |
| `azure_mysql_flexible_server` | **HAS** | `azure_mysql_flexible_database` |
| `azure_mysql_flexible_server` | **HAS** | `azure_mysql_server_firewall_rule` |
| `azure_mysql_server` | **HAS** | `azure_mysql_database` |
| `azure_mysql_server` | **HAS** | `azure_mysql_server_firewall_rule` |
| `azure_nat_gateway` | **HAS** | `azure_public_ip` |
| `azure_network_firewall` | **HAS** | `azure_network_firewall_policy` |
| `azure_network_firewall` | **HAS** | `azure_public_ip` |
| `azure_network_firewall_policy` | **EXTENDS** | `azure_network_firewall_policy` |
| `azure_network_watcher` | **HAS** | `azure_security_group_flow_logs` |
| `azure_oracle_exadata_infrastructure` | **HAS** | `azure_oracle_db_server` |
| `azure_oracle_exadb_vm_cluster` | **HAS** | `azure_oracle_db_node` |
| `azure_oracle_exadb_vm_cluster` | **USES** | `azure_vnet` |
| `azure_oracle_exadb_vm_cluster` | **USES** | `azure_subnet` |
| `azure_policy_assignment` | **USES** | `azure_policy_set_definition` |
| `azure_policy_assignment` | **USES** | `azure_policy_definition` |
| `azure_policy_assignment` | **HAS** | `azure_policy_state` |
| `azure_policy_definition` | **DEFINES** | `azure_policy_state` |
| `azure_policy_set_definition` | **CONTAINS** | `azure_policy_definition` |
| `azure_postgresql_flexible_server` | **HAS** | `azure_postgresql_flexible_database` |
| `azure_postgresql_flexible_server` | **HAS** | `azure_postgresql_server_firewall_rule` |
| `azure_postgresql_flexible_server` | **HAS** | `azure_postgresql_flexible_server_entra_admin` |
| `azure_postgresql_flexible_server` | **HAS** | `azure_postgresql_flexible_server_configuration` |
| `azure_postgresql_flexible_server` | **HAS** | `azure_postgresql_flexible_server` |
| `azure_postgresql_flexible_server` | **HAS** | `azure_private_endpoint` |
| `azure_postgresql_flexible_server` | **USES** | `azure_subnet` |
| `azure_postgresql_flexible_server` | **USES** | `azure_keyvault_key` |
| `azure_postgresql_server` | **HAS** | `azure_postgresql_database` |
| `azure_postgresql_server` | **HAS** | `azure_postgresql_server_firewall_rule` |
| `azure_powerbi_private_link_service` | **USES** | `azure_private_endpoint` |
| `azure_private_dns_zone` | **HAS** | `azure_private_dns_record_set` |
| `azure_private_dns_zone` | **HAS** | `azure_private_dns_zone_virtual_network_link` |
| `azure_private_dns_zone_virtual_network_link` | **USES** | `azure_vnet` |
| `azure_private_endpoint` | **USES** | `azure_nic` |
| `azure_private_endpoint` | **CONNECTS** | `ANY_RESOURCE` |
| `azure_recovery_services_vault` | **HAS** | `azure_private_endpoint` |
| `azure_recovery_services_vault` | **HAS** | `azure_backup_protected_item` |
| `azure_recovery_services_vault` | **USES** | `azure_managed_identity` |
| `azure_recovery_services_vault` | **ASSIGNED** | `azure_managed_identity` |
| `azure_redis_cache` | **HAS** | `azure_firewall_rule` |
| `azure_redis_cache` | **CONNECTS** | `azure_redis_cache` |
| `azure_redis_enterprise_cluster` | **HAS** | `azure_redis_enterprise_database` |
| `azure_redis_enterprise_cluster` | **USES** | `azure_private_endpoint` |
| `azure_resource_group` | **HAS** | `azure_gallery` |
| `azure_resource_group` | **HAS** | `azure_image` |
| `azure_resource_group` | **HAS** | `azure_managed_disk` |
| `azure_resource_group` | **HAS** | `azure_vm` |
| `azure_resource_group` | **HAS** | `azure_vm_scale_set` |
| `azure_resource_group` | **HAS** | `azure_cosmosdb_account` |
| `azure_resource_group` | **HAS** | `azure_data_factory` |
| `azure_resource_group` | **HAS** | `azure_data_protection_backup_vault` |
| `azure_resource_group` | **HAS** | `azure_datamigration_service` |
| `azure_resource_group` | **HAS** | `azure_data_share_account` |
| `azure_resource_group` | **HAS** | `azure_mariadb_server` |
| `azure_resource_group` | **HAS** | `azure_mysql_server` |
| `azure_resource_group` | **HAS** | `azure_mysql_flexible_server` |
| `azure_resource_group` | **HAS** | `azure_postgresql_server` |
| `azure_resource_group` | **HAS** | `azure_postgresql_flexible_server` |
| `azure_resource_group` | **HAS** | `azure_sql_server` |
| `azure_resource_group` | **HAS** | `azure_sql_managed_instance` |
| `azure_resource_group` | **HAS** | `azure_databricks_workspace` |
| `azure_resource_group` | **HAS** | `azure_keyvault_service` |
| `azure_resource_group` | **HAS** | `azure_managed_hsm` |
| `azure_resource_group` | **HAS** | `azure_machine_learning_workspace` |
| `azure_resource_group` | **HAS** | `azure_desktop_virtualization_workspace` |
| `azure_resource_group` | **HAS** | `azure_desktop_virtualization_host_pool` |
| `azure_resource_group` | **HAS** | `azure_desktop_virtualization_application_group` |
| `azure_resource_group` | **HAS** | `azure_document_intelligence_account` |
| `azure_resource_group` | **HAS** | `azure_search_service` |
| `azure_resource_group` | **HAS** | `azure_cognitive_services_account` |
| `azure_resource_group` | **HAS** | `azure_public_ip` |
| `azure_resource_group` | **HAS** | `azure_nic` |
| `azure_resource_group` | **HAS** | `azure_vnet` |
| `azure_resource_group` | **HAS** | `azure_security_group` |
| `azure_resource_group` | **HAS** | `azure_lb` |
| `azure_resource_group` | **HAS** | `azure_network_firewall` |
| `azure_resource_group` | **HAS** | `azure_network_watcher` |
| `azure_resource_group` | **HAS** | `azure_private_endpoint` |
| `azure_resource_group` | **HAS** | `azure_nat_gateway` |
| `azure_resource_group` | **HAS** | `azure_bastion_host` |
| `azure_resource_group` | **HAS** | `azure_route_table` |
| `azure_resource_group` | **HAS** | `azure_storage_account` |
| `azure_resource_group` | **HAS** | `azure_api_management_service` |
| `azure_resource_group` | **HAS** | `azure_arc_machine` |
| `azure_resource_group` | **HAS** | `azure_arc_sql_server_instance` |
| `azure_resource_group` | **HAS** | `azure_dns_zone` |
| `azure_resource_group` | **HAS** | `azure_private_dns_zone` |
| `azure_resource_group` | **HAS** | `azure_container_registry` |
| `azure_resource_group` | **HAS** | `azure_service_bus_namespace` |
| `azure_resource_group` | **HAS** | `azure_cdn_profile` |
| `azure_resource_group` | **HAS** | `azure_batch_account` |
| `azure_resource_group` | **HAS** | `azure_bot_service_bot` |
| `azure_resource_group` | **HAS** | `azure_recovery_services_vault` |
| `azure_resource_group` | **HAS** | `azure_redis_cache` |
| `azure_resource_group` | **HAS** | `azure_redis_enterprise_cluster` |
| `azure_resource_group` | **HAS** | `azure_container_group` |
| `azure_resource_group` | **HAS** | `azure_frontdoor` |
| `azure_resource_group` | **HAS** | `azure_frontdoor_profile` |
| `azure_resource_group` | **HAS** | `azure_traffic_manager_profile` |
| `azure_resource_group` | **HAS** | `azure_event_grid_domain` |
| `azure_resource_group` | **HAS** | `azure_event_grid_topic` |
| `azure_resource_group` | **HAS** | `azure_automation_account` |
| `azure_resource_group` | **HAS** | `azure_chaos_studio_experiment` |
| `azure_resource_group` | **HAS** | `azure_kubernetes_fleet_manager` |
| `azure_resource_group` | **HAS** | `azure_monitor_activity_log_alert` |
| `azure_resource_group` | **HAS** | `azure_web_app` |
| `azure_resource_group` | **HAS** | `azure_function_app` |
| `azure_resource_group` | **HAS** | `azure_app_service_plan` |
| `azure_resource_group` | **HAS** | `azure_kubernetes_cluster` |
| `azure_resource_group` | **HAS** | `azure_ddos_protection_plan` |
| `azure_resource_group` | **HAS** | `azure_event_hub_namespace` |
| `azure_resource_group` | **HAS** | `azure_event_hub` |
| `azure_resource_group` | **HAS** | `azure_app_configuration_store` |
| `azure_resource_group` | **HAS** | `azure_virtual_wan` |
| `azure_resource_group` | **HAS** | `azure_virtual_hub` |
| `azure_resource_group` | **HAS** | `azure_vpn_gateway` |
| `azure_resource_group` | **HAS** | `azure_log_analytics_workspace` |
| `azure_resource_group` | **HAS** | `azure_application_insights` |
| `azure_resource_group` | **HAS** | `azure_rm_deployment` |
| `azure_resource_group` | **HAS** | `azure_managed_identity` |
| `azure_resource_group` | **HAS** | `azure_oracle_exadata_infrastructure` |
| `azure_resource_group` | **HAS** | `azure_oracle_exadb_vm_cluster` |
| `azure_resource_group` | **HAS** | `azure_oracle_db_system` |
| `azure_resource_group` | **HAS** | `azure_sql_vm` |
| `azure_resource_group` | **HAS** | `azure_stream_analytics_cluster` |
| `azure_resource_group` | **HAS** | `azure_stream_analytics_job` |
| `azure_resource_group` | **HAS** | `azure_static_site` |
| `azure_role_assignment` | **ALLOWS** | `ANY_SCOPE` |
| `azure_role_assignment` | **USES** | `azure_role_definition` |
| `azure_route_table` | **HAS** | `azure_route` |
| `azure_search_service` | **USES** | `azure_private_endpoint` |
| `azure_security_assessment` | **IDENTIFIED** | `azure_advisor_recommendation` |
| `azure_security_assessment` | **HAS** | `azure_security_assessment_finding` |
| `azure_security_assessment` | **SCANS** | `azure_container_registry` |
| `azure_security_group` | **PROTECTS** | `azure_vm_scale_set` |
| `azure_security_group` | **PROTECTS** | `azure_subnet` |
| `azure_security_group` | **PROTECTS** | `azure_nic` |
| `azure_security_group` | **HAS** | `azure_security_rule` |
| `azure_security_group` | **ALLOWS** | `azure_subnet` |
| `azure_security_group` | **DENIES** | `azure_subnet` |
| `azure_security_group` | **HAS** | `azure_security_group_flow_logs` |
| `azure_security_group_flow_logs` | **USES** | `azure_storage_account` |
| `azure_service_bus_namespace` | **HAS** | `azure_service_bus_queue` |
| `azure_service_bus_namespace` | **HAS** | `azure_service_bus_topic` |
| `azure_service_bus_topic` | **HAS** | `azure_service_bus_subscription` |
| `azure_service_principal` | **USES** | `azure_service_principal_key_credential` |
| `azure_service_principal` | **USES** | `azure_oauth2_permission_grant` |
| `azure_service_principal` | **HAS** | `azure_ad_role_definition` |
| `azure_service_principal` | **ASSIGNED** | `azure_group` |
| `azure_service_principal` | **ASSIGNED** | `azure_user` |
| `azure_service_principal` | **ASSIGNED** | `azure_service_principal` |
| `azure_service_principal` | **OWNS** | `azure_application` |
| `azure_shared_image` | **HAS** | `azure_shared_image_version` |
| `azure_sql_managed_instance` | **HAS** | `azure_sql_managed_instance_database` |
| `azure_sql_managed_instance` | **HAS** | `azure_sql_managed_instance_active_directory_admin` |
| `azure_sql_managed_instance` | **HAS** | `azure_private_endpoint` |
| `azure_sql_server` | **HAS** | `azure_sql_database` |
| `azure_sql_server` | **HAS** | `azure_sql_server_firewall_rule` |
| `azure_sql_server` | **HAS** | `azure_sql_server_active_directory_admin` |
| `azure_sql_vm` | **USES** | `azure_vm` |
| `azure_static_site` | **HAS** | `azure_static_site_build` |
| `azure_static_site` | **HAS** | `azure_static_site_custom_domain` |
| `azure_static_site` | **USES** | `azure_private_endpoint` |
| `azure_storage_account` | **USES** | `azure_keyvault_service` |
| `azure_storage_account` | **HAS** | `azure_storage_file_share` |
| `azure_storage_account` | **HAS** | `azure_storage_container` |
| `azure_storage_account` | **HAS** | `azure_storage_queue` |
| `azure_storage_account` | **HAS** | `azure_storage_table` |
| `azure_storage_account` | **HAS** | `azure_storage_blob_service` |
| `azure_storage_account` | **HAS** | `azure_storage_account_key` |
| `azure_storage_account` | **USES** | `azure_managed_identity` |
| `azure_storage_account` | **ASSIGNED** | `azure_managed_identity` |
| `azure_stream_analytics_cluster` | **HAS** | `azure_stream_analytics_job` |
| `azure_stream_analytics_cluster` | **HAS** | `azure_stream_analytics_private_endpoint` |
| `azure_subnet` | **ALLOWS** | `azure_security_group` |
| `azure_subnet` | **DENIES** | `azure_security_group` |
| `azure_subnet` | **HAS** | `azure_private_endpoint` |
| `azure_subnet` | **HAS** | `azure_security_group_flow_logs` |
| `azure_subnet` | **USES** | `azure_route_table` |
| `azure_subnet` | **HAS** | `azure_vm` |
| `azure_subscription` | **CONTAINS** | `azure_role_definition` |
| `azure_subscription` | **HAS** | `azure_resource_group` |
| `azure_subscription` | **HAS** | `azure_usage_details` |
| `azure_subscription` | **PERFORMED** | `azure_security_assessment` |
| `azure_subscription` | **HAS** | `azure_security_center_contact` |
| `azure_subscription` | **HAS** | `azure_security_center_subscription_pricing` |
| `azure_subscription` | **HAS** | `azure_security_center_setting` |
| `azure_subscription` | **HAS** | `azure_security_center_auto_provisioning_setting` |
| `azure_subscription` | **HAS** | `azure_defender_alert` |
| `azure_subscription` | **HAS** | `azure_monitor_log_profile` |
| `azure_subscription` | **HAS** | `azure_activity_log_event` |
| `azure_subscription` | **HAS** | `azure_kube_service` |
| `azure_subscription` | **HAS** | `azure_synapse` |
| `azure_subscription` | **HAS** | `azure_ddos_protection_plan` |
| `azure_subscription` | **HAS** | `azure_event_hub` |
| `azure_subscription` | **HAS** | `azure_iot_hub` |
| `azure_subscription` | **HAS** | `azure_iot_security_solution` |
| `azure_subscription` | **HAS** | `azure_expressroute` |
| `azure_subscription` | **HAS** | `azure_bgp_service_communities` |
| `azure_subscription` | **HAS** | `azure_easm_workspace` |
| `azure_subscription` | **HAS** | `azure_rm_deployment` |
| `azure_subscription` | **HAS** | `azure_managed_services_registration_definition` |
| `azure_subscription` | **HAS** | `azure_managed_services_registration_assignment` |
| `azure_subscription` | **HAS** | `azure_fabric_capacity` |
| `azure_subscription` | **HAS** | `azure_powerbi_private_link_service` |
| `azure_synapse` | **HAS** | `azure_synapse_workspace` |
| `azure_synapse` | **HAS** | `azure_synapse_sql_pool` |
| `azure_synapse` | **HAS** | `azure_synapse_key` |
| `azure_synapse_sql_pool` | **HAS** | `azure_synapse_masking_rule` |
| `azure_synapse_sql_pool` | **ASSIGNED** | `azure_synapse_masking_policy` |
| `azure_synapse_workspace` | **HAS** | `azure_synapse_sql_pool` |
| `azure_synapse_workspace` | **HAS** | `azure_synapse_key` |
| `azure_traffic_manager_profile` | **HAS** | `azure_traffic_manager_endpoint` |
| `azure_user` | **OWNS** | `azure_device` |
| `azure_user` | **ASSIGNED** | `azure_oauth2_permission_grant` |
| `azure_user` | **HAS** | `azure_ad_role_definition` |
| `azure_user` | **APPROVED** | `azure_access_packages_policy` |
| `azure_user` | **OWNS** | `azure_application` |
| `azure_user` | **CREATED** | `azure_access_packages_request` |
| `azure_user` | **ASSIGNED** | `azure_access_packages_services` |
| `azure_virtual_hub` | **HAS** | `azure_vpn_gateway` |
| `azure_virtual_hub` | **USES** | `azure_network_firewall` |
| `azure_virtual_wan` | **HAS** | `azure_virtual_hub` |
| `azure_vm` | **GENERATED** | `azure_shared_image_version` |
| `azure_vm` | **USES** | `azure_storage_account` |
| `azure_vm` | **USES** | `azure_managed_disk` |
| `azure_vm` | **USES** | `azure_vm_extension` |
| `azure_vm` | **USES** | `azure_image` |
| `azure_vm` | **USES** | `azure_shared_image` |
| `azure_vm` | **USES** | `azure_shared_image_version` |
| `azure_vm` | **USES** | `azure_vm_scale_set` |
| `azure_vm` | **USES** | `azure_nic` |
| `azure_vm` | **USES** | `azure_public_ip` |
| `azure_vm_scale_set` | **USES** | `azure_lb` |
| `azure_vm_scale_set` | **USES** | `azure_subnet` |
| `azure_vm_scale_set` | **USES** | `azure_shared_image` |
| `azure_vm_scale_set` | **USES** | `azure_shared_image_version` |
| `azure_vm_scale_set` | **USES** | `azure_managed_identity` |
| `azure_vm_scale_set` | **ASSIGNED** | `azure_managed_identity` |
| `azure_vnet` | **CONTAINS** | `azure_subnet` |
| `azure_vnet` | **HAS** | `azure_security_group_flow_logs` |
| `azure_vpn_connection` | **HAS** | `azure_vpn_link_connection` |
| `azure_vpn_gateway` | **HAS** | `azure_vpn_connection` |
| `azure_web_app` | **USES** | `azure_app_service_plan` |
| `azure_web_app` | **USES** | `azure_managed_identity` |
| `azure_web_app` | **ASSIGNED** | `azure_managed_identity` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `azure_backup_protected_item` | **PROTECTS** | `azure_vm` | FORWARD |
| `azure_backup_protected_item` | **PROTECTS** | `azure_storage_account` | FORWARD |
| `azure_backup_protected_item` | **PROTECTS** | `azure_sql_database` | FORWARD |
| `azure_data_factory_managed_private_endpoint` | **CONNECTS** | `azure_resource` | FORWARD |
| `azure_fabric_workspace` | **HAS** | `azure_user` | FORWARD |
| `azure_fabric_workspace` | **HAS** | `azure_service_principal` | FORWARD |
| `azure_kube_trusted_access_role` | **IS** | `kube_cluster_role` | FORWARD |
| `azure_managed_identity` | **IS** | `azure_service_principal` | FORWARD |
| `azure_management_group` | **HAS** | `azure_subscription` | FORWARD |
| `azure_network_firewall` | **ALLOWS** | `internet` | FORWARD |
| `azure_network_firewall` | **ALLOWS** | `internet` | REVERSE |
| `azure_network_firewall` | **DENIES** | `internet` | FORWARD |
| `azure_network_firewall` | **DENIES** | `internet` | REVERSE |
| `azure_network_watcher` | **HAS** | `azure_location` | REVERSE |
| `azure_postgresql_flexible_server_entra_admin` | **IS** | `azure_user` | FORWARD |
| `azure_postgresql_flexible_server_entra_admin` | **IS** | `azure_group` | FORWARD |
| `azure_postgresql_flexible_server_entra_admin` | **IS** | `azure_service_principal` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_unknown_principal_type` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_application` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_directory` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_directory_role_template` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_everyone` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_foreign_group` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_group` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_msi` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_service_principal` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_unknown` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_user` | FORWARD |
| `azure_subscription` | **USES** | `azure_location` | FORWARD |
| `azure_vm` | **USES** | `azure_image` | FORWARD |
| `azure_vm` | **ASSIGNED** | `azure_service_principal` | FORWARD |

### Azure Access Review

`azure_access_review` inherits from [Review](/data-model/schemas/Review.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `autoApplyDecisions` | `boolean` |  |  |
| `createdOn` | `number` |  |  |
| `defaultDecision` | `string` |  |  |
| `defaultDecisionEnabled` | `boolean` |  |  |
| `descriptionForAdmins` | `string` |  |  |
| `descriptionForReviewers` | `string` |  |  |
| `durationInDays` | `number` |  |  |
| `id` | `string` |  |  |
| `justificationRequired` | `boolean` |  |  |
| `mailNotificationsEnabled` | `boolean` |  |  |
| `recommendationsEnabled` | `boolean` |  |  |
| `recurrenceDayOfMonth` | `number` |  |  |
| `recurrenceDaysOfWeek` | `array` of `string`s |  |  |
| `recurrenceEndDate` | `string` |  |  |
| `recurrenceFirstDayOfWeek` | `string` |  |  |
| `recurrenceIndex` | `string` |  |  |
| `recurrenceInterval` | `number` |  |  |
| `recurrenceMonth` | `number` |  |  |
| `recurrenceOccurrences` | `number` |  |  |
| `recurrenceRangeType` | `string` |  |  |
| `recurrenceStartDate` | `string` |  |  |
| `recurrenceTimeZone` | `string` |  |  |
| `recurrenceType` | `string` |  |  |
| `reminderNotificationsEnabled` | `boolean` |  |  |
| `updatedOn` | `number` |  |  |

---

### Azure Activity Log Event

`azure_activity_log_event` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`authorizationAction` \*

 | `string` **|** `null` |  |  |
| 

`authorizationRole` \*

 | `string` **|** `null` |  |  |
| 

`authorizationScope` \*

 | `string` **|** `null` |  |  |
| 

`caller` \*

 | `string` **|** `null` |  |  |
| 

`category` \*

 | `string` **|** `null` |  |  |
| 

`clientIpAddress` \*

 | `string` **|** `null` |  |  |
| 

`correlationId` \*

 | `string` **|** `null` |  |  |
| 

`eventDataId` \*

 | `string` **|** `null` |  |  |
| 

`eventTimestamp` \*

 | `number` **|** `null` |  |  |
| 

`httpMethod` \*

 | `string` **|** `null` |  |  |
| 

`level` \*

 | `string` **|** `null` |  |  |
| 

`numericSeverity` \*

 | `number` |  |  |
| 

`open` \*

 | `boolean` |  |  |
| 

`operationId` \*

 | `string` **|** `null` |  |  |
| 

`operationName` \*

 | `string` **|** `null` |  |  |
| 

`operationStatus` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroupName` \*

 | `string` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` **|** `null` |  |  |
| 

`resourceProviderName` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`severity` \*

 | `string` **|** `null` |  |  |
| 

`submissionTimestamp` \*

 | `number` **|** `null` |  |  |
| 

`subscriptionId` \*

 | `string` **|** `null` |  |  |
| 

`subStatus` \*

 | `string` **|** `null` |  |  |

---

### Azure Api Management Backend

`azure_api_management_backend` inherits from [NetworkEndpoint](/data-model/schemas/NetworkEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`address` \*

 | `string` | The backend upstream URL (runtime URL). |  |
| 

`hasAuthorizationHeader` \*

 | `boolean` **|** `null` | Whether an authorization header is configured for backend credentials. |  |
| 

`hasClientCertificate` \*

 | `boolean` **|** `null` | Whether the backend is configured with a client certificate. |  |
| 

`hasServiceFabricCluster` \*

 | `boolean` **|** `null` | Whether this backend connects to a Service Fabric cluster. |  |
| 

`isTlsCertificateChainValidationEnabled` \*

 | `boolean` **|** `null` | Whether SSL certificate chain validation is performed for self-signed certificates. |  |
| 

`isTlsCertificateNameValidationEnabled` \*

 | `boolean` **|** `null` | Whether SSL certificate name validation is performed for self-signed certificates. |  |
| 

`protocol` \*

 | `string` | Communication protocol ('http' or 'soap'). |  |
| 

`proxyUrl` \*

 | `string` **|** `null` | WebProxy URL used for requests to this backend. |  |
| 

`resourceId` \*

 | `string` **|** `null` | ARM resource ID of the external resource (e.g. Logic App, Function App). |  |
| 

`title` \*

 | `string` **|** `null` | Backend title. |  |

---

### Azure Api Management Named Value

`azure_api_management_named_value` inherits from [Secret](/data-model/schemas/Secret.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isKeyVaultBacked` \*

 | `boolean` | Whether the named value resolves its value from an Azure Key Vault secret rather than storing it inline. Azure forces secret=true on Key Vault-backed named values, so isSecret=true with isKeyVaultBacked=false identifies a secret stored inline in API Management. |  |
| 

`isSecret` \*

 | `boolean` | Whether the named value is encrypted/secret. If true, the value is never returned by the API. |  |
| `keyVaultIdentityClientId` | `string` **|** `null` | Client ID of the user-assigned managed identity used to fetch the Key Vault secret. Null when the system-assigned identity is used. |  |
| `keyVaultLastStatusCheckedOn` | `number` **|** `null` | Timestamp (ms since epoch) of the most recent attempt to refresh the secret from Key Vault. |  |
| `keyVaultLastStatusCode` | `string` **|** `null` | Status code of the most recent Key Vault secret refresh ('Success' when the secret was retrieved). A non-success code means the gateway is serving a stale value. |  |
| `keyVaultLastStatusMessage` | `string` **|** `null` | Details of the most recent Key Vault secret refresh failure, when one occurred. |  |
| `keyVaultSecretIdentifier` | `string` **|** `null` | Data-plane URI of the backing Key Vault secret (https://<vault>.vault.azure.net/secrets/<name>\[/<version>\]). A URI without a version is refreshed automatically; a versioned URI is pinned. |  |

---

### Azure Api Management Portal Config

`azure_api_management_portal_config` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`corsAllowedOrigins` \*

 | `array` **|** `null` | Allowed origins for CORS on the developer portal. |  |
| 

`cspAllowedSources` \*

 | `array` **|** `null` | Allowed sources for the Content Security Policy. |  |
| 

`cspMode` \*

 | `string` **|** `null` | Content Security Policy mode ('enabled', 'disabled', or 'reportOnly'). |  |
| 

`delegationUrl` \*

 | `string` **|** `null` | URL of the external delegation service. |  |
| 

`isBasicAuthEnabled` \*

 | `boolean` **|** `null` | Whether basic authentication is enabled on the portal. |  |
| 

`isDelegateRegistrationEnabled` \*

 | `boolean` **|** `null` | Whether user registration is delegated to an external service. |  |
| 

`isDelegateSubscriptionEnabled` \*

 | `boolean` **|** `null` | Whether product subscription management is delegated to an external service. |  |
| 

`isSigninRequired` \*

 | `boolean` **|** `null` | Whether anonymous users are redirected to the sign-in page. |  |
| 

`isSignupTermsConsentRequired` \*

 | `boolean` **|** `null` | Whether user consent to terms of service is required during sign-up. |  |
| 

`isSignupTermsOfServiceEnabled` \*

 | `boolean` **|** `null` | Whether terms of service are displayed during sign-up. |  |

---

### Azure Api Management Product

`azure_api_management_product` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isApprovalRequired` \*

 | `boolean` **|** `null` | Whether administrator approval is required before a subscription is active. |  |
| 

`isSubscriptionRequired` \*

 | `boolean` **|** `null` | Whether a product subscription is required to access the APIs. If false, the product is "open". |  |
| 

`state` \*

 | `string` **|** `null` | Publication state of the product ('published' or 'notPublished'). |  |
| 

`subscriptionsLimit` \*

 | `number` **|** `null` | Maximum number of simultaneous subscriptions a user can have. Null means unlimited. |  |
| 

`terms` \*

 | `string` **|** `null` | Terms of use text that developers must accept before subscribing. |  |

---

### Azure Api Management Service

`azure_api_management_service` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `certificateExpiryDates` | `array` **|** `null` | Expiry timestamps (ms since epoch) of the service certificates. |  |
| 
`delegationUrl` \*

 | `string` **|** `null` | URL of the external delegation service, when configured. |  |
| `hasCertificates` | `boolean` **|** `null` | Whether the service has any custom CA/client certificates configured. |  |
| `hostnameConfigurationsKeyVaultIds` | `array` **|** `null` | Key Vault secret identifiers backing the custom hostname TLS certificates. |  |
| `identityType` | `string` **|** `null` | The managed identity type configured on the service (e.g. 'SystemAssigned', 'UserAssigned'). |  |
| `isClientCertificateEnabled` | `boolean` **|** `null` | Whether client certificate authentication is required at the gateway (Consumption tier). |  |
| 

`isDelegateRegistrationEnabled` \*

 | `boolean` **|** `null` | Whether user registration is delegated to an external service. |  |
| 

`isDelegateSubscriptionEnabled` \*

 | `boolean` **|** `null` | Whether product subscription management is delegated to an external service. |  |
| 

`isSignInEnabled` \*

 | `boolean` **|** `null` | Whether anonymous users must sign in to access the developer portal. |  |
| 

`isSignUpEnabled` \*

 | `boolean` **|** `null` | Whether self-service sign-up is enabled on the developer portal. |  |
| 

`isSignUpTermsConsentRequired` \*

 | `boolean` **|** `null` | Whether consent to the terms of service is required during sign-up. |  |
| 

`isSignUpTermsOfServiceEnabled` \*

 | `boolean` **|** `null` | Whether terms of service are displayed during developer portal sign-up. |  |
| `minApiVersion` | `string` **|** `null` | The minimum control-plane API version clients may use, when an apiVersionConstraint is configured. |  |
| `skuName` | `string` **|** `null` | The pricing tier (SKU) name of the service (e.g. 'Developer', 'Basic', 'Standard', 'Premium', 'Consumption'). |  |
| `virtualNetworkSubnetResourceId` | `string` **|** `null` | ARM resource ID of the subnet the service is injected into, when VNet-integrated. |  |

---

### Azure Api Management Subscription

`azure_api_management_subscription` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`endedOn` \*

 | `number` **|** `null` | Timestamp (ms since epoch) when the subscription was cancelled or expired. |  |
| 

`isAllowTracingEnabled` \*

 | `boolean` **|** `null` | Whether request tracing is enabled for this subscription. |  |
| 

`ownerId` \*

 | `string` **|** `null` | The user resource identifier of the subscription owner (e.g. /users/{userId}). |  |
| 

`scope` \*

 | `string` | Subscription scope: /products/{productId}, /apis, or /apis/{apiId}. |  |
| 

`startedOn` \*

 | `number` **|** `null` | Timestamp (ms since epoch) when the subscription was activated. |  |
| 

`state` \*

 | `string` | Subscription state: 'active', 'suspended', 'submitted', 'rejected', 'cancelled', or 'expired'. |  |
| 

`stateComment` \*

 | `string` **|** `null` | Optional comment added by an administrator. |  |

---

### Azure Api Management Tenant Access

`azure_api_management_tenant_access` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessId` \*

 | `string` **|** `null` | The tenant access identifier. |  |
| 

`isEnabled` \*

 | `boolean` | Whether direct tenant management API access is enabled. |  |

---

### Azure Arc Sql Server Database

`azure_arc_sql_server_database` inherits from [Database](/data-model/schemas/Database.md), [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`collation` \*

 | `string` **|** `null` | Database-level collation, such as SQL\_Latin1\_General\_CP1\_CI\_AS. |  |
| 

`compatibilityLevel` \*

 | `number` **|** `null` | SQL Server compatibility level of the database, such as 150 for SQL Server 2019. |  |
| 

`databaseCreatedOn` \*

 | `number` **|** `null` | Timestamp (milliseconds since epoch) when the database was created on the SQL Server instance. |  |
| 

`isAutoCloseOn` \*

 | `boolean` **|** `null` | Whether the database shuts down cleanly and frees resources after the last user disconnects. |  |
| 

`isAutoCreateStatsOn` \*

 | `boolean` **|** `null` | Whether the query optimizer automatically creates single-column statistics. |  |
| 

`isAutoShrinkOn` \*

 | `boolean` **|** `null` | Whether the database files are periodically shrunk automatically. |  |
| 

`isAutoUpdateStatsOn` \*

 | `boolean` **|** `null` | Whether the query optimizer automatically updates out-of-date statistics. |  |
| 

`isChangeTrackingOn` \*

 | `boolean` **|** `null` | Whether change tracking is enabled on the database. |  |
| 

`isFullTextIndexingOn` \*

 | `boolean` **|** `null` | Whether full-text indexing is enabled on the database. |  |
| 

`isReadOnly` \*

 | `boolean` **|** `null` | Whether the database is in read-only mode. |  |
| 

`isRemoteDataArchiveEnabled` \*

 | `boolean` **|** `null` | Whether Remote Data Archive (Stretch Database) is enabled for the database. |  |
| 

`isTrustworthyOn` \*

 | `boolean` **|** `null` | Whether the TRUSTWORTHY database option is enabled, allowing database modules to access resources outside the database. |  |
| 

`lastFullBackupOn` \*

 | `number` **|** `null` | Timestamp (milliseconds since epoch) of the most recent full backup. |  |
| 

`lastLogBackupOn` \*

 | `number` **|** `null` | Timestamp (milliseconds since epoch) of the most recent transaction log backup. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | ARM provisioning state of the resource, such as Succeeded, Failed, or Deleting. |  |
| 

`recoveryMode` \*

 | `string` **|** `null` | Recovery model of the database: FULL, SIMPLE, or BULK\_LOGGED. |  |
| 

`region` \*

 | `string` **|** `null` | Azure region the parent Arc SQL Server instance is registered in. |  |
| 

`resourceGroup` \*

 | `string` **|** `null` | Name of the Azure resource group containing the database. |  |
| 

`sizeMB` \*

 | `number` **|** `null` | Total size of the database in megabytes. |  |
| 

`spaceAvailableMB` \*

 | `number` **|** `null` | Unused space available within the database files, in megabytes. |  |
| 

`state` \*

 | `string` **|** `null` | Current database state: Online, Offline, Restoring, Recovering, Suspect, Emergency, or OfflineSecondary. |  |

---

### Azure Arc Sql Server Instance

`azure_arc_sql_server_instance` inherits from [Database](/data-model/schemas/Database.md), [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`azureDefenderStatus` \*

 | `string` **|** `null` | Microsoft Defender for SQL status reported for the instance: Protected, Unprotected, or Unknown. |  |
| 

`azureDefenderStatusLastUpdatedOn` \*

 | `number` **|** `null` | Timestamp (milliseconds since epoch) when the Microsoft Defender for SQL status was last updated. |  |
| 

`backupFullFrequency` \*

 | `string` **|** `null` | Configured frequency of full backups, such as Weekly or Daily. |  |
| 

`backupRetentionDays` \*

 | `number` **|** `null` | Number of days automated backups are retained for the instance. |  |
| 

`backupStorageRedundancy` \*

 | `string` **|** `null` | Redundancy configured for backup storage, such as Local, Zone, or Geo. |  |
| 

`collation` \*

 | `string` **|** `null` | Server-level collation, such as SQL\_Latin1\_General\_CP1\_CI\_AS. |  |
| 

`connectionStatus` \*

 | `string` **|** `null` | Connection status of the instance to Azure Arc: Connected, Disconnected, Registered, or Unknown. |  |
| 

`containerResourceId` \*

 | `string` **|** `null` | Resource ID of the Azure Arc-enabled server hosting this SQL Server instance. |  |
| 

`cores` \*

 | `string` **|** `null` | Number of physical cores on the host running the instance. |  |
| 

`currentVersion` \*

 | `string` **|** `null` | Exact SQL Server build number currently installed. |  |
| 

`edition` \*

 | `string` **|** `null` | SQL Server edition: Evaluation, Enterprise, Standard, Web, Developer, or Express. |  |
| 

`hostType` \*

 | `string` **|** `null` | Type of host running the instance, such as Physical Server, Virtual Machine, or Container. |  |
| 

`instanceName` \*

 | `string` **|** `null` | SQL Server instance name as reported by the host, such as MSSQLSERVER for a default instance. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Arc SQL Server instance type, such as Single or AvailabilityGroup. |  |
| 

`isAzureDefenderEnabled` \*

 | `boolean` **|** `null` | Whether Microsoft Defender for SQL reports the instance as Protected. Null when the Defender status is unknown or has not been reported. |  |
| 

`licenseType` \*

 | `string` **|** `null` | License type applied to the instance: Undefined, Free, HADR, ServerCAL, LicenseOnly, PAYG, or Paid. |  |
| 

`monitoringStatus` \*

 | `string` **|** `null` | Monitoring state of the instance, such as Enabled or Disabled. |  |
| 

`patchLevel` \*

 | `string` **|** `null` | Patch level of the SQL Server installation, such as 15.0.4316.3. |  |
| 

`productId` \*

 | `string` **|** `null` | SQL Server product ID of the installation. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | ARM provisioning state of the resource, such as Succeeded, Failed, or Deleting. |  |
| 

`region` \*

 | `string` **|** `null` | Azure region the Arc SQL Server instance is registered in. |  |
| 

`resourceGroup` \*

 | `string` **|** `null` | Name of the Azure resource group containing the instance. |  |
| 

`tcpDynamicPorts` \*

 | `string` **|** `null` | Comma-separated list of dynamic TCP ports the instance listens on. |  |
| 

`tcpStaticPorts` \*

 | `string` **|** `null` | Comma-separated list of static TCP ports the instance listens on. |  |
| 

`vCore` \*

 | `string` **|** `null` | Number of virtual cores available to the instance. |  |
| 

`version` \*

 | `string` **|** `null` | SQL Server product version, such as "SQL Server 2019" or "SQL Server 2022". |  |

---

### Azure Authentication Methods Policy

`azure_authentication_methods_policy` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `attestationEnforced` | `boolean` |  |  |
| `certificateValidationEnabled` | `boolean` |  |  |
| `defaultLifetimeMinutes` | `number` |  |  |
| `disabledAuthenticationMethods` | `array` of `string`s |  |  |
| `enabledAuthenticationMethods` | `array` of `string`s |  |  |
| `externalIdEmailOtpAllowed` | `string` |  |  |
| `hasExclusions` | `array` of `string`s |  |  |
| `includeAllUsers` | `array` of `string`s |  |  |
| `isRegistrationEnforced` | `boolean` |  |  |
| `isUsableOnce` | `boolean` |  |  |
| `keyRestrictionsEnforced` | `boolean` |  |  |
| `lastModifiedDateTime` | `number` **|** `null` |  |  |
| `maximumLifetimeMinutes` | `number` |  |  |
| `minimumLifetimeMinutes` | `number` |  |  |
| `officePhoneAllowed` | `boolean` |  |  |
| `policyMigrationState` | `string` **|** `null` |  |  |
| `policyVersion` | `string` **|** `null` |  |  |
| `registrationCampaignState` | `string` |  |  |
| `registrationSnoozeDays` | `number` |  |  |
| `requiresRegistration` | `array` of `string`s |  |  |
| `selfServiceRegistrationAllowed` | `boolean` |  |  |
| `softwareOathEnabled` | `boolean` |  |  |

---

### Azure Authentication Strength Policy

`azure_authentication_strength_policy` inherits from [PasswordPolicy](/data-model/schemas/PasswordPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowedCombinations` | `array` of `string`s |  |  |
| `description` | `string` |  |  |
| `policyType` | `string` |  |  |
| `requirementsSatisfied` | `string` |  |  |

---

### Azure Authorization Policy

`azure_authorization_policy` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowedToSignUpEmailBasedSubscriptions` | `boolean` |  |  |
| `allowedToUseSSPR` | `boolean` |  |  |
| `allowEmailVerifiedUsersToJoinOrganization` | `boolean` |  |  |
| `allowInvitesFrom` | `string` **|** `null` |  |  |
| `allowUserConsentForRiskyApps` | `boolean` **|** `null` |  |  |
| `blockMsolPowerShell` | `boolean` **|** `null` |  |  |
| `defaultUserRolePermissions.allowedToCreateApps` | `boolean` |  |  |
| `defaultUserRolePermissions.allowedToCreateSecurityGroups` | `boolean` |  |  |
| `defaultUserRolePermissions.allowedToCreateTenants` | `boolean` **|** `null` |  |  |
| `defaultUserRolePermissions.allowedToReadBitlockerKeysForOwnedDevice` | `boolean` **|** `null` |  |  |
| `defaultUserRolePermissions.allowedToReadOtherUsers` | `boolean` |  |  |
| `defaultUserRolePermissions.permissionGrantPoliciesAssigned` | `array` **|** `null` |  |  |

---

### Azure Backup Protected Item

`azure_backup_protected_item` inherits from [Backup](/data-model/schemas/Backup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `backupEngineName` | `string` **|** `null` | Name of the DPM/MABS backup engine managing the item. |  |
| `backupManagementType` | `string` **|** `null` | Backup management engine handling the item: "AzureIaasVM", "AzureWorkload", "AzureStorage", "AzureSql", "MAB", or "DPM". |  |
| `backupSetName` | `string` **|** `null` | Name of the backup set the item belongs to. |  |
| `computerName` | `string` **|** `null` | Name of the on-premises machine backed up by a MAB (Azure Backup agent) item. |  |
| `containerName` | `string` **|** `null` | Name of the protection container holding the item; the only stable identifier for MAB/DPM items that have no ARM resource ID. |  |
| `deferredDeleteOn` | `number` **|** `null` | Timestamp (ms since epoch) at which the soft-deleted item is scheduled for permanent deletion. |  |
| `deferredDeleteTimeRemaining` | `string` **|** `null` | Free-form time remaining before permanent deletion, as reported by Azure (e.g. "13 days"). |  |
| `friendlyName` | `string` **|** `null` | Human-readable name of the protected datasource - the file share name, the "instance/database" pair, or the VM name depending on subtype. |  |
| `hasResourceGuardOperationRequests` | `boolean` **|** `null` | Whether a Resource Guard (Multi-User Authorization) protects critical operations on this item. |  |
| `healthStatus` | `string` **|** `null` | Backup health of an IaaS VM item: "Passed", "ActionRequired", "ActionSuggested", or "Invalid". Only populated for IaaS VM subtypes - null for SQL, SAP HANA, and file share items. |  |
| `isArchiveEnabled` | `boolean` **|** `null` | Whether recovery points for this item are moved to the archive tier, which changes restore latency. |  |
| `isDeferredDeleteScheduleUpcoming` | `boolean` **|** `null` | Whether permanent deletion of the soft-deleted backup data is imminent. |  |
| `isPolicyInconsistent` | `boolean` **|** `null` | Whether the effective backup policy is inconsistent with the assigned policy, normalized from `policyInconsistent` (IaaS VM) and `policyState === "Inconsistent"` (all other subtypes). May be null if the vault-scoped listing omits extended info. |  |
| `isRehydrate` | `boolean` **|** `null` | Whether an archived recovery point for this item is currently being rehydrated. |  |
| `isScheduledForDeferredDelete` | `boolean` **|** `null` | Whether the item has been soft-deleted and its backup data is on a countdown to permanent deletion. |  |
| `lastBackupErrorCode` | `string` **|** `null` | Error code from the most recent failed backup, flattened from the error detail object. |  |
| `lastBackupErrorMessage` | `string` **|** `null` | Error message from the most recent failed backup, flattened from the error detail object. |  |
| `lastBackupOn` | `number` **|** `null` | Timestamp (ms since epoch) of the most recent backup attempt. Null for Azure SQL protected items, which do not report it. A stale value indicates backups have stopped running. |  |
| `lastBackupStatus` | `string` **|** `null` | Status of the most recent backup. The vocabulary varies by subtype (IaaS VM items report free-form values such as "Completed"; workload items report "Healthy"/"Unhealthy"/"IRPending"), so treat it as an opaque string. |  |
| `lastRecoveryPointOn` | `number` **|** `null` | Timestamp (ms since epoch) of the newest recovery point available for this item. |  |
| `oldestRecoveryPointOn` | `number` **|** `null` | Timestamp (ms since epoch) of the oldest recovery point still retained - the floor of the restore window. May be null if the vault-scoped listing omits extended info. |  |
| `parentName` | `string` **|** `null` | SQL instance or availability group containing the protected database. Not an ARM resource ID. |  |
| `parentType` | `string` **|** `null` | Kind of parent recorded in `parentName`, e.g. "SQLInstance" or "SQLAG". |  |
| `policyName` | `string` **|** `null` | Name of the backup policy assigned to this item, which determines backup frequency and retention. |  |
| `policyType` | `string` **|** `null` | Backup policy generation for IaaS VM items: "V1" or "V2". Null for other subtypes. |  |
| `protectedItemHealthStatus` | `string` **|** `null` | Health of an in-VM workload item: "Healthy", "Unhealthy", "NotReachable", or "IRPending". Only populated for AzureVmWorkload subtypes. |  |
| `protectedItemType` | `string` **|** `null` | Wire discriminator for the protected item, e.g. "Microsoft.Compute/virtualMachines", "AzureFileShareProtectedItem", or "AzureVmWorkloadSQLDatabase". |  |
| `protectionState` | `string` **|** `null` | Backup protection state. Anything other than "Protected" (e.g. "ProtectionStopped", "ProtectionError", "ProtectionPaused", "BackupsSuspended", "IRPending") means the datasource is not currently being protected. |  |
| `protectionStatus` | `string` **|** `null` | Overall protection status reported for IaaS VM items: "Healthy" or "Unhealthy". Null for non-IaaS-VM workloads. |  |
| `recoveryPointCount` | `number` **|** `null` | Number of recovery points retained for this item. Zero means the datasource has never been successfully backed up. May be null if the vault-scoped listing omits extended info. |  |
| `region` | `string` **|** `null` | Azure region of the Recovery Services vault holding this item. |  |
| `resourceGroup` | `string` **|** `null` | Resource group of the Recovery Services vault holding this item. |  |
| `serverName` | `string` **|** `null` | Host or cluster name running the in-VM workload. Only populated for AzureVmWorkload subtypes. |  |
| `softDeleteRetentionPeriodInDays` | `number` **|** `null` | Number of days soft-deleted backup data is retained before permanent deletion - the ransomware recovery window. |  |
| `workloadType` | `string` **|** `null` | Datasource type being backed up, e.g. "VM", "AzureFileShare", "SQLDataBase", or "SAPHanaDatabase". |  |

---

### Azure Bot Service Bot

`azure_bot_service_bot` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`appPasswordHint` \*

 | `string` **|** `null` |  |  |
| 

`category` \*

 | `array` **|** `null` |  |  |
| 

`cmekEncryptionStatus` \*

 | `string` **|** `null` |  |  |
| 

`cmekKeyVaultUrl` \*

 | `string` **|** `null` |  |  |
| 

`configuredChannels` \*

 | `array` **|** `null` |  |  |
| 

`description` \*

 | `string` **|** `null` |  |  |
| 

`developerAppInsightKey` \*

 | `string` **|** `null` |  |  |
| 

`developerAppInsightsApiKey` \*

 | `string` **|** `null` |  |  |
| 

`developerAppInsightsApplicationId` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` **|** `null` |  |  |
| 

`enabledChannels` \*

 | `array` **|** `null` |  |  |
| 

`endpoint` \*

 | `string` **|** `null` |  |  |
| 

`endpointVersion` \*

 | `string` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`iconUrl` \*

 | `string` **|** `null` |  |  |
| 

`identityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`identityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`identityType` \*

 | `string` **|** `null` |  |  |
| 

`isCmekEnabled` \*

 | `boolean` |  |  |
| 

`isDeveloperAppInsightsApiKeySet` \*

 | `boolean` **|** `null` |  |  |
| 

`isLocalAuthenticationEnabled` \*

 | `boolean` |  |  |
| 

`isStreamingSupported` \*

 | `boolean` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`luisAppIds` \*

 | `array` **|** `null` |  |  |
| 

`luisKey` \*

 | `string` **|** `null` |  |  |
| 

`manifestUrl` \*

 | `string` **|** `null` |  |  |
| 

`migrationToken` \*

 | `string` **|** `null` |  |  |
| 

`msaAppId` \*

 | `string` **|** `null` |  |  |
| 

`msaAppMSIResourceId` \*

 | `string` **|** `null` |  |  |
| 

`msaAppTenantId` \*

 | `string` **|** `null` |  |  |
| 

`msaAppType` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`openWithHint` \*

 | `string` **|** `null` |  |  |
| 

`provisioningState` \*

 | `string` **|** `null` |  |  |
| 

`publicNetworkAccess` \*

 | `string` **|** `null` |  |  |
| 

`publishingCredentials` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`schemaTransformationVersion` \*

 | `string` **|** `null` |  |  |
| 

`skuName` \*

 | `string` **|** `null` |  |  |
| 

`skuTier` \*

 | `string` **|** `null` |  |  |
| 

`storageResourceId` \*

 | `string` **|** `null` |  |  |
| 

`tenantId` \*

 | `string` **|** `null` |  |  |
| 

`zones` \*

 | `array` **|** `null` |  |  |

---

### Azure Bot Service Channel

`azure_bot_service_channel` inherits from [Channel](/data-model/schemas/Channel.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` **|** `null` |  |  |
| 

`channelName` \*

 | `string` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |

---

### Azure Container Registry Repository

`azure_container_registry_repository` inherits from [Repository](/data-model/schemas/Repository.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`registry` \*

 | `string` | The registry login server this repository belongs to. |  |
| 

`repositoryName` \*

 | `string` | The repository (image) name within the registry. |  |

---

### Azure Data Factory

`azure_data_factory` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `encryptionIdentityUserAssigned` | `string` **|** `null` | ARM ID of the user-assigned identity used to reach the customer-managed key. Null when the system-assigned identity is used. |  |
| `encryptionKeyName` | `string` **|** `null` | Name of the Key Vault key used as the customer-managed key (CMK) for the factory. Null when Microsoft-managed encryption is used. |  |
| `encryptionKeyVersion` | `string` **|** `null` | Version of the customer-managed key. Null when the latest version is tracked automatically. |  |
| `encryptionVaultBaseUrl` | `string` **|** `null` | Base URL of the Key Vault holding the customer-managed key. |  |
| `etag` | `string` **|** `null` | ARM entity tag of the factory resource. |  |
| `identityPrincipalId` | `string` **|** `null` | Object ID of the factory system-assigned managed identity. |  |
| `identityTenantId` | `string` **|** `null` | Entra ID tenant ID of the factory managed identity. |  |
| `identityType` | `string` **|** `null` | Managed identity type: "SystemAssigned", "UserAssigned", or "SystemAssigned,UserAssigned". |  |
| `identityUserAssignedIdentityIds` | `array` **|** `null` | ARM IDs of the user-assigned managed identities attached to the factory. |  |
| `isPublicNetworkAccessEnabled` | `boolean` **|** `null` | Whether the factory accepts traffic from public networks. False when access is restricted to private endpoints. |  |
| `isRepoPublishDisabled` | `boolean` **|** `null` | Whether manual publishing from the Data Factory studio is disabled in favor of automated CI/CD publishing. |  |
| `provisioningState` | `string` **|** `null` | Provisioning state of the factory, e.g. "Succeeded" or "Failed". |  |
| `purviewResourceId` | `string` **|** `null` | ARM ID of the Microsoft Purview account the factory reports lineage to. |  |
| `region` | `string` **|** `null` | Azure region hosting the factory. |  |
| `repoAccountName` | `string` **|** `null` | Git account or organization name. |  |
| `repoClientId` | `string` **|** `null` | Client ID of the GitHub bring-your-own-app used for repository access. Null for GitHub Enterprise apps and Azure DevOps repositories. |  |
| `repoCollaborationBranch` | `string` **|** `null` | Git branch that factory publishes are made from, e.g. "main". |  |
| `repoHostName` | `string` **|** `null` | GitHub Enterprise host name. Null for github.com and for Azure DevOps repositories. |  |
| `repoLastCommitId` | `string` **|** `null` | Commit ID of the most recent publish from the collaboration branch. |  |
| `repoProjectName` | `string` **|** `null` | Azure DevOps project name. Null for GitHub repositories. |  |
| `repoRepositoryName` | `string` **|** `null` | Git repository name backing the factory. |  |
| `repoRootFolder` | `string` **|** `null` | Folder within the repository holding the factory resources. |  |
| `repoTenantId` | `string` **|** `null` | Entra ID tenant ID of the Azure DevOps organization. Null for GitHub repositories. |  |
| `repoType` | `string` **|** `null` | Git repository configuration type: "FactoryGitHubConfiguration" or "FactoryVSTSConfiguration". Null when the factory is in live mode with no Git integration. |  |
| `resourceGroup` | `string` **|** `null` | Resource group name extracted from the ARM ID. |  |
| `version` | `string` **|** `null` | Data Factory version, e.g. "2018-06-01". |  |

---

### Azure Data Factory Integration Runtime

`azure_data_factory_integration_runtime` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authorizationType` | `string` **|** `null` | Authorization used to share a self-hosted integration runtime: "Key" or "RBAC". Null when the runtime is not linked from another factory. |  |
| `computeLocation` | `string` **|** `null` | Region the managed integration runtime compute runs in. May differ from the factory region. |  |
| `customerVirtualNetworkSubnetId` | `string` **|** `null` | ARM ID of the customer subnet an Azure-SSIS integration runtime joins. |  |
| `dataFlowComputeType` | `string` **|** `null` | Data flow cluster compute type: "General", "MemoryOptimized", or "ComputeOptimized". |  |
| `dataFlowCoreCount` | `number` **|** `null` | Core count of the data flow cluster. |  |
| `dataFlowTimeToLive` | `number` **|** `null` | Minutes the data flow cluster stays alive after a run before being recycled. |  |
| `edition` | `string` **|** `null` | SSIS integration runtime edition: "Standard" or "Enterprise". Null for non-SSIS runtimes. |  |
| `factoryId` | `string` **|** `null` | ARM ID of the factory that owns this integration runtime. |  |
| `isManagedVirtualNetworkEnabled` | `boolean` **|** `null` | Whether the integration runtime runs inside a Data Factory managed virtual network. |  |
| `licenseType` | `string` **|** `null` | SSIS license model: "BasePrice" (bring your own license) or "LicenseIncluded". Null for non-SSIS runtimes. |  |
| `linkedFactoryResourceId` | `string` **|** `null` | ARM ID of the shared integration runtime this runtime links to. |  |
| `managedVirtualNetworkName` | `string` **|** `null` | Name of the managed virtual network the integration runtime runs in. |  |
| `publicIps` | `array` **|** `null` | ARM IDs of the static public IP addresses the integration runtime uses for outbound traffic. |  |
| `resourceGroup` | `string` **|** `null` | Resource group name extracted from the ARM ID. |  |
| `runtimeType` | `string` **|** `null` | Integration runtime type: "Managed" or "SelfHosted". |  |
| `ssisCustomSetupBlobContainerUri` | `string` **|** `null` | URI of the blob container holding the custom setup script for an Azure-SSIS integration runtime. |  |
| `state` | `string` **|** `null` | Integration runtime state, e.g. "Started", "Stopped", "Online", "Offline", or "AccessDenied". |  |
| `subnetId` | `string` **|** `null` | ARM ID of the subnet the integration runtime joins within the customer virtual network. |  |
| `subnetName` | `string` **|** `null` | Name of the subnet the integration runtime joins. |  |
| `vNetId` | `string` **|** `null` | ARM ID of the customer virtual network the integration runtime joins. Null for runtimes not joined to a virtual network. |  |

---

### Azure Data Factory Linked Service

`azure_data_factory_linked_service` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `connectViaIntegrationRuntime` | `string` **|** `null` | Name of the integration runtime this linked service connects through. Null when the default AutoResolve runtime is used. |  |
| `connectViaIntegrationRuntimeType` | `string` **|** `null` | Reference type of the integration runtime, always "IntegrationRuntimeReference" when set. |  |
| `factoryId` | `string` **|** `null` | ARM ID of the factory that owns this linked service. |  |
| `isCredentialStoredInKeyVault` | `boolean` **|** `null` | Whether at least one credential for this linked service resolves from Key Vault rather than being stored inline. |  |
| `keyVaultBaseUrl` | `string` **|** `null` | Base URL of the Key Vault this linked service connects to. Only set for "AzureKeyVault" linked services. |  |
| `keyVaultSecretNames` | `array` **|** `null` | Names of the Key Vault secrets this linked service resolves its credentials from. Empty when credentials are stored inline instead of in Key Vault. |  |
| `keyVaultStoreLinkedServiceNames` | `array` **|** `null` | Names of the Key Vault linked services holding the secrets this linked service references. |  |
| `resourceGroup` | `string` **|** `null` | Resource group name extracted from the ARM ID. |  |
| `serviceType` | `string` **|** `null` | Linked service type, e.g. "AzureBlobStorage", "AzureSqlDatabase", or "AzureKeyVault". |  |

---

### Azure Data Factory Managed Private Endpoint

`azure_data_factory_managed_private_endpoint` inherits from [NetworkEndpoint](/data-model/schemas/NetworkEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `connectionActionsRequired` | `string` **|** `null` | Actions the consumer must take on the private link connection, e.g. "None". |  |
| `connectionDescription` | `string` **|** `null` | Description recorded with the private link connection approval or rejection. |  |
| `connectionStatus` | `string` **|** `null` | Private link connection status: "Pending", "Approved", "Rejected", or "Disconnected". |  |
| `factoryId` | `string` **|** `null` | ARM ID of the factory that owns this managed private endpoint. |  |
| `fqdns` | `array` **|** `null` | Fully qualified domain names resolved through this managed private endpoint. |  |
| `groupId` | `string` **|** `null` | Private link sub-resource the endpoint targets, e.g. "blob", "sqlServer", or "vault". |  |
| `isReserved` | `boolean` **|** `null` | Whether the managed private endpoint is reserved by Data Factory rather than user-created. |  |
| `managedVirtualNetworkName` | `string` **|** `null` | Name of the managed virtual network containing this managed private endpoint. |  |
| `privateLinkResourceId` | `string` **|** `null` | ARM ID of the Azure resource this managed private endpoint connects outbound to. |  |
| `provisioningState` | `string` **|** `null` | Provisioning state of the managed private endpoint, e.g. "Succeeded". |  |
| `resourceGroup` | `string` **|** `null` | Resource group name extracted from the ARM ID. |  |

---

### Azure Data Factory Managed Virtual Network

`azure_data_factory_managed_virtual_network` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `alias` | `string` **|** `null` | Managed virtual network alias, usually the factory name. |  |
| `factoryId` | `string` **|** `null` | ARM ID of the factory that owns this managed virtual network. |  |
| `isPreventDataExfiltration` | `boolean` **|** `null` | Whether data exfiltration protection is enabled, restricting outbound traffic to approved managed private endpoints. |  |
| `resourceGroup` | `string` **|** `null` | Resource group name extracted from the ARM ID. |  |
| `vNetId` | `string` **|** `null` | Managed virtual network ID assigned by Data Factory. |  |

---

### Azure Data Protection Backup Vault

`azure_data_protection_backup_vault` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`bcdrSecurityLevel` \*

 | `string` **|** `null` |  |  |
| 

`category` \*

 | `array` **|** `null` |  |  |
| 

`crossRegionRestoreState` \*

 | `string` **|** `null` |  |  |
| 

`crossSubscriptionRestoreState` \*

 | `string` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`identityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`identityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`identityType` \*

 | `string` **|** `null` |  |  |
| 

`immutabilityState` \*

 | `string` **|** `null` |  |  |
| 

`isVaultProtectedByResourceGuard` \*

 | `boolean` |  |  |
| 

`keyVaultUri` \*

 | `string` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`replicatedRegions` \*

 | `array` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`secureScore` \*

 | `string` **|** `null` |  |  |
| 

`softDeleteRetentionDurationInDays` \*

 | `number` **|** `null` |  |  |
| 

`softDeleteState` \*

 | `string` **|** `null` |  |  |
| 

`storageSettingDataStoreType` \*

 | `string` **|** `null` |  |  |
| 

`storageSettingType` \*

 | `string` **|** `null` |  |  |

---

### Azure Databricks Workspace

`azure_databricks_workspace` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`amlWorkspaceId` \*

 | `string` **|** `null` |  |  |
| 

`category` \*

 | `array` **|** `null` |  |  |
| 

`customPrivateSubnetName` \*

 | `string` **|** `null` |  |  |
| 

`customPublicSubnetName` \*

 | `string` **|** `null` |  |  |
| 

`customVirtualNetworkId` \*

 | `string` **|** `null` |  |  |
| 

`diskEncryptionSetId` \*

 | `string` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`isInfrastructureEncryptionRequired` \*

 | `boolean` **|** `null` |  |  |
| 

`isPublicIpEnabled` \*

 | `boolean` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`loadBalancerBackendPoolName` \*

 | `string` **|** `null` |  |  |
| 

`loadBalancerId` \*

 | `string` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`managedDiskEncryptionKeySource` \*

 | `string` **|** `null` |  |  |
| 

`managedDiskIdentityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`managedDiskIdentityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`managedDiskIdentityType` \*

 | `string` **|** `null` |  |  |
| 

`managedResourceGroupId` \*

 | `string` **|** `null` |  |  |
| 

`managedServicesEncryptionKeySource` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`natGatewayName` \*

 | `string` **|** `null` |  |  |
| 

`privateEndpointConnections` \*

 | `array` **|** `null` |  |  |
| 

`publicIpName` \*

 | `string` **|** `null` |  |  |
| 

`publicNetworkAccess` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`requiredNsgRules` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`skuName` \*

 | `string` **|** `null` |  |  |
| 

`skuTier` \*

 | `string` **|** `null` |  |  |
| 

`storageAccountIdentityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`storageAccountIdentityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`storageAccountIdentityType` \*

 | `string` **|** `null` |  |  |
| 

`storageAccountName` \*

 | `string` **|** `null` |  |  |
| 

`vnetAddressPrefix` \*

 | `string` **|** `null` |  |  |
| 

`workspaceId` \*

 | `string` **|** `null` |  |  |
| 

`workspaceUrl` \*

 | `string` **|** `null` |  |  |

---

### Azure Defender Alert

`azure_defender_alert` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`blocking` \*

 | `boolean` |  |  |
| `id` | `string` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Azure Desktop Virtualization Application Group

`azure_desktop_virtualization_application_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationGroupType` \*

 | `string` **|** `null` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| 

`friendlyName` \*

 | `string` **|** `null` |  |  |
| 

`hostPoolArmPath` \*

 | `string` **|** `null` |  |  |
| 

`identityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`identityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`identityType` \*

 | `string` **|** `null` |  |  |
| 

`isCloudPcResource` \*

 | `boolean` **|** `null` |  |  |
| 

`isShownInFeed` \*

 | `boolean` **|** `null` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`objectId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`skuName` \*

 | `string` **|** `null` |  |  |
| 

`skuTier` \*

 | `string` **|** `null` |  |  |
| 

`workspaceArmPath` \*

 | `string` **|** `null` |  |  |

---

### Azure Desktop Virtualization Desktop

`azure_desktop_virtualization_desktop` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`friendlyName` \*

 | `string` **|** `null` |  |  |
| 

`iconHash` \*

 | `string` **|** `null` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`objectId` \*

 | `string` **|** `null` |  |  |

---

### Azure Desktop Virtualization Host Pool

`azure_desktop_virtualization_host_pool` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentUpdateType` \*

 | `string` **|** `null` |  |  |
| 

`customRdpProperty` \*

 | `string` **|** `null` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| 

`friendlyName` \*

 | `string` **|** `null` |  |  |
| 

`hostPoolType` \*

 | `string` **|** `null` |  |  |
| 

`identityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`identityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`identityType` \*

 | `string` **|** `null` |  |  |
| 

`isAgentUpdateUseSessionHostLocalTime` \*

 | `boolean` **|** `null` |  |  |
| 

`isCloudPcResource` \*

 | `boolean` **|** `null` |  |  |
| 

`isStartVMOnConnectEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isValidationEnvironment` \*

 | `boolean` **|** `null` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`loadBalancerType` \*

 | `string` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`maxSessionLimit` \*

 | `number` **|** `null` |  |  |
| 

`objectId` \*

 | `string` **|** `null` |  |  |
| 

`personalDesktopAssignmentType` \*

 | `string` **|** `null` |  |  |
| 

`preferredAppGroupType` \*

 | `string` **|** `null` |  |  |
| 

`privateEndpointConnectionIds` \*

 | `array` **|** `null` |  |  |
| 

`publicNetworkAccess` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`registrationTokenExpirationOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`ring` \*

 | `number` **|** `null` |  |  |
| 

`skuName` \*

 | `string` **|** `null` |  |  |
| 

`skuTier` \*

 | `string` **|** `null` |  |  |
| 

`ssoadfsAuthority` \*

 | `string` **|** `null` |  |  |
| 

`ssoClientId` \*

 | `string` **|** `null` |  |  |
| 

`ssoSecretType` \*

 | `string` **|** `null` |  |  |
| 

`vmTemplate` \*

 | `string` **|** `null` |  |  |

---

### Azure Desktop Virtualization Workspace

`azure_desktop_virtualization_workspace` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationGroupReferences` \*

 | `array` **|** `null` |  |  |
| 

`category` \*

 | `array` **|** `null` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| 

`friendlyName` \*

 | `string` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`identityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`identityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`identityType` \*

 | `string` **|** `null` |  |  |
| 

`isCloudPcResource` \*

 | `boolean` **|** `null` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`objectId` \*

 | `string` **|** `null` |  |  |
| 

`privateEndpointConnectionIds` \*

 | `array` **|** `null` |  |  |
| 

`publicNetworkAccess` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`skuName` \*

 | `string` **|** `null` |  |  |
| 

`skuTier` \*

 | `string` **|** `null` |  |  |

---

### Azure Device

`azure_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aadDeviceId` | `string` |  |  |
| `active` | `boolean` |  |  |
| `alternativeSecurityIds` | `array` of `string`s |  |  |
| `approximateLastSignInDateTime` | `number` |  |  |
| `complianceExpirationDateTime` | `string` |  |  |
| `deviceMetadata` | `string` |  |  |
| `deviceVersion` | `number` |  |  |
| `isCompliant` | `boolean` |  |  |
| `isManaged` | `boolean` |  |  |
| `manufacturer` | `string` |  |  |
| `name` | `string` |  |  |
| `onPremisesLastSyncDateTime` | `number` |  |  |
| `onPremisesSyncEnabled` | `boolean` |  |  |
| `operatingSystem` | `string` |  |  |
| `operatingSystemVersion` | `string` |  |  |
| `physicalIds` | `array` of `string`s |  |  |
| `profileType` | `string` |  |  |
| `registeredUsers` | `array` of `string`s |  |  |
| `systemLabels` | `array` of `string`s |  |  |
| `trustType` | `string` |  |  |

---

### Azure Device Registration Policy

`azure_device_registration_policy` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `description` | `string` |  |  |
| `isAdminConfigurable` | `boolean` |  |  |
| `isLocalAdminPasswordEnabled` | `boolean` |  |  |
| `multiFactorAuthConfiguration` | `string` |  |  |
| `userDeviceQuota` | `number` |  |  |

---

### Azure Easm Workspace

`azure_easm_workspace` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `dataPlaneEndpoint` | `string` |  |  |
| `location` | `string` |  |  |
| `provisioningState` | `string` |  |  |
| `type` | `string` |  |  |
| `webLink` | `string` |  |  |

---

### Azure Fabric Capacity

`azure_fabric_capacity` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `administrationMembers` | `array` **|** `null` | User principal names or object IDs of the capacity administrators. |  |
| `location` | `string` **|** `null` | Azure region the capacity is provisioned in. |  |
| `provisioningState` | `string` **|** `null` | Provisioning state of the capacity, e.g. "Succeeded", "Failed". |  |
| `resourceGroupName` | `string` **|** `null` | Name of the resource group containing the capacity. |  |
| `skuName` | `string` **|** `null` | Capacity SKU name, e.g. "F2", "F64". |  |
| `skuTier` | `string` **|** `null` | Capacity SKU tier, e.g. "Fabric". |  |
| `state` | `string` **|** `null` | Capacity lifecycle state, e.g. "Active", "Paused", "Suspended". |  |
| `type` | `string` **|** `null` | Azure resource type, always "Microsoft.Fabric/capacities". |  |
| `webLink` | `string` | Azure portal URL for the capacity. |  |

---

### Azure Fabric Dashboard

`azure_fabric_dashboard` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appId` | `string` **|** `null` | Identifier of the Power BI app the dashboard belongs to, if any. |  |
| `dataClassification` | `string` **|** `null` | Data classification tag applied to the dashboard in Power BI. |  |
| `isReadOnly` | `boolean` **|** `null` | Whether the dashboard is read-only. |  |
| `sensitivityLabelId` | `string` **|** `null` | Identifier of the Microsoft Purview sensitivity label applied to the dashboard. |  |

---

### Azure Fabric Dataflow

`azure_fabric_dataflow` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `certifiedBy` | `string` **|** `null` | Display name of the user who certified the dataflow. |  |
| `configuredBy` | `string` **|** `null` | Display name of the dataflow owner. |  |
| `endorsement` | `string` **|** `null` | Endorsement status, e.g. "Promoted" or "Certified". |  |
| `modelUrl` | `string` **|** `null` | URL of the dataflow definition file (model.json). |  |
| `sensitivityLabelId` | `string` **|** `null` | Identifier of the Microsoft Purview sensitivity label applied to the dataflow. |  |

---

### Azure Fabric Datamart

`azure_fabric_datamart` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `certifiedBy` | `string` **|** `null` | Display name of the user who certified the datamart. |  |
| `configuredBy` | `string` **|** `null` | Display name of the datamart owner. |  |
| `configuredById` | `string` **|** `null` | Identifier of the datamart owner. |  |
| `datamartType` | `string` **|** `null` | Datamart type, e.g. "Sql" or "Kusto". |  |
| `endorsement` | `string` **|** `null` | Endorsement status, e.g. "Promoted" or "Certified". |  |
| `modifiedById` | `string` **|** `null` | Identifier of the user who last modified the datamart. |  |
| `sensitivityLabelId` | `string` **|** `null` | Identifier of the Microsoft Purview sensitivity label applied to the datamart. |  |
| `state` | `string` **|** `null` | Current datamart state, e.g. "Active" or "Deleted". |  |

---

### Azure Fabric Datasource

`azure_fabric_datasource` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `connectionDatabase` | `string` **|** `null` | Database named in the connection details. |  |
| `connectionKind` | `string` **|** `null` | Connection kind reported for the data source. |  |
| `connectionPath` | `string` **|** `null` | Path named in the connection details. |  |
| `connectionServer` | `string` **|** `null` | Server named in the connection details. |  |
| `connectionUrl` | `string` **|** `null` | URL named in the connection details. |  |
| `datasourceType` | `string` **|** `null` | Type of the data source, e.g. "Sql", "AnalysisServices", "Web", "SharePointList". |  |
| `gatewayId` | `string` **|** `null` | Identifier of the on-premises data gateway the source is bound to, when it is bound to one. |  |

---

### Azure Fabric Domain

`azure_fabric_domain` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `contributorsScope` | `string` **|** `null` | Who may contribute to the domain, e.g. "AllTenant", "SpecificUsersAndGroups", "AdminsOnly". |  |
| `parentDomainId` | `string` **|** `null` | Identifier of the parent domain, when this is a subdomain. |  |

---

### Azure Fabric Report

`azure_fabric_report` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appId` | `string` **|** `null` | Identifier of the Power BI app the report belongs to, if any. |  |
| `certifiedBy` | `string` **|** `null` | Display name of the user who certified the report. |  |
| `createdById` | `string` **|** `null` | Identifier of the user who created the report. |  |
| `endorsement` | `string` **|** `null` | Endorsement status, e.g. "Promoted" or "Certified". |  |
| `modifiedById` | `string` **|** `null` | Identifier of the user who last modified the report. |  |
| `reportType` | `string` **|** `null` | Report type, either "PowerBIReport" or "PaginatedReport". |  |
| `sensitivityLabelId` | `string` **|** `null` | Identifier of the Microsoft Purview sensitivity label applied to the report. |  |

---

### Azure Fabric Semantic Model

`azure_fabric_semantic_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `certifiedBy` | `string` **|** `null` | Display name of the user who certified the model. |  |
| `configuredBy` | `string` **|** `null` | Display name of the semantic model owner. |  |
| `contentProviderType` | `string` **|** `null` | How the model was authored, e.g. "PowerBIDesktop", "PbixInImportMode", "Excel". |  |
| `endorsement` | `string` **|** `null` | Endorsement status, e.g. "Promoted" or "Certified". |  |
| `sensitivityLabelId` | `string` **|** `null` | Identifier of the Microsoft Purview sensitivity label applied to the model. |  |
| `targetStorageMode` | `string` **|** `null` | Storage mode of the model, e.g. "Abf" (import) or "PremiumFiles". |  |

---

### Azure Fabric Tenant Setting

`azure_fabric_tenant_setting` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `enabledSecurityGroupIds` | `array` **|** `null` | Microsoft Graph IDs of the security groups the setting is enabled for. |  |
| `enabledSecurityGroupNames` | `array` **|** `null` | Names of the security groups the setting is enabled for. |  |
| `excludedSecurityGroupIds` | `array` **|** `null` | Microsoft Graph IDs of the security groups excluded from the setting. |  |
| `excludedSecurityGroupNames` | `array` **|** `null` | Names of the security groups excluded from the setting. |  |
| `isDelegableToCapacity` | `boolean` **|** `null` | Whether a capacity administrator may override this setting for their capacity. |  |
| `isDelegableToDomain` | `boolean` **|** `null` | Whether a domain administrator may override this setting for their domain. |  |
| `isDelegableToWorkspace` | `boolean` **|** `null` | Whether a workspace administrator may override this setting for their workspace. |  |
| `isEnabled` | `boolean` **|** `null` | Whether the setting is turned on for the tenant. True - enabled, False - disabled. |  |
| `isGroupRestricted` | `boolean` **|** `null` | Whether the setting applies only to specific security groups rather than the entire organization. |  |
| 
`settingName` \*

 | `string` | Programmatic name of the tenant setting, e.g. "ExportToExcel". |  |
| `settingProperties` | `array` **|** `null` | Configuration values attached to the setting, formatted as `name=value` strings (or just `name` when the value is empty). |  |
| `tenantSettingGroup` | `string` **|** `null` | Admin portal group the setting belongs to, e.g. "Export and sharing settings". |  |
| `title` | `string` **|** `null` | Human readable title of the setting as shown in the Fabric admin portal. |  |

---

### Azure Fabric Tenant Setting Override

`azure_fabric_tenant_setting_override` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `delegatedFrom` | `string` **|** `null` | Level the setting was delegated from: "Tenant", "Capacity" or "Domain". |  |
| `enabledSecurityGroupIds` | `array` **|** `null` | Microsoft Graph IDs of the security groups the override is enabled for. |  |
| `enabledSecurityGroupNames` | `array` **|** `null` | Names of the security groups the override is enabled for. |  |
| `excludedSecurityGroupIds` | `array` **|** `null` | Microsoft Graph IDs of the security groups excluded from the override. |  |
| `excludedSecurityGroupNames` | `array` **|** `null` | Names of the security groups excluded from the override. |  |
| `isDelegableToWorkspace` | `boolean` **|** `null` | Whether a workspace administrator may further override this setting. |  |
| `isEnabled` | `boolean` **|** `null` | Whether the setting is turned on for this scope, which may differ from the tenant default. |  |
| `isGroupRestricted` | `boolean` **|** `null` | Whether the override applies only to specific security groups rather than everyone in scope. |  |
| 
`scopeType` \*

 | `string` | Level the override was applied at: "Workspace", "Capacity" or "Domain". |  |
| 

`settingName` \*

 | `string` | Programmatic name of the overridden tenant setting, e.g. "ExportToExcel". |  |
| `settingProperties` | `array` **|** `null` | Configuration values attached to the override, formatted as `name=value` strings (or just `name` when the value is empty). |  |
| `tenantSettingGroup` | `string` **|** `null` | Admin portal group the setting belongs to, e.g. "Export and sharing settings". |  |
| `title` | `string` **|** `null` | Human readable title of the setting as shown in the Fabric admin portal. |  |

---

### Azure Fabric Workspace

`azure_fabric_workspace` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `capacityId` | `string` **|** `null` | Power BI identifier (GUID) of the dedicated capacity the workspace is assigned to. |  |
| `capacityMigrationStatus` | `string` **|** `null` | Status of an in-progress migration of the workspace between capacities. |  |
| `dataflowStorageId` | `string` **|** `null` | Identifier of the storage account assigned for dataflow storage. |  |
| `defaultDatasetStorageFormat` | `string` **|** `null` | Default storage format for semantic models in the workspace, e.g. "Small", "Large". |  |
| `isOnDedicatedCapacity` | `boolean` **|** `null` | Whether the workspace is assigned to a dedicated Fabric capacity rather than shared capacity. |  |
| `isOrphaned` | `boolean` **|** `null` | Whether the workspace has no assigned administrator. |  |
| `isReadOnly` | `boolean` **|** `null` | Whether the workspace is in a read-only state. |  |
| `isWorkspaceLevelSettingsEnabled` | `boolean` **|** `null` | Whether workspace administrators can override tenant settings for this workspace. |  |
| `state` | `string` **|** `null` | Workspace state, e.g. "Active", "Deleted", "Removing". |  |
| `type` | `string` **|** `null` | Workspace type, e.g. "Workspace", "PersonalGroup", "Group". |  |

---

### Azure Function

`azure_function` inherits from [Function](/data-model/schemas/Function.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` **|** `null` |  |  |
| 

`configHref` \*

 | `string` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`functionAppId` \*

 | `string` |  |  |
| 

`href` \*

 | `string` **|** `null` |  |  |
| 

`invokeUrlTemplate` \*

 | `string` **|** `null` |  |  |
| 

`isEnabled` \*

 | `boolean` |  |  |
| 

`language` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`scriptHref` \*

 | `string` **|** `null` |  |  |
| 

`scriptRootPathHref` \*

 | `string` **|** `null` |  |  |
| 

`secretsFileHref` \*

 | `string` **|** `null` |  |  |
| 

`testDataHref` \*

 | `string` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Azure Function App

`azure_function_app` inherits from [Function](/data-model/schemas/Function.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appConfigCorsAllowedOrigins` | `array` **|** `null` | CORS allowed origins configured for the app. |  |
| `appConfigIpSecurityRestrictions` | `string` **|** `null` | JSON-stringified IP security restrictions from the site configuration. Stringified shape retained for back-compat. |  |
| `appConfigScmIpSecurityRestrictions` | `string` **|** `null` | JSON-stringified SCM IP security restrictions from the site configuration. Stringified shape retained for back-compat. |  |
| `authAadClaimsAuthorization` | `string` **|** `null` | JSON describing AAD claim-based authorization configuration. |  |
| `authAdditionalLoginParams` | `array` **|** `null` | Additional login parameters appended to the authorization endpoint request. |  |
| `authAllowedAudiences` | `array` **|** `null` | Token audiences allowed by the App Service auth module. |  |
| `authAllowedExternalRedirectUrls` | `array` **|** `null` | External redirect URLs allowed after a successful authentication. |  |
| `authClientId` | `string` **|** `null` | Azure AD application client ID configured for App Service authentication. |  |
| `authClientSecretCertificateThumbprint` | `string` **|** `null` | Certificate thumbprint used to authenticate to AAD as an alternative to a client secret. |  |
| `authClientSecretSettingName` | `string` **|** `null` | App setting name holding the AAD client secret (the secret itself is not ingested). |  |
| `authConfigVersion` | `string` **|** `null` | Version marker emitted by Azure for the auth configuration payload. |  |
| `authDefaultProvider` | `string` **|** `null` | Default authentication provider used when an unauthenticated request arrives. |  |
| `authEnabled` | `boolean` **|** `null` | Whether App Service Authentication is enabled (CIS 9.1). Name retained for back-compat. |  |
| `authFacebookAppId` | `string` **|** `null` | Facebook App ID configured for App Service auth. |  |
| `authFacebookAppSecretSettingName` | `string` **|** `null` | App setting name holding the Facebook App secret. |  |
| `authFacebookOAuthScopes` | `array` **|** `null` | OAuth scopes requested from Facebook. |  |
| `authGitHubClientId` | `string` **|** `null` | GitHub OAuth client ID configured for App Service auth. |  |
| `authGitHubClientSecretSettingName` | `string` **|** `null` | App setting name holding the GitHub OAuth client secret. |  |
| `authGitHubOAuthScopes` | `array` **|** `null` | OAuth scopes requested from GitHub. |  |
| `authGoogleClientId` | `string` **|** `null` | Google OAuth client ID configured for App Service auth. |  |
| `authGoogleClientSecretSettingName` | `string` **|** `null` | App setting name holding the Google OAuth client secret. |  |
| `authGoogleOAuthScopes` | `array` **|** `null` | OAuth scopes requested from Google. |  |
| `authIsAuthFromFile` | `string` **|** `null` | Whether auth configuration is loaded from a file. Azure returns the string "True" or "False". |  |
| `authIssuer` | `string` **|** `null` | OpenID Connect issuer URL used to validate tokens. |  |
| `authMicrosoftAccountClientId` | `string` **|** `null` | Microsoft Account client ID configured for App Service auth. |  |
| `authMicrosoftAccountClientSecretSettingName` | `string` **|** `null` | App setting name holding the Microsoft Account client secret. |  |
| `authMicrosoftAccountOAuthScopes` | `array` **|** `null` | OAuth scopes requested from Microsoft Account. |  |
| `authRuntimeVersion` | `string` **|** `null` | Runtime version of the App Service auth module. |  |
| `authTokenRefreshExtensionHours` | `number` **|** `null` | Hours after token expiration during which a session token may still be refreshed. |  |
| `authTwitterConsumerKey` | `string` **|** `null` | Twitter consumer key configured for App Service auth. |  |
| `authTwitterConsumerSecretSettingName` | `string` **|** `null` | App setting name holding the Twitter consumer secret. |  |
| `authUnauthenticatedClientAction` | `string` **|** `null` | Action to take for unauthenticated requests (e.g. "AllowAnonymous", "RedirectToLoginPage"). |  |
| `clientCertEnabled` | `boolean` **|** `null` | Whether incoming client certificates are required (CIS 9.4). Pre-existing name retained for back-compat. |  |
| `ftpsState` | `string` **|** `null` | FTPS state of the app (FtpsOnly, Disabled, AllAllowed). |  |
| `http20Enabled` | `boolean` **|** `null` | Whether HTTP/2 is enabled (CIS 9.9). Pre-existing name retained for back-compat. |  |
| `httpLoggingEnabled` | `boolean` **|** `null` | Whether HTTP logging is enabled. Pre-existing name retained for back-compat. |  |
| `httpsOnly` | `boolean` **|** `null` | Whether the app redirects all HTTP traffic to HTTPS (CIS 9.2). Pre-existing name retained for back-compat (would be `isHttpsOnly` under current naming rules). |  |
| `identityType` | `string` **|** `null` | Managed identity type (e.g. "SystemAssigned", "UserAssigned"). |  |
| `isAuthTokenStoreEnabled` | `boolean` **|** `null` | Whether the auth token store is enabled. |  |
| `javaVersion` | `string` **|** `null` | Java runtime version, when used (CIS 9.8). |  |
| `kind` | `array` **|** `null` | Tokenized app kind from the Azure resource (e.g. \["app", "linux"\] for web apps, \["functionapp"\] for function apps). |  |
| `linuxFxVersion` | `string` **|** `null` | Linux runtime stack version string. |  |
| `location` | `string` **|** `null` | Azure region of the app. |  |
| `minTlsVersion` | `string` **|** `null` | Minimum TLS version accepted by the app (CIS 9.3). |  |
| `netFrameworkVersion` | `string` **|** `null` | .NET Framework runtime version. |  |
| `nodeVersion` | `string` **|** `null` | Node.js runtime version, when used. |  |
| `phpVersion` | `string` **|** `null` | PHP runtime version, when used (CIS 9.6). |  |
| `powerShellVersion` | `string` **|** `null` | PowerShell runtime version. |  |
| `principalId` | `string` **|** `null` | Service principal ID assigned to the app via managed identity (CIS 9.5). |  |
| `publicNetworkAccess` | `string` **|** `null` | Public network access setting (Enabled / Disabled). |  |
| `pythonVersion` | `string` **|** `null` | Python runtime version, when used (CIS 9.7). |  |
| `redundancyMode` | `string` **|** `null` | Site redundancy mode (None, Manual, Failover, ActiveActive, GeoRedundant). |  |
| `remoteDebuggingEnabled` | `boolean` **|** `null` | Whether remote debugging is enabled. Pre-existing name retained for back-compat. |  |
| `requestTracingEnabled` | `boolean` **|** `null` | Whether request tracing is enabled. Pre-existing name retained for back-compat. |  |
| `storageAccountRequired` | `boolean` **|** `null` | Whether the app requires a linked storage account. Pre-existing name retained for back-compat. |  |
| `type` | `string` **|** `null` | Azure resource type, e.g. "Microsoft.Web/sites". |  |
| `virtualNetworkSubnetId` | `string` **|** `null` | VNet subnet ID used for VNet integration. |  |
| `windowsFxVersion` | `string` **|** `null` | Windows runtime stack version string. |  |

---

### Azure Group Unified Guest Setting

`azure_group_unified_guest_setting` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowToAddGuests` | `boolean` |  |  |
| `groupId` | `string` |  |  |
| `templateId` | `string` |  |  |

---

### Azure Group Unified Guest Setting Template

`azure_group_unified_guest_setting_template` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `description` | `string` |  |  |
| `templateId` | `string` |  |  |

---

### Azure Group Unified Setting

`azure_group_unified_setting` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowGuestsToAccessGroups` | `boolean` |  |  |
| `allowGuestsToBeGroupOwner` | `boolean` |  |  |
| `allowToAddGuests` | `boolean` |  |  |
| `classificationDescriptions` | `string` **|** `null` |  |  |
| `classificationList` | `string` **|** `null` |  |  |
| `customBlockedWordsList` | `string` **|** `null` |  |  |
| `defaultClassification` | `string` **|** `null` |  |  |
| `enableGroupCreation` | `boolean` |  |  |
| `enableMIPLabels` | `boolean` |  |  |
| `groupCreationAllowedGroupId` | `string` **|** `null` |  |  |
| `guestUsageGuidelinesUrl` | `string` **|** `null` |  |  |
| `newUnifiedGroupWritebackDefault` | `boolean` |  |  |
| `prefixSuffixNamingRequirement` | `string` **|** `null` |  |  |
| `templateId` | `string` |  |  |
| `usageGuidelinesUrl` | `string` **|** `null` |  |  |

---

### Azure Group Unified Setting Template

`azure_group_unified_setting_template` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `description` | `string` |  |  |
| `templateId` | `string` |  |  |

---

### Azure Iot Hub

`azure_iot_hub` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `comments` | `string` |  |  |
| `defaultTtlAsIso8601` | `string` |  |  |
| `deviceStreamingEndpoints` | `array` of `string`s |  |  |
| `enableFileUploadNotifications` | `boolean` |  |  |
| `enrichmentKeys` | `array` of `string`s |  |  |
| `etag` | `string` |  |  |
| `eventHubEndpoint` | `string` |  |  |
| `eventHubPartitionCount` | `number` |  |  |
| `eventHubPartitionIds` | `array` of `string`s |  |  |
| `eventHubPath` | `string` |  |  |
| `eventHubRetentionTimeInDays` | `number` |  |  |
| `features` | `string` |  |  |
| `feedbackLockDurationAsIso8601` | `string` |  |  |
| `feedbackMaxDeliveryCount` | `number` |  |  |
| `feedbackTtlAsIso8601` | `string` |  |  |
| `hostName` | `string` |  |  |
| `location` | `string` |  |  |
| `maxDeliveryCount` | `number` |  |  |
| `provisioningState` | `string` |  |  |
| `region` | `string` |  |  |
| `routeNames` | `array` of `string`s |  |  |
| `skuCapacity` | `number` |  |  |
| `skuName` | `string` |  |  |
| `skuTier` | `string` |  |  |
| `state` | `string` |  |  |
| `tags` | `array` of `string`s |  |  |
| `type` | `string` |  |  |
| `webLink` | `string` |  |  |

---

### Azure Iot Security Solution

`azure_iot_security_solution` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `additionalWorkspacesCount` | `number` |  |  |
| `autoDiscoveredResources` | `array` of `string`s |  |  |
| `createdBy` | `string` |  |  |
| `createdByType` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `disabledDataSources` | `array` of `string`s |  |  |
| `displayName` | `string` |  |  |
| `export` | `array` of `string`s |  |  |
| `iotHubs` | `array` of `string`s |  |  |
| `lastModifiedBy` | `string` |  |  |
| `lastModifiedByType` | `string` |  |  |
| `lastModifiedOn` | `number` |  |  |
| `location` | `string` |  |  |
| `recommendationsConfigurationCount` | `number` |  |  |
| `region` | `string` |  |  |
| `status` | `string` |  |  |
| `tags` | `array` of `string`s |  |  |
| `type` | `string` |  |  |
| `unmaskedIpLoggingStatus` | `string` |  |  |
| `userDefinedResourcesQuery` | `string` **|** `null` |  |  |
| `userDefinedResourcesQuerySubscriptions` | `array` **|** `null` |  |  |
| `webLink` | `string` |  |  |
| `workspace` | `string` |  |  |

---

### Azure Machine Learning Compute

`azure_machine_learning_compute` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` **|** `null` |  |  |
| 

`computeLocation` \*

 | `string` **|** `null` |  |  |
| 

`computeType` \*

 | `string` **|** `null` |  |  |
| 

`description` \*

 | `string` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`identityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`identityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`identityType` \*

 | `string` **|** `null` |  |  |
| 

`isComputeAttached` \*

 | `boolean` **|** `null` |  |  |
| 

`isLocalAuthEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`provisioningState` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`skuName` \*

 | `string` **|** `null` |  |  |
| 

`skuTier` \*

 | `string` **|** `null` |  |  |
| 

`sshPublicAccess` \*

 | `string` **|** `null` |  |  |
| 

`subnetId` \*

 | `string` **|** `null` |  |  |
| 

`vmSize` \*

 | `string` **|** `null` |  |  |

---

### Azure Machine Learning Online Endpoint

`azure_machine_learning_online_endpoint` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` |  |  |
| `aiPlatform` | `string` |  |  |
| 
`authMode` \*

 | `string` **|** `null` |  |  |
| 

`category` \*

 | `array` of `string`s |  |  |
| `createdOn` | `number` |  |  |
| `function` | `array` of `string`s |  |  |
| 

`identityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`identityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`identityType` \*

 | `string` **|** `null` |  |  |
| `isAi` | `boolean` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`provisioningState` \*

 | `string` **|** `null` |  |  |
| 

`publicNetworkAccess` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`scoringUri` \*

 | `string` **|** `null` |  |  |

---

### Azure Machine Learning Workspace

`azure_machine_learning_workspace` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` |  |  |
| `aiPlatform` | `string` |  |  |
| 
`applicationInsights` \*

 | `string` **|** `null` |  |  |
| 

`category` \*

 | `array` **|** `null` |  |  |
| 

`containerRegistry` \*

 | `string` **|** `null` |  |  |
| 

`description` \*

 | `string` **|** `null` |  |  |
| 

`discoveryUrl` \*

 | `string` **|** `null` |  |  |
| 

`encryptionIdentityClientId` \*

 | `string` **|** `null` |  |  |
| 

`encryptionKeyIdentifier` \*

 | `string` **|** `null` |  |  |
| 

`encryptionKeyVaultArmId` \*

 | `string` **|** `null` |  |  |
| 

`encryptionStatus` \*

 | `string` **|** `null` |  |  |
| 

`friendlyName` \*

 | `string` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`hbiWorkspace` \*

 | `boolean` **|** `null` |  |  |
| 

`identityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`identityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`identityType` \*

 | `string` **|** `null` |  |  |
| `isAi` | `boolean` |  |  |
| 

`isDataIsolationEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isPublicAccessAllowedWhenBehindVnet` \*

 | `boolean` **|** `null` |  |  |
| 

`isStorageHnsEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`keyVault` \*

 | `string` **|** `null` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`publicNetworkAccess` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`skuName` \*

 | `string` **|** `null` |  |  |
| 

`skuTier` \*

 | `string` **|** `null` |  |  |
| 

`storageAccount` \*

 | `string` **|** `null` |  |  |
| 

`v1LegacyMode` \*

 | `boolean` **|** `null` |  |  |
| 

`workspaceId` \*

 | `string` **|** `null` |  |  |

---

### Azure Oauth2 Permission Grant

`azure_oauth2_permission_grant` inherits from [AccessKey](/data-model/schemas/AccessKey.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `clientId` | `string` | Service principal ID of the OAuth client that received the grant |  |
| `consentType` | `string` | Scope of the grant: Principal (per-user) or AllPrincipals (tenant-wide) | **Any of**:
-   `Principal`

-   `AllPrincipals`

 |
| `expiresOn` | `number` | Epoch ms when the grant expires |  |
| `principalId` | `string` | User ID when consentType is Principal; undefined when consentType is AllPrincipals |  |
| `resourceId` | `string` | Service principal ID of the API resource the scopes apply to (e.g. Microsoft Graph) |  |
| `scope` | `string` | Space-delimited list of OAuth scopes granted (kept as a single string for substring J1QL matching) |  |
| `startedOn` | `number` | Epoch ms when the grant became effective |  |

---

### Azure Postgresql Flexible Server Configuration

`azure_postgresql_flexible_server_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`allowedValues` \*

 | `string` **|** `null` | The allowed values for the configuration parameter. |  |
| 

`dataType` \*

 | `string` **|** `null` | The data type of the configuration parameter (Boolean, Numeric, Integer, or Enumeration). |  |
| 

`defaultValue` \*

 | `string` **|** `null` | The default value of the configuration parameter. |  |
| 

`isConfigPendingRestart` \*

 | `boolean` **|** `null` | Whether a value change to this parameter is pending a server restart. |  |
| 

`isDynamicConfig` \*

 | `boolean` **|** `null` | Whether the parameter can be applied dynamically without a restart. |  |
| 

`isReadOnly` \*

 | `boolean` **|** `null` | Whether the parameter is read-only. |  |
| 

`source` \*

 | `string` **|** `null` | The source of the configuration value (e.g. system-default or user-override). |  |
| 

`unit` \*

 | `string` **|** `null` | The unit of the configuration parameter, when applicable. |  |
| 

`value` \*

 | `string` **|** `null` | The effective value of the configuration parameter. |  |

---

### Azure Postgresql Flexible Server Entra Admin

`azure_postgresql_flexible_server_entra_admin` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`objectId` \*

 | `string` **|** `null` | The Microsoft Entra object id of the administrator principal. |  |
| 

`principalName` \*

 | `string` **|** `null` | The display name / user principal name of the Entra administrator. |  |
| 

`principalType` \*

 | `string` **|** `null` | The type of the Entra principal that is an administrator (User, Group, or ServicePrincipal). |  |
| 

`tenantId` \*

 | `string` **|** `null` | The Microsoft Entra tenant id that the administrator belongs to. |  |
| 

`type` \*

 | `string` **|** `null` | The Azure resource type of the administrator resource. |  |

---

### Azure Powerbi Private Link Service

`azure_powerbi_private_link_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `location` | `string` **|** `null` | Azure region the private link service is provisioned in. |  |
| `resourceGroupName` | `string` **|** `null` | Name of the resource group containing the private link service. |  |
| `tenantId` | `string` **|** `null` | Microsoft Entra tenant ID the private link service grants access to. |  |
| `type` | `string` **|** `null` | Azure resource type, always "Microsoft.PowerBI/privateLinkServicesForPowerBI". |  |
| `webLink` | `string` | Azure portal URL for the private link service. |  |

---

### Azure Recovery Services Vault

`azure_recovery_services_vault` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`identityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`identityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`identityType` \*

 | `string` **|** `null` |  |  |
| 

`immutabilityState` \*

 | `string` **|** `null` |  |  |
| 

`keyVaultUri` \*

 | `string` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`privateEndpointConnections` \*

 | `array` **|** `null` |  |  |
| 

`privateEndpointStateForBackup` \*

 | `string` **|** `null` |  |  |
| 

`privateEndpointStateForSiteRecovery` \*

 | `string` **|** `null` |  |  |
| 

`publicNetworkAccess` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`skuCapacity` \*

 | `string` **|** `null` |  |  |
| 

`skuFamily` \*

 | `string` **|** `null` |  |  |
| 

`skuName` \*

 | `string` **|** `null` |  |  |
| 

`skuSize` \*

 | `string` **|** `null` |  |  |
| 

`skuTier` \*

 | `string` **|** `null` |  |  |
| 

`softDeleteState` \*

 | `string` **|** `null` |  |  |
| 

`standardTierStorageRedundancy` \*

 | `string` **|** `null` |  |  |

---

### Azure Security Assessment Finding

`azure_security_assessment_finding` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`blocking` \*

 | `boolean` | Whether this finding blocks the affected resource from operation. |  |
| 

`cveId` \*

 | `string` | Normalized CVE identifier (e.g. CVE-2023-12345). |  |

---

### Azure Service Principal Key Credential

`azure_service_principal_key_credential` inherits from [Certificate](/data-model/schemas/Certificate.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdOn` | `number` |  |  |
| `expiresOn` | `number` |  |  |
| `keyId` | `string` |  |  |
| `type` | `string` |  |  |
| `usage` | `string` |  |  |

---

### Azure Sql Managed Instance

`azure_sql_managed_instance` inherits from [Database](/data-model/schemas/Database.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`administratorLogin` \*

 | `string` **|** `null` |  |  |
| 

`administratorLoginPassword` \*

 | `string` **|** `null` |  |  |
| 

`category` \*

 | `array` **|** `null` |  |  |
| 

`collation` \*

 | `string` **|** `null` |  |  |
| 

`dnsZone` \*

 | `string` **|** `null` |  |  |
| 

`encryptionKeySource` \*

 | `string` **|** `null` |  |  |
| 

`fqdn` \*

 | `string` **|** `null` |  |  |
| 

`hostname` \*

 | `string` **|** `null` |  |  |
| 

`instancePoolId` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` |  |  |
| 

`isPublicDataEndpointEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isZoneRedundant` \*

 | `boolean` **|** `null` |  |  |
| 

`licenseType` \*

 | `string` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`minimalTlsVersion` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`primaryUserAssignedIdentityId` \*

 | `string` **|** `null` |  |  |
| 

`privateEndpointConnections` \*

 | `array` **|** `null` |  |  |
| 

`proxyOverride` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`servicePrincipalType` \*

 | `string` **|** `null` |  |  |
| 

`skuCapacity` \*

 | `number` **|** `null` |  |  |
| 

`skuFamily` \*

 | `string` **|** `null` |  |  |
| 

`skuName` \*

 | `string` **|** `null` |  |  |
| 

`skuTier` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`storageAccountType` \*

 | `string` **|** `null` |  |  |
| 

`subnetId` \*

 | `string` **|** `null` |  |  |
| 

`timezoneId` \*

 | `string` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Azure Sql Managed Instance Database

`azure_sql_managed_instance_database` inherits from [Database](/data-model/schemas/Database.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`catalogCollation` \*

 | `string` **|** `null` |  |  |
| 

`collation` \*

 | `string` **|** `null` |  |  |
| 

`createMode` \*

 | `string` **|** `null` |  |  |
| 

`creationDate` \*

 | `number` **|** `null` |  |  |
| 

`currentServiceObjectiveName` \*

 | `string` **|** `null` |  |  |
| 

`defaultSecondaryLocation` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`isAutoCompleteRestore` \*

 | `boolean` **|** `null` |  |  |
| 

`lastBackupName` \*

 | `string` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`requestedServiceObjectiveName` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`sourceDatabaseId` \*

 | `string` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`storageContainerUri` \*

 | `string` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Azure Storage Container

`azure_storage_container` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `containerSize` | `number` **|** `null` | The total size of the container in bytes. If retrieving this value takes longer than 5 minutes while scanning blobs, the result will be null. |  |
| `deleted` | `boolean` |  |  |
| `leaseState` | `string` |  |  |
| `leaseStatus` | `string` |  |  |
| `publicAccess` | `string` |  | **Any of**:
-   `Container`

-   `Blob`

-   `None`

 |
| `resourceGroup` | `string` |  |  |

---

### Azure Vm

`azure_vm` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `applicationSecurityGroup` | `array` of `string`s |  |  |
| `instanceStatus` | `array` of `string`s |  |  |
| `provisioningState` | `string` |  |  |
| `region` | `string` |  |  |
| `resourceGroup` | `string` |  |  |
| `state` | `string` |  |  |
| `type` | `string` |  |  |
| `usesManagedDisks` | `boolean` |  |  |
| `vmId` | `string` |  |  |
| `vmSize` | `string` |  |  |
| `webLink` | `string` |  |  |

---

### Azure Web App

`azure_web_app` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appConfigCorsAllowedOrigins` | `array` **|** `null` | CORS allowed origins configured for the app. |  |
| `appConfigIpSecurityRestrictions` | `string` **|** `null` | JSON-stringified IP security restrictions from the site configuration. Stringified shape retained for back-compat. |  |
| `appConfigScmIpSecurityRestrictions` | `string` **|** `null` | JSON-stringified SCM IP security restrictions from the site configuration. Stringified shape retained for back-compat. |  |
| `authAadClaimsAuthorization` | `string` **|** `null` | JSON describing AAD claim-based authorization configuration. |  |
| `authAdditionalLoginParams` | `array` **|** `null` | Additional login parameters appended to the authorization endpoint request. |  |
| `authAllowedAudiences` | `array` **|** `null` | Token audiences allowed by the App Service auth module. |  |
| `authAllowedExternalRedirectUrls` | `array` **|** `null` | External redirect URLs allowed after a successful authentication. |  |
| `authClientId` | `string` **|** `null` | Azure AD application client ID configured for App Service authentication. |  |
| `authClientSecretCertificateThumbprint` | `string` **|** `null` | Certificate thumbprint used to authenticate to AAD as an alternative to a client secret. |  |
| `authClientSecretSettingName` | `string` **|** `null` | App setting name holding the AAD client secret (the secret itself is not ingested). |  |
| `authConfigVersion` | `string` **|** `null` | Version marker emitted by Azure for the auth configuration payload. |  |
| `authDefaultProvider` | `string` **|** `null` | Default authentication provider used when an unauthenticated request arrives. |  |
| `authEnabled` | `boolean` **|** `null` | Whether App Service Authentication is enabled (CIS 9.1). Name retained for back-compat. |  |
| `authFacebookAppId` | `string` **|** `null` | Facebook App ID configured for App Service auth. |  |
| `authFacebookAppSecretSettingName` | `string` **|** `null` | App setting name holding the Facebook App secret. |  |
| `authFacebookOAuthScopes` | `array` **|** `null` | OAuth scopes requested from Facebook. |  |
| `authGitHubClientId` | `string` **|** `null` | GitHub OAuth client ID configured for App Service auth. |  |
| `authGitHubClientSecretSettingName` | `string` **|** `null` | App setting name holding the GitHub OAuth client secret. |  |
| `authGitHubOAuthScopes` | `array` **|** `null` | OAuth scopes requested from GitHub. |  |
| `authGoogleClientId` | `string` **|** `null` | Google OAuth client ID configured for App Service auth. |  |
| `authGoogleClientSecretSettingName` | `string` **|** `null` | App setting name holding the Google OAuth client secret. |  |
| `authGoogleOAuthScopes` | `array` **|** `null` | OAuth scopes requested from Google. |  |
| `authIsAuthFromFile` | `string` **|** `null` | Whether auth configuration is loaded from a file. Azure returns the string "True" or "False". |  |
| `authIssuer` | `string` **|** `null` | OpenID Connect issuer URL used to validate tokens. |  |
| `authMicrosoftAccountClientId` | `string` **|** `null` | Microsoft Account client ID configured for App Service auth. |  |
| `authMicrosoftAccountClientSecretSettingName` | `string` **|** `null` | App setting name holding the Microsoft Account client secret. |  |
| `authMicrosoftAccountOAuthScopes` | `array` **|** `null` | OAuth scopes requested from Microsoft Account. |  |
| `authRuntimeVersion` | `string` **|** `null` | Runtime version of the App Service auth module. |  |
| `authTokenRefreshExtensionHours` | `number` **|** `null` | Hours after token expiration during which a session token may still be refreshed. |  |
| `authTwitterConsumerKey` | `string` **|** `null` | Twitter consumer key configured for App Service auth. |  |
| `authTwitterConsumerSecretSettingName` | `string` **|** `null` | App setting name holding the Twitter consumer secret. |  |
| `authUnauthenticatedClientAction` | `string` **|** `null` | Action to take for unauthenticated requests (e.g. "AllowAnonymous", "RedirectToLoginPage"). |  |
| `clientCertEnabled` | `boolean` **|** `null` | Whether incoming client certificates are required (CIS 9.4). Pre-existing name retained for back-compat. |  |
| `ftpsState` | `string` **|** `null` | FTPS state of the app (FtpsOnly, Disabled, AllAllowed). |  |
| `http20Enabled` | `boolean` **|** `null` | Whether HTTP/2 is enabled (CIS 9.9). Pre-existing name retained for back-compat. |  |
| `httpLoggingEnabled` | `boolean` **|** `null` | Whether HTTP logging is enabled. Pre-existing name retained for back-compat. |  |
| `httpsOnly` | `boolean` **|** `null` | Whether the app redirects all HTTP traffic to HTTPS (CIS 9.2). Pre-existing name retained for back-compat (would be `isHttpsOnly` under current naming rules). |  |
| `identityType` | `string` **|** `null` | Managed identity type (e.g. "SystemAssigned", "UserAssigned"). |  |
| `isAuthTokenStoreEnabled` | `boolean` **|** `null` | Whether the auth token store is enabled. |  |
| `javaVersion` | `string` **|** `null` | Java runtime version, when used (CIS 9.8). |  |
| `kind` | `array` **|** `null` | Tokenized app kind from the Azure resource (e.g. \["app", "linux"\] for web apps, \["functionapp"\] for function apps). |  |
| `linuxFxVersion` | `string` **|** `null` | Linux runtime stack version string. |  |
| `location` | `string` **|** `null` | Azure region of the app. |  |
| `minTlsVersion` | `string` **|** `null` | Minimum TLS version accepted by the app (CIS 9.3). |  |
| `netFrameworkVersion` | `string` **|** `null` | .NET Framework runtime version. |  |
| `nodeVersion` | `string` **|** `null` | Node.js runtime version, when used. |  |
| `phpVersion` | `string` **|** `null` | PHP runtime version, when used (CIS 9.6). |  |
| `powerShellVersion` | `string` **|** `null` | PowerShell runtime version. |  |
| `principalId` | `string` **|** `null` | Service principal ID assigned to the app via managed identity (CIS 9.5). |  |
| `publicNetworkAccess` | `string` **|** `null` | Public network access setting (Enabled / Disabled). |  |
| `pythonVersion` | `string` **|** `null` | Python runtime version, when used (CIS 9.7). |  |
| `redundancyMode` | `string` **|** `null` | Site redundancy mode (None, Manual, Failover, ActiveActive, GeoRedundant). |  |
| `remoteDebuggingEnabled` | `boolean` **|** `null` | Whether remote debugging is enabled. Pre-existing name retained for back-compat. |  |
| `requestTracingEnabled` | `boolean` **|** `null` | Whether request tracing is enabled. Pre-existing name retained for back-compat. |  |
| `storageAccountRequired` | `boolean` **|** `null` | Whether the app requires a linked storage account. Pre-existing name retained for back-compat. |  |
| `type` | `string` **|** `null` | Azure resource type, e.g. "Microsoft.Web/sites". |  |
| `virtualNetworkSubnetId` | `string` **|** `null` | VNet subnet ID used for VNet integration. |  |
| `windowsFxVersion` | `string` **|** `null` | Windows runtime stack version string. |  |

---

## Release Notes

-   **2026-08-04** — Added support for Azure API Management resources, ingesting named values, products, subscriptions, portal configurations, tenant access settings, and backends as queryable entities.
-   **2026-08-04** — Added support for Azure Redis Enterprise, ingesting clusters and databases with private endpoint relationships and diagnostic settings.
-   **2026-07-22** — Added an optional enhanced ingestion source for Azure PostgreSQL Flexible Server, including Entra administrators, server configurations, replicas, private endpoint and subnet relationships, customer-managed key usage, and diagnostic settings.
-   **2026-07-14** — Added Azure managed identity entities, linked to the resources that use them.
-   **2026-07-09** — Added Azure Container Registry repository ingestion, with security assessment scanning relationships to registries.
-   **2026-04-08** — Added configuration option to automatically delete child integration instances when their parent subscription or management group is removed from the Azure integration.
-   **2026-04-08** — Improved OS name accuracy for Azure virtual machine entities by mapping marketplace image names to human-readable OS names.
-   **2026-04-07** — Added Azure Traffic Manager data model, ingesting Traffic Manager profiles and endpoints.
-   **2026-04-07** — Added Azure Activity Log Events ingestion as a new optionally enabled data source for monitoring control-plane operations.
-   **2026-04-02** — Added Azure ARM Deployments and Managed Services as new entity types, exposing resource deployment and delegated management configurations.
-   **2026-04-02** — Promoted network access control list default action and bypass settings to Azure Key Vault entities.
-   **2026-04-02** — Promoted public network access property to Azure Event Hub namespace entities.
-   **2026-04-01** — Added Azure Log Analytics workspaces and Application Insights components as new entity types with subscription relationships.
-   **2026-04-01** — Added Azure Arc hybrid compute data model, ingesting Arc-enabled servers and machines as new entity types.
-   **2026-03-23** — Added Azure Virtual WAN data model, ingesting Virtual WANs, Virtual Hubs, and hub connections.
-   **2026-03-23** — Added Azure Kubernetes Fleet Manager data model, ingesting Fleet and Fleet Member entities.
-   **2026-03-17** — Added Azure Desktop Virtualization data model, ingesting Host Pools, Application Groups, and Workspaces.
-   **2026-03-17** — Added Azure Database Migration Service data model, ingesting migration services and projects.
-   **2026-03-16** — Promoted SKU tier property to Azure Firewall and Firewall Policy entities.
-   **2026-03-16** — Promoted shared private link request message to Azure Front Door backend pool entities.
-   **2026-03-11** — Promoted request tracing enabled property to Azure Web App entities.
-   **2026-03-10** — Added Azure App Configuration data model, ingesting App Configuration stores with encryption and access key details.
-   **2026-03-06** — Added Azure Front Door Standard/Premium data model, ingesting Front Door profiles, endpoints, and routes.
-   **2026-03-06** — Promoted 13 new properties to Azure Kubernetes cluster entities including network profile, add-on settings, and SKU tier.
-   **2026-03-04** — Added Azure Chaos Studio data model, ingesting experiments and targets.
-   **2026-03-04** — Added Azure Data Share data model, ingesting share accounts and invitations.
-   **2026-02-19** — Promoted identity type and authentication settings to Azure API Management entities, exposing managed identity and authentication configuration.
-   **2026-02-19** — Promoted identity type property to Azure VM scale set entities, exposing the managed identity type assigned to VM scale sets.
-   **2026-02-17** — Added raw data properties for Azure private endpoint and subnet entities, including network interface references and IP configuration details.
-   **2026-02-17** — Added flow analytics parameters (flow analytics enabled, traffic analytics interval) to Azure security group flow logs entities.
-   **2026-02-12** — Added Enterprise Application attributes including service principal properties and app role assignments to Azure AD entities.
-   **2026-02-11** — Promoted additional configuration properties to Azure Function App entities including runtime version and CORS settings.
-   **2026-02-11** — Promoted service provider provisioning state, bandwidth, and circuit location properties to Azure ExpressRoute circuit entities.
-   **2026-02-10** — Promoted VNet properties including DDoS protection enabled, flow timeout in minutes, and BGP community settings to Azure VNet entities.
-   **2026-02-09** — Promoted properties on API management, ExpressRoute, and additional Azure resource types from raw data.
-   **2026-01-22** — Added OWNS relationship between Azure service principals and their registered applications.
-   **2026-01-20** — Promoted identity and network interface properties to Azure VM and related entities.
-   **2025-12-15** — Preserved security rule properties (direction, port, protocol) in Azure NSG relationships for direct querying without traversal.
-   **2025-12-04** — Added support for Azure NSG Rules, Route Tables, and Routes as queryable entity types.
-   **2025-10-24** — Added Azure Bastion Host to public IP relationship, linking Bastion Host resources to their associated public IP addresses.
-   **2025-10-22** — Promoted SKU name and SKU tier properties to Azure managed disk entities.
-   **2025-10-20** — Promoted inbound IP rules to Azure Event Grid topic and Event Grid domain entities.
-   **2025-10-16** — Promoted additional properties to Azure Machine Learning workspace and related entities.
-   **2025-10-13** — Added is public property to Azure load balancer entities, derived from frontend IP configurations using public IP addresses.
-   **2025-10-07** — Added ingestion of Azure AD group settings and group setting templates.
-   **2025-10-01** — Added grant controls property to Azure conditional access policy entities, exposing required grant control conditions.
-   **2025-09-30** — Added is trusted field to Azure conditional access named location entities.
-   **2025-09-30** — Added Azure AD Authentication Strength Policies as new ingested entities.
-   **2025-09-30** — Added ingestion of Azure subscription policies.
-   **2025-09-30** — Added ingestion of Azure AD access reviews.
-   **2025-09-25** — Added Azure External Attack Surface Management (EASM) workspaces as new entity types.
-   **2025-09-22** — Added Azure Bastion Host ingestion with VNet relationship mapping.
-   **2025-09-22** — Added SMB protocol version property to Azure storage account entities.
-   **2025-09-22** — Added IoT Hub security solution and alert properties.
-   **2025-09-22** — Promoted MySQL server properties from raw data to Azure MySQL server entities.
-   **2025-09-15** — Added Azure IoT Hub security module ingestion.
-   **2025-09-10** — Added Azure AD Authentication Methods Policy ingestion.
-   **2025-09-09** — Promoted Azure Service Bus namespace properties including zone redundancy and premium tier settings.
-   **2025-09-09** — Added SMB channel encryption property to Azure storage account entities.
-   **2025-09-09** — Added Azure AD authorization policy ingestion.
-   **2025-09-08** — Added blob versioning enabled property to Azure storage account entities.
-   **2025-09-08** — Added key rotation reminder fields to Azure Key Vault key entities.
-   **2025-09-05** — Added additional Azure Function App fields including identity, scale, and networking configurations.
-   **2025-08-29** — Added ingestion of Azure AD service principal key credentials.
-   **2025-08-27** — Added Azure Managed HSM and key rotation policy ingestion.
-   **2025-08-27** — Added Azure private endpoint to Key Vault relationship.
-   **2025-08-20** — Added relationships between Azure Automation accounts and Azure Policy states and private endpoints.
-   **2025-08-20** — Added support for ingesting Azure SQL Managed Instances as new entity types.
-   **2025-08-11** — Added Azure Databricks workspace ingestion as new entity types.
-   **2025-08-06** — Added Azure Backup Vaults (Recovery Services backup container) as new entity types.
-   **2025-08-06** — Added Azure Recovery Service Vaults ingestion with backup policy relationships.
-   **2025-08-01** — Added Azure Bot Service ingestion as new entity types.
-   **2025-07-31** — Added Azure Document Intelligence service ingestion as new entity types.
-   **2025-07-30** — Added Azure Machine Learning workspace and compute resources ingestion.
-   **2025-07-16** — Added advisor extended properties to Azure entities for recommendation querying.
-   **2025-05-28** — Added exclusion properties to Azure conditional access policy entities for exclusion group/user details.
-   **2025-05-28** — Related access package policies to primary approver users and groups.
-   **2025-05-23** — Added user principal name property to Azure user entities.
-   **2025-05-22** — Added Azure Automation Accounts ingestion with runbooks and schedules.
-   **2025-05-01** — Added is guest property to Azure user entities distinguishing guest from member accounts.
-   **2025-04-29** — Added Azure storage account access keys as queryable relationship properties.
-   **2025-04-17** — Upgraded Azure Storage SDK; added minimum TLS version property to Azure storage account entities.
-   **2025-04-03** — Added IP security restrictions and SCM IP security restrictions properties to Azure App Service entities, surfacing IP-based access restriction configurations.

---

Source: /integrations/directory/azure-devops

# Azure DevOps

Visualize Azure DevOps projects, teams, and users, and monitor changes through queries and alerts.

## Installation

The Azure DevOps integration uses a read-only Personal Access Token (PAT) to ingest projects, teams, users, repositories, pipelines, pull requests, work items, and security findings from Azure DevOps Services (cloud). Before enabling the integration in JupiterOne, generate a PAT and grant the required permissions.

### Prerequisites

-   An Azure DevOps **organization** on Azure DevOps Services (cloud). On-premises Azure DevOps Server is partially supported — the Service Endpoints, Audit Streams, and Advanced Security steps require Azure DevOps Services.
-   An account with permission to **create Personal Access Tokens** in your organization.
-   Access to JupiterOne with permission to configure integrations.

### Creating a Personal Access Token in Azure DevOps

1.  Sign in to your Azure DevOps organization at `https://dev.azure.com/{yourOrganization}`.
    
2.  In the upper-right corner, click your profile picture and select **Personal access tokens**.
    
3.  Click **New Token** and provide a descriptive name (for example, `JupiterOne Integration`).
    
4.  Set the **Expiration** to a value appropriate for your organization's security policy.
    
5.  Under **Scopes**, select **Custom defined**, then enable the following permissions:
    
    | Scope | Required permission |
    | --- | --- |
    | Project and Team | Read |
    | Work Items | Read |
    | Build | Read |
    | Environment | Read & Manage |
    | Code | Read |
    | Advanced Security | Read |
    
    > **NOTE**
    > 
    > **Optional ingestion sources** — if you enable **Service Endpoints** or **Audit Streams** in the JupiterOne integration settings, also grant:
    > 
    > | Scope | Required permission |
    > | --- | --- |
    > | Service Connections | Read |
    > | Auditing | Read |
    
6.  Click **Create** and copy the generated token — it is shown only once.
    

For full instructions on creating PATs, see the [Azure DevOps documentation](https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops).

### Configuration in JupiterOne

To install the Azure DevOps integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Azure DevOps. Click **New Instance** to begin configuring the integration.

Creating an Azure DevOps instance requires the following:

-   The **Account Name** used to identify the Azure DevOps account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Account ID** — your Azure DevOps organization URL in the form `https://dev.azure.com/{yourOrganization}`. This is the URL you use to access your organization in the browser.
    
-   **Personal Access Token** — the token generated above.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (8)

-   `vso.advsec`
-   `vso.auditstreams_manage`
-   `vso.build`
-   `vso.code`
-   `vso.environment_manage`
-   `vso.project`
-   `vso.serviceendpoint`
-   `vso.work`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (13)

-   `https://advsec.dev.azure.com/{organization}/{projectId}/_apis/management/repositories/{repositoryId}/enablement?includeAllProperties=true&api-version=7.2-preview.3`
-   `https://auditservice.dev.azure.com/{organization}/_apis/audit/streams?api-version=7.1-preview.1`
-   `https://dev.azure.com/{organization}/_apis/projects/{projectId}/teams/{teamId}/members?api-version=7.1`
-   `https://dev.azure.com/{organization}/_apis/projects?api-version=7.1`
-   `https://dev.azure.com/{organization}/_apis/teams?api-version=7.1`
-   `https://dev.azure.com/{organization}/{projectId}/_apis/alert/repositories/{repositoryId}/alerts?api-version=7.2`
-   `https://dev.azure.com/{organization}/{projectId}/_apis/build/builds?api-version=7.1`
-   `https://dev.azure.com/{organization}/{projectId}/_apis/build/definitions?api-version=7.1`
-   `https://dev.azure.com/{organization}/{projectId}/_apis/build/generalsettings?api-version=7.1`
-   `https://dev.azure.com/{organization}/{projectId}/_apis/git/repositories/{repositoryId}/pullrequests?api-version=7.1`
-   `https://dev.azure.com/{organization}/{projectId}/_apis/pipelines/environments?api-version=7.1`
-   `https://dev.azure.com/{organization}/{projectId}/_apis/serviceendpoint/endpoints?api-version=7.1-preview.4`
-   `https://dev.azure.com/{organization}/{projectId}/_apis/wit/reporting/workItemRevisions?api-version=7.1`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (15)

-   [https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops#scopes](https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops#scopes)
-   [https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/organization-management?view=azure-devops](https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/organization-management?view=azure-devops)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/advancedsecurity/alerts/list?view=azure-devops-rest-7.2](https://learn.microsoft.com/en-us/rest/api/azure/devops/advancedsecurity/alerts/list?view=azure-devops-rest-7.2)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/advancedsecurity/repo-enablement/get?view=azure-devops-rest-7.2](https://learn.microsoft.com/en-us/rest/api/azure/devops/advancedsecurity/repo-enablement/get?view=azure-devops-rest-7.2)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/audit/streams/query-all-streams?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/audit/streams/query-all-streams?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/build/builds/list?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/build/builds/list?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/build/definitions/list?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/build/definitions/list?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/build/general-settings/get?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/build/general-settings/get?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/core/projects/list?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/core/projects/list?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/core/teams/get-all-teams?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/core/teams/get-all-teams?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/core/teams/get-team-members-with-extended-properties?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/core/teams/get-team-members-with-extended-properties?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/distributedtask/environments/list?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/distributedtask/environments/list?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/git/pull-requests/get-pull-requests?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/git/pull-requests/get-pull-requests?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/serviceendpoint/endpoints/get-service-endpoints?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/serviceendpoint/endpoints/get-service-endpoints?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/wit/reporting-work-item-revisions/read-reporting-revisions-get?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/wit/reporting-work-item-revisions/read-reporting-revisions-get?view=azure-devops-rest-7.1)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (12)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Build Account Service Relationship | \- | \- |
| Build DevOps Service Project Relationship | \- | \- |
| Fetch Advanced Security Settings | `vso.advsec` | `https://advsec.dev.azure.com/{organization}/{projectId}/_apis/management/repositories/{repositoryId}/enablement?includeAllProperties=true&api-version=7.2-preview.3` |
| Fetch Alerts | `vso.advsec` | `https://dev.azure.com/{organization}/{projectId}/_apis/alert/repositories/{repositoryId}/alerts?api-version=7.2` |
| Fetch Build Settings | `vso.build` | `https://dev.azure.com/{organization}/{projectId}/_apis/build/generalsettings?api-version=7.1` |
| Fetch Environment | `vso.environment_manage` | `https://dev.azure.com/{organization}/{projectId}/_apis/pipelines/environments?api-version=7.1` |
| Fetch Pipelines | `vso.build` | `https://dev.azure.com/{organization}/{projectId}/_apis/build/definitions?api-version=7.1` |
| Fetch PullRequests | `vso.code` | `https://dev.azure.com/{organization}/{projectId}/_apis/git/repositories/{repositoryId}/pullrequests?api-version=7.1` |
| Fetch Repositories | `vso.build` | `https://dev.azure.com/{organization}/{projectId}/_apis/build/builds?api-version=7.1` |
| Fetch Service Endpoints | `vso.serviceendpoint` | `https://dev.azure.com/{organization}/{projectId}/_apis/serviceendpoint/endpoints?api-version=7.1-preview.4` |
| Fetch Teams | `vso.project` | `https://dev.azure.com/{organization}/_apis/teams?api-version=7.1`, `https://dev.azure.com/{organization}/_apis/projects/{projectId}/teams/{teamId}/members?api-version=7.1` |
| Fetch Workitems | `vso.work` | `https://dev.azure.com/{organization}/_apis/projects?api-version=7.1`, `https://dev.azure.com/{organization}/{projectId}/_apis/wit/reporting/workItemRevisions?api-version=7.1` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| ADO Project | `azure_devops_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| ADO Team | `azure_devops_team` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| ADO User | `azure_devops_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| ADO WorkItem | `azure_devops_work_item` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| AuditStream | `azure_devops_audit_stream` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| Azure Devops Account | `azure_devops_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Azure DevOps Alerts | `azure_devops_alert_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| AzureBuildSettings | `azure_devops_build_settings` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AzureDevOps | `azure_devops` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AzureDevOpsPipeline | `azure_devops_pipeline` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AzureDevOpsPullRequest | `azure_devops_pr` | [PR](https://docs.jupiterone.io/data-model/schemas/PR) |
| Environments | `azure_devops_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RepoAdvancedSecuritySettings | `azure_devops_repo_advanced_security_settings` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Repository | `azure_devops_repo` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| ServiceEndpoint | `azure_devops_service_endpoint` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `azure_devops` | **SCANS** | `azure_devops_project` |
| `azure_devops_account` | **HAS** | `azure_devops_project` |
| `azure_devops_account` | **HAS** | `azure_devops_user` |
| `azure_devops_account` | **HAS** | `azure_devops_team` |
| `azure_devops_account` | **OWNS** | `azure_devops_repo` |
| `azure_devops_account` | **HAS** | `azure_devops` |
| `azure_devops_account` | **HAS** | `azure_devops_audit_stream` |
| `azure_devops_project` | **HAS** | `azure_devops_team` |
| `azure_devops_project` | **HAS** | `azure_devops_work_item` |
| `azure_devops_project` | **USES** | `azure_devops_repo` |
| `azure_devops_project` | **HAS** | `azure_devops_pipeline` |
| `azure_devops_project` | **HAS** | `azure_devops_environment` |
| `azure_devops_project` | **HAS** | `azure_devops_build_settings` |
| `azure_devops_project` | **HAS** | `azure_devops_service_endpoint` |
| `azure_devops_repo` | **HAS** | `azure_devops_pr` |
| `azure_devops_repo` | **HAS** | `azure_devops_alert_finding` |
| `azure_devops_repo` | **HAS** | `azure_devops_repo_advanced_security_settings` |
| `azure_devops_team` | **HAS** | `azure_devops_user` |
| `azure_devops_user` | **MANAGES** | `azure_devops_account` |
| `azure_devops_user` | **CREATED** | `azure_devops_work_item` |
| `azure_devops_user` | **ASSIGNED** | `azure_devops_work_item` |
| `azure_devops_user` | **OPENED** | `azure_devops_pr` |
| `azure_devops_user` | **REVIEWED** | `azure_devops_pr` |
| `azure_devops_user` | **APPROVED** | `azure_devops_pr` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `azure_devops_project` | **USES** | `github_repo` | FORWARD |
| `azure_devops_project` | **USES** | `bitbucket_repo` | FORWARD |

### Azure Devops Audit Stream

`azure_devops_audit_stream` inherits from [Logs](/data-model/schemas/Logs.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `azureWorkspaceId` | `string` **|** `null` | Azure Monitor / Log Analytics workspace id. |  |
| `blobStorageUrl` | `string` **|** `null` | Azure Blob Storage URL when consumerType is AzureBlobStorage. |  |
| 
`consumerType` \*

 | `string` | Destination type for the stream — Splunk, AzureMonitorLogs, AzureEventGrid, AzureBlobStorage, Sentinel, SumoLogic, Custom, etc. |  |
| `eventGridTopicHostname` | `string` **|** `null` | Azure Event Grid topic hostname when consumerType is AzureEventGrid. |  |
| 

`isEnabled` \*

 | `boolean` | True when the stream status is "enabled". |  |
| 

`isSecretConfigured` \*

 | `boolean` | True when the stream has a secret/access-token credential configured (the secret itself is never persisted). |  |
| 

`isSumoConfigured` \*

 | `boolean` | True when the stream targets Sumo Logic. The collector URL itself encodes the token in its path and is therefore treated as a secret; only the hostname is persisted via sumoLogicCollectorHost. |  |
| 

`isWebhookConfigured` \*

 | `boolean` | True when the stream targets a custom webhook. Webhook URLs frequently carry an access token in the path or query string and are therefore treated as secrets; only the hostname is persisted via webhookHost. |  |
| `sentinelWorkspaceId` | `string` **|** `null` | Microsoft Sentinel workspace id. |  |
| `splunkUrl` | `string` **|** `null` | Splunk HTTP event collector URL when consumerType is Splunk. |  |
| `statusReason` | `string` **|** `null` | Reason populated when the stream is disabled by the system (e.g. invalid credentials). |  |
| `sumoLogicCollectorHost` | `string` **|** `null` | Hostname of the Sumo Logic HTTP collector when consumerType is SumoLogic. The full URL embeds the collector token in its path and is intentionally not persisted. |  |
| `webhookHost` | `string` **|** `null` | Hostname of the custom webhook when consumerType is Custom. The full URL frequently embeds an auth token in the path or query string and is intentionally not persisted. |  |

---

### Azure Devops Repo Advanced Security Settings

`azure_devops_repo_advanced_security_settings` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `codeSecurityChangedById` | `string` **|** `null` | Identity UUID of the actor who last toggled code-security. |  |
| `codeSecurityEnablementLastChangedOn` | `number` **|** `null` | Epoch milliseconds when the code-security enablement state was last changed. |  |
| `isAdvancedSecurityEnabled` | `boolean` **|** `null` | Whether GitHub Advanced Security is enabled on the repository (parent flag). |  |
| `isAutofixEnabled` | `boolean` **|** `null` | Whether auto-fix for code-scanning findings is enabled on the repository. |  |
| `isCodeQlEnabled` | `boolean` **|** `null` | Whether CodeQL static analysis is enabled on the repository. |  |
| `isCodeSecurityEnabled` | `boolean` **|** `null` | Whether GitHub Advanced Security code security (CodeQL, dependency scanning) is enabled on the repository. |  |
| `isDependencyScanningInjectionEnabled` | `boolean` **|** `null` | Whether dependency-scanning injection is enabled on the repository. |  |
| `isPushBlockingOnSecretDetected` | `boolean` **|** `null` | Whether pushes containing detected secrets are blocked on the repository. |  |
| `isSecretProtectionEnabled` | `boolean` **|** `null` | Whether GitHub Advanced Security secret protection is enabled on the repository. |  |
| 
`projectId` \*

 | `string` | Azure DevOps project id that owns the repository the settings describe. |  |
| 

`repositoryId` \*

 | `string` | Azure DevOps repository id the settings entity describes. |  |
| `secretProtectionChangedById` | `string` **|** `null` | Identity UUID of the actor who last toggled secret-protection. |  |
| `secretProtectionEnablementLastChangedOn` | `number` **|** `null` | Epoch milliseconds when the secret-protection enablement state was last changed. |  |

---

### Azure Devops Service Endpoint

`azure_devops_service_endpoint` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`authScheme` \*

 | `string` | Authorization scheme — e.g. UsernamePassword, Token, OAuth2, ServicePrincipal, WorkloadIdentityFederation, ManagedServiceIdentity, Certificate, None. |  |
| `authUsername` | `string` **|** `null` | Username carried by the endpoint when the authorization scheme uses a username/secret pair. |  |
| `azureEnvironment` | `string` **|** `null` | Azure environment (e.g. AzureCloud, AzureUSGovernment) for the endpoint. |  |
| `azureTenantId` | `string` **|** `null` | Azure AD tenant id used by the endpoint when the scheme is Azure-flavored. |  |
| `createdById` | `string` **|** `null` | Identity UUID of the user that created the endpoint. |  |
| `createdByUniqueName` | `string` **|** `null` | Unique name (UPN/email) of the user that created the endpoint. |  |
| `creationMode` | `string` **|** `null` | Creation mode (Manual or Automatic) — security-relevant for service-principal endpoints. |  |
| 

`endpointType` \*

 | `string` | Provider type for the service endpoint (e.g. azurerm, github, dockerregistry, kubernetes, sonarqube). |  |
| `isReady` | `boolean` **|** `null` | True when the endpoint has been initialized and is healthy. |  |
| 

`isShared` \*

 | `boolean` | True when the service endpoint is shared with other projects in the same organization. |  |
| `ownerScope` | `string` **|** `null` | Owner scope of the endpoint (e.g. Library or agentcloud). Renamed to avoid clobbering the inherited owner property. |  |
| `registryType` | `string` **|** `null` | Registry type label (used when endpointType is dockerregistry). |  |
| `registryUrl` | `string` **|** `null` | Registry URL (used when endpointType is dockerregistry). |  |
| `scopeLevel` | `string` **|** `null` | Scope level for the endpoint (e.g. Subscription, ManagementGroup). |  |
| `servicePrincipalId` | `string` **|** `null` | Service principal id used by the endpoint when the scheme is ServicePrincipal. |  |
| `sharedProjectIds` | `array` **|** `null` | IDs of additional projects the endpoint is shared with (preserves audit fidelity for projects not ingested). |  |
| `statusMessage` | `string` **|** `null` | Operation status message when the endpoint is failed or pending. |  |
| `subscriptionId` | `string` **|** `null` | Azure subscription id targeted by the endpoint (azurerm). |  |
| `subscriptionName` | `string` **|** `null` | Azure subscription display name targeted by the endpoint (azurerm). |  |
| `targetUrl` | `string` **|** `null` | Remote endpoint URL the service connection targets. |  |

---

## Release Notes

-   **2025-07-31** — Azure DevOps repository entities now carry the CodeRepo entity class in addition to Repository, enabling cross-integration code repository queries.

---

Source: /integrations/directory/bamboohr

# BambooHR

Visualize BambooHR users and files, map BambooHR users to employees and managers, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to [generate a REST API key](https://documentation.bamboohr.com/docs/getting-started) before initiating the integration in JupiterOne. Once the API key has been retrieved, proceed to JupiterOne to continue.

> **INFO**
> 
> As described in the BambooHR documentation, the API key will have the permissions of the associated user. This means the user must have sufficient permissions to create an API key, [list users metadata](https://www.bamboohr.com/api/documentation/metadata.php), and [list employee files](https://www.bamboohr.com/api/documentation/employees.php) (we do not read the content).

### Configuration in JupiterOne

To complete the BambooHR integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select BambooHR. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the BambooHR account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Client Namespace** (subdomain) for your BoombooHR account.
    
-   The BambooHR **API Key** generated for use with JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

> **NOTE**
> 
> The users listing API includes user records of employees that have been terminated (`status: 'disabled'`, `active: false` in the User entity). BambooHR employee records also have an `employeeNumber` that is assigned when the employee is created and which may later be modified. There is a permanent `id` property that does not change and very likely is not equal to the `employeeNumber`.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `bamboohr_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Employee | `bamboohr_employee` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| File | `bamboohr_file` | [DataObject](https://docs.jupiterone.io/data-model/schemas/DataObject) |
| User | `bamboohr_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `bamboohr_account` | **HAS** | `bamboohr_employee` |
| `bamboohr_account` | **HAS** | `bamboohr_user` |
| `bamboohr_account` | **HAS** | `bamboohr_file` |
| `bamboohr_user` | **IS** | `bamboohr_employee` |
| `bamboohr_user` | **HAS** | `bamboohr_file` |

### Bamboohr User

`bamboohr_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `department` | `string` |  |  |
| `division` | `string` |  |  |
| `employeeId` | `string` |  |  |
| `jobTitle` | `string` |  |  |
| `lastLogin` | `number` |  |  |
| `location` | `string` |  |  |
| `mobilePhone` | `string` |  |  |
| `supervisor` | `string` |  |  |
| `webLink` | `string` |  |  |
| `workEmail` | `string` |  |  |
| `workPhone` | `string` |  |  |

---

---

Source: /integrations/directory/bigid

# BigID

Visualize BigID data sources, finding objects, and users, map BigID users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to create an API Token within BigID. During creation, set the desired expiration period for the token, and copy the token for use within JupiterOne.

> **INFO**
> 
> For more information on BigID API Token generation, see [their documentation](https://developer.bigid.com/wiki/BigID_API/Token_Authentication).

### Required Permissions in BigID

The API Token must have **read-only access** to the following resources:

-   **Data Sources** (`/api/v1/ds-connections`) - to retrieve data source configurations
-   **PII Findings** (`/api/v1/piiRecords/objects/file-download/export`) - to retrieve privacy and compliance findings
-   **Users** (`/api/v1/access-management/users`) - to retrieve user accounts and access information

The integration uses session-based authentication via `/api/v1/refresh-access-token` and requires no write or modification permissions.

### Configuration in JupiterOne

To install the Rumble integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Rumble. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Rumble account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Lastly, depending on your authentication preference, input either of the following credentials:
    
    -   For configuring the integration with an Account API Key then put the key in the Rumble **Account API Key** field.
    -   For configuring the integration with an Export Token, provide the token in the **Export Token** field.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `bigid_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| BigID User | `bigid_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Data Source | `bigid_datasource` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| PII Object | `bigid_pii_object` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `bigid_account` | **SCANS** | `bigid_datasource` |
| `bigid_account` | **HAS** | `bigid_user` |
| `bigid_datasource` | **HAS** | `bigid_pii_object` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `bigid_account` | **SCANS** | `aws_s3_bucket` | FORWARD |
| `bigid_datasource` | **IS** | `aws_s3_bucket` | FORWARD |
| `bigid_pii_object` | **HAS** | `aws_s3_bucket` | REVERSE |

### Bigid User

`bigid_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admin` | `boolean` |  |  |
| `lastLoginOn` | `number` |  |  |

---

---

Source: /integrations/directory/bitbucket

# Bitbucket

Visualize Bitbucket Cloud workspaces, map Bitbucket Cloud users to employees, and monitor changes through queries and alerts.

## Installation

To install the Bitbucket Cloud integration, you will need to configure settings both within Bitbucket and on JupiterOne. Before enabling in JupiterOne, ensure that you have completed the setup within Bitbucket.

This integration only works with Bitbucket Cloud and not Bitbucket Server.

### Bitbucket configuration

To set up this integration, you will need to ensure your Bitbucket workspace has an OAuth consumer configured. You will also need to provide the name of your **Bitbucket Workspace** and obtain the Oauth **Client Key** and **Secret Key** for use within JupiterOne.

To ensure your Bitbucket Workspace Oauth consumer is configured:

1.  From your profile avatar in the bottom left, click on the workspace in the **Recent workspaces** list or click **All workspaces** to open an entire list from which to choose.
2.  Click **Settings** on the left sidebar to open the Workspace settings.
3.  From the left-hand navigation, select **Apps and features > OAuth consumers**.
4.  If you already have an OAuth consumer for this workspace, you can use it for JupiterOne. However, Bitbucket enforces rate-limiting per OAuth consumer, so it may be wise to configure a new OAuth consumer specifically for JupiterOne's use. To configure a new OAuth consumer, click the **Add consumer**.
5.  Add a **Name** for this consumer. This only appears in your list of OAuth consumers for this workspace. For example, `JupiterOne integration`.
6.  Add a **Callback URL**. This URL is not used for anything, but the OAuth 2 authentication flow requires it, and it must be in URL format. For example, `https://jupiterone.com/`.
7.  Check the box labeled **This is a private consumer**. This is required for the way the integration authenticates.
8.  Set permissions for this consumer. The integration requires Read access to **Account**, **Projects**, and **Repositories**. If you plan to ingest pull requests into the JupiterOne graph, or think you might later, the integration also needs Read access to **Pull requests**. If you want to, you can also enable Admin access to **Repositories** to ingest permissions and branch restrictions.
9.  Click **Save**. The system generates a key and a secret for you. Make a note of the client id and client secret, along with the name of the workspace to be accessed.

With the above completed, continue to JupiterOne to complete the integration setup.

### Configuration in JupiterOne

To install the BitBucket integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Bitbucket. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Bitbucket account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Bitbucket **Client Key**, **Secret Key**, and **Bitbucket Workspace** (the name of your BitBucket Workspace).
    
    -   **Optional** set the **Bitbucket Ingest Pull Requests** field to false if you want to disable the ingestion of pull requests into the JupiterOne graph. By default, whenever the integration is run, JupiterOne will ingest any PR created or modified in the last 24 hours.
    -   **Optional** set the **Bitbucket Enriched PRs** field to true to get additional information on each PR, such as who reviewed it. Note that this has performance implications, which is why it is disabled by default. See below.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Details on pull request data ingestion

Generally, when JupiterOne ingests data from an integration, any entities not ingested are deleted from the JupiterOne graph if they exist. For example, if a Project gets deleted from your Bitbucket account, it will disappear from the JupiterOne graph the next time the integration runs.

Since Pull Requests are only ingested from the last 24 hours (for performance reasons), previous Pull Requests in the JupiterOne graph are not deleted. Even if the PR is deleted from Bitbucket, the JupiterOne integration will have no way of knowing if the PR was deleted or is merely untouched in the last 24 hours.

That said, if the Repo that owns that Pull Request is deleted from Bitbucket, the JupiterOne graph will delete the Repo, and then it will delete any orphaned Pull Request entities that were owned by it. This same "cascading delete" would apply if higher-level objects (Projects, Workspaces) were deleted from your Bitbucket account.

### Details on rate limiting

Bitbucket enforces a rate-limit of 1000 per hour per OAuth consumer, on API calls related to Repositories and Pull Requests. JupiterOne ingestion exceeds this rate, so you might see a rate-limit error on your account if your workspace has enough data.

You can get around this limit by adding additional OAuth consumers to your Bitbucket workspace, and then updating your JupiterOne Bitbucket integration configuration to use a comma-delimited list of OAuth keys and secrets.

To do so, put the comma-delimited list of OAuth client keys in the **Bitbucket Client Key** field of your integration configuration. Do the same for the matching OAuth client secrets in the **Bitbucket Client Secret** field, being careful to make sure the secrets are in the same order as the keys.

> **NOTE**
> 
> The integration will attempt to validate all of the key/secret pairs before starting ingestion, and throw an error if any of them is invalid. Assuming they are all valid, the integration will automatically switch to each new OAuth consumer sequentially when it encounters a Bitbucket rate limit, and will not throw a rate-limit error unless is exhausts all OAuth consumers.

You can calculate the minimum number of API calls that count against this limit as:

-   If not ingesting Pull Requests: (#Repos)/10
-   With Pull Requests (default status): (#Repos)/10 + (#PRs)/10 + (2\*#PRs)
-   With Enriched PRs: (#Repos)/10 + (#PRs)/10 + (3\*#PRs)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Bitbucket Branch Restriction | `bitbucket_branch_restriction` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Bitbucket Group | `bitbucket_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Bitbucket Permission | `bitbucket_permission` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Bitbucket Project | `bitbucket_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Bitbucket Pull Request | `bitbucket_pullrequest` | [Review](https://docs.jupiterone.io/data-model/schemas/Review), [PR](https://docs.jupiterone.io/data-model/schemas/PR) |
| Bitbucket Repo | `bitbucket_repo` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Bitbucket User | `bitbucket_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Bitbucket Workspace | `bitbucket_workspace` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `bitbucket_branch_restriction` | **ALLOWS** | `bitbucket_group` |
| `bitbucket_branch_restriction` | **ALLOWS** | `bitbucket_user` |
| `bitbucket_group` | **HAS** | `bitbucket_user` |
| `bitbucket_group` | **HAS** | `bitbucket_permission` |
| `bitbucket_project` | **HAS** | `bitbucket_repo` |
| `bitbucket_repo` | **ALLOWS** | `bitbucket_permission` |
| `bitbucket_repo` | **HAS** | `bitbucket_branch_restriction` |
| `bitbucket_repo` | **HAS** | `bitbucket_pullrequest` |
| `bitbucket_user` | **OWNS** | `bitbucket_group` |
| `bitbucket_user` | **HAS** | `bitbucket_permission` |
| `bitbucket_user` | **OPENED** | `bitbucket_pullrequest` |
| `bitbucket_user` | **APPROVED** | `bitbucket_pullrequest` |
| `bitbucket_user` | **REVIEWED** | `bitbucket_pullrequest` |
| `bitbucket_workspace` | **HAS** | `bitbucket_user` |
| `bitbucket_workspace` | **HAS** | `bitbucket_group` |
| `bitbucket_workspace` | **OWNS** | `bitbucket_project` |
| `bitbucket_workspace` | **OWNS** | `bitbucket_repo` |

---

Source: /integrations/directory/bitdefender

# Bitdefender

Visualize Bitdefender accounts, users, policies, and endpoints, and monitor changes through queries and alerts.

# Installation Guide

## Requirements

To set up this integration, you must have a Bitdefender account with Administrator user access.

### Authentication

This integration uses **API Key Authentication** for making API calls.

#### Generating an API Key in GravityZone Control Center

Follow these steps to generate an API key:

1.  **Log in** to [GravityZone Control Center](https://gravityzone.bitdefender.com).
    
2.  Click your **username** in the upper-right corner of the console and select **My Account:**
    
    ![My Account](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAVsAAADFCAIAAAB1tsY9AAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAydpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDkuMS1jMDAyIDc5LmE2YTYzOTY4YSwgMjAyNC8wMy8wNi0xMTo1MjowNSAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIiB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyIgeG1sbnM6c3RSZWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9zVHlwZS9SZXNvdXJjZVJlZiMiIHhtcDpDcmVhdG9yVG9vbD0iQWRvYmUgUGhvdG9zaG9wIDI1LjEyIChXaW5kb3dzKSIgeG1wTU06SW5zdGFuY2VJRD0ieG1wLmlpZDpCMjA0MUY4NDkyRDMxMUVGQTc1QkREMzIwQkNBQ0EzQSIgeG1wTU06RG9jdW1lbnRJRD0ieG1wLmRpZDpCMjA0MUY4NTkyRDMxMUVGQTc1QkREMzIwQkNBQ0EzQSI+IDx4bXBNTTpEZXJpdmVkRnJvbSBzdFJlZjppbnN0YW5jZUlEPSJ4bXAuaWlkOkIyMDQxRjgyOTJEMzExRUZBNzVCREQzMjBCQ0FDQTNBIiBzdFJlZjpkb2N1bWVudElEPSJ4bXAuZGlkOkIyMDQxRjgzOTJEMzExRUZBNzVCREQzMjBCQ0FDQTNBIi8+IDwvcmRmOkRlc2NyaXB0aW9uPiA8L3JkZjpSREY+IDwveDp4bXBtZXRhPiA8P3hwYWNrZXQgZW5kPSJyIj8+pFsVnQAAF3tJREFUeNrsnQlcE9fah08SIGwBVEBZDJsIyqYgIC64FlGhKN6q9Xrtrdf+KrXVbtJaq2211WoXrrXWpVY//Vy+1opL4Yr0qhRxQcAFURYLEoQiyCKySAIh3yujEdDaoAET+T+/GGfOnDmzZM5z3ncSEp5EImEAANCMDv0Ti8U4EQCAgoICPs4CAEAJjAAAaJ01FBQW4EQAAO4aQWyL+wigk+hp1x8nofMpkVxWpRruIwAAWgEjAABgBAAAjAAAeDQ6OAVAwzF0H288aIq+rTsT6D1+K3JZfWFGTereuoxDWnTs010NnrPXG2ip28uQR7PX6xTnSht+zZf9X9ZtGAF0RboFvSUK+IcaGhLo6dt506Pa2rUyPkorXBDpZ2Rj3CqKtzHm2RgLQxyFtGj1mdqO8AKyBqDR0YF6dNACapCa1fAD/2y4aM1oURsdtFYDnypQNRgBdCEoWdCiZtWogzkeBqrUpGpqlwKMADSXO/cOtKdZdSULKupAKQVaBfcRQNfgL24l8nw9dF524Lua8oRcgVxxtbIp7nzjjmLFEzR7h7EfbPj4BX+xkNVfT961Yu7H/+WKbcOXLF80dUBPAasv/PXzdyO3pKvlOG0jftjyVoAFqzwv2LawucSKBS1jHnaM6bGmYnbybZZcfKcw5HPmZsekZ9m/31auHOlnpMYbCogRgFZi7ai7Y4bwO1+BrzlPpMv0uIc+z8VKsGC88OjzusEmj9+4+NWt370a6NxdyHSEpk6BEV9sjbBv1sQXG/49x19s0lzuErJyy4YZajmY+asXjbU1NRKaVlYa6zR3yb4RbKAdO/c+++pFdl3EBkbc0UHY18xFxAqLH7ynoMYwAUYA2sdQX70dIwUu+i2K5EzWdH9OZC5YHqK34HH/Xmf2JH9TJk39JkjcN+jjU9Wsu/+iLcvHjl3+cZijkFUnraDyKVuyGbMYOOWfT3os4oCXo8Y73Y1xck/dLc1ZynYvZefOMlbMqsqZvjFjxoxfzBLeY5WyBxt5zl5PXecWWQPQtujAQ2+5B//+/TRZ056TDavzKE3gBQ/RjXS9t0ifP3OYXnmMbMetdm/CVEBP1TevFdJ/66dvGHtu4TCnkC3fCYVC6ZWfFk7ZeKf8Vp2UQnp9kyc5FNvZ3235eKKtUFlQnHV/YcHp5v8GM1s7Vp7I2BW2rzlTmPCQhgZa6sIIoEtiovPpgBY6YIoTybLVeXen407KhMbCD2157J4UIgJ1jsY0/tHOjey9kDfDxXHsp4lJc5p1UkdhgkhIHbe2mnlFJsVHMh0TMY3r0syUg49/KJSDtNLBHQvdaF3Fik2LZCIJS/rPo5viPr+ErAF0OXy9BR4th0OZIvVKqwoHihXVLWb1LAURNu3eStLC1etTypjQ3NnF8c7D9p6CjO6VOJkLa/Nily/4OP+xfbBm5VRH4aNqOLMX1zFbKUv4lF0u7rQzjBgBaBGCv1vx2ly/PdpUMWSt36Dn+fYTsCK5Co1/+N/LU/q2mJdK2Z24gFWnblz+w71w3nPWkoiBItZIC23GLvqlYNHd8pJTX/j+a5fqR/Lm3MCH3OUQWbBbJXeThX98yHoUs0NLVdHB9ToFjAC6YMrAd2hzT53PHz2Kv+aY8qYif7Vd27C3hxnfmslVSByE+kbChw7a9aUx0dF3p3tOXdLcb4TC1l3H1EjYniOZMdzpYfWtXO8awXcqszZmTXZs3DY2jubLWeKLzH43E/dgfD2mY8feime3z7IN73PrnSttgBFA16M378EP6Fk76MWJ5Ad+byoz4If1Fbg8+DacPm80Yzs060iED+95TgEs+7c7Eylvs5QHlqa9+GfN/ZovgxEAuBcFmAtmmwuehSPxCGZJW+8lDqpSVNOkxk8owQhAe7h5565hyzBBVtN0NFd+oup+iYO1INiBb93SDzJFtsYdiWPPP3vbctjL7D+ft6ut1Wdq1bhnMALQHooURTJmfe/DOLIqeeTehhNt6vwuX5+v+9MogcM9KVRXK1JUan3j+68lW06cv36ibfv26tb59R/tSik+345Vwi1MHxEmlOSwtGgVW9p88bZ6/yYa7z4CLaIxtVI5rbiQ84AOOAoaDpbev/eeX9yoWuOFSbEx0bWPkZBLS6JjYk8VtmMNNwvLRywdO5/5hKuog8XHq9V7imEEoE1sOS+/2tSeFark689r3FFEuP1VGEJSmPA+M+n5iHsHC45Wq10HMALQusShYU2uonkc5/l66UU6PvhZPV7wEL3Z3McW5IoDKQ0pGncMIcP6qPClBpQ+RPzIJrxbKZBS/5c3KehBEzF5UnKB9/ayDvpiNdxHAFrGieOy9YZ6C2x4TI//wkhh8KCm9KKmEyWKaj3eIFu+ryX/7o2GJkXKWdmnmvhzZblbV0TuVT0nKRa1LyWBEUAXQ7HjsKxsiG5kX76Iz0TG/KEu9GhdRaaIS5UtyVLLJ/lEvnNjkqbenTG1f/LvLMr8b3Rmq4IX16QsCbybIeTsFU/69CmeXGQNoPNoampSlxTiTspGxzTc+SuG1h9QltUrUrIbZu6QPqYOUnJLH7gRKbRwvPvnDC6OlsIHx/DCi094NLv3JhUyoZFQKKxOOfQ/T/c14kkkErEYv/sIOskIA/xHlZTeULG++KOzKl7Gvg584/qmY8WqWqDgE+8/XWbvP9HbQtXPJEtvpMYmqyU1EQf4m55KvtgBp93M1CQ7/bRKp6WgAFkD6MSIlM/v1aun6kZQPWRIuSpXW2P5ybH5T+HkFJxK7qCWbWyskTUADcXTvT2/DS2XdchOdFCzmsoAT3cYAWgo3gM8Va9cX5jREfvQQc1qLH6DBsIIQEMZ7OfTv5+LipVrUvd2xD50ULOaiZeH29AAPxgBaCiODnaTQieoWLku41D1qf9V7w5Qg9r1049PyMTg53rbtuNrpHBnEXQ2f5sckpJ27tcjCapUroyPkv6R1WV/CfYJGTNyeFho+37SDkYAnY2NtdXsl2bkXc3PzctXMVLoUt1YXbj07fPqnJfs7Xq3ay1kDeApMHrEsMi333Dv74pT0XE6eOv1V0cMH9LeFREjgKfDpNDxJiaijZu3JSSewNlQe7JA0cFj6ABGAE85UnBxdvo5+pf9MYcuZ2bjhDw5Xh5uE4OfCwsd395kQQk+xQyePtdLSo8mJKWknr2UlZOVfUUqleKcqI6ZqYmNjfUAT3e/QQOHBvi1652FNhQUFMAIAID7RsCdRQDAfWAEAACMAACAEQAAj6bz3n3clco2nmDJEiZtxGkHoGMR6jB/O/bqUDZjkEYa4d39LOEKWxLMglyZgS5eLwA6ltsNLD6LLY9jZwvZl5M0LGug6IB0cPxNFuYBHQDQGVBHo+5GnY66HnVAzTICJQsUHcAFAHS+F6jrbTyhYUZIltxJFgAAnQ91PeqAmmUEaSMCBACeWpjQrnv5ePcRAAAjAABgBAAAjAAAgBEAADACAABGAADACAAAGAEAACMAAGAEAACMAACAEQAAMAIAAEboaNLT01esWCGRSPACA6D1RoiPj1+5cuW1a9e42eLi4lWrVq1bt662tpYrycrKWrZs2fnz5/H6AfDsG0EsFjc0NJSXl3OzJSUlt2/frqqqKisrUzpCKBT27NkTrx8Az74RevToYWBgUFRUxM1evXrVzMyMz+eXlpbSrFwuLywspJJu3brh9QNAvWjir8WLRCJTU1Pq/xQpUP+nCXt7+8rKSlKDr69vXV0dTffu3VtfX58q5+TkxMXFUYmOjo6bm9v48eMpfGjToLIOacXJySksLMzIyKixsTExMfH06dMymczQ0HDMmDHe3t48Hi89PT0mJsbBwSEvL4/qUP3Ro0cfOnSINESbCAwMHDZsGFXjgpf9+/fTM81S/dDQUNptXFIAMYKaoa5uYWFx8+ZNShaoG9+6dcvV1dXS0vLGjRu1tbVUTs+2trZUUyKRUJ/08PBYvHjxSy+9RMqgrqtQKFq2RkI5cOCAubn566+/PmXKFMo4YmNjSTSkg5SUlHHjxi1YsMDf3//w4cMXL17kViFHUIU5c+aEh4eTCLZt29anTx9a3cvLi9airVCdioqK3bt3U+by3nvvzZs3j3Zp3759tCIuKQAjqB8ackkH1OtoBObyCAoTqNeRHa5fv05DPWeEs2fP0qKhQ4fS6E0lfn5+NLBXVVW1bOrSpUt6enohISFUs3///jNnzqTBnAKNjIwMn2Yo+6CRn2KBtLQ0ikpoFapPgQD1dqpvY2PTvXt3UgatTs+0iHsLIzMzk0IDCh8oJKEKI0aMoF0l3eCSAsgaOuRWAvU3CgpoiKbh3czMjAqphHodlRgbG5uYmNTX11OFmpoaCgG4tcgFVNjGCLSKgYEB9WRulrsfSb2aVqS4gyuklmmL1DKZQllCzwKBQFdXl5vmTEEyovCBpq9duyaVSikkoRKapRVpts2mAYAR1AONutTnc3NzKSigUZq6Jc3SYJ6dnV1dXU05hZGREfVA6o00HRQUpFyReq+hoWEn9EzatEgkGjVqVMvbFrRpXFIAWYP6oa5FoUF+fn5ZWRnF81RCHc/KyorGdhrzKafgSmhgp+SCJkybUSgUFPZTBtGyKQoKqI4ywy8vLy8tLSXjUKDBvXlB0IpUToWqd2nyFDVLUQO3adoozZK5cEkBGEH90FBva2tLKQB1OeXnDuzt7anX0eDcq1cvrsTHx6eysjI2Npb6c05OzrZt2+Li4rionqitrSVBuLm5kQ5iYmK4Otu3b4+Pj6c8wt3dPa0ZaiExMZHiEWpN9S7dv39/yin2799fXFxMGcTOnTv37dtHu5eRkREVFfXbb7/h2gLIGtQJDcKkA4oCaDDnSijtN2yGBnOuRCwWT548mZL5tWvXUv90dXWdMGECTVA0QYHDTz/9FB4e7unpGRYWRqb49ttvySZcHe59RGrh8OHD3LuP48aN8/DwUH33KIWZPn16dHT0pk2byF+0JyEhISSampoaymsqKipwbQFthEdxOF3NHbuN+UzxTVc5oUVFRbt27SI79OvXD5cX0IhOrnIHLCgowN8+qhMKN5KSkiihcHZ2xtkAyBq6OpTmTJs2DecBaC+IEQAAMAIAAEYAAMAIAAAYAQAAIwAAYAQAAIwAAIAR2nDs+GmvYaGXMq+ovsqZtHQ3//E/H4jDyw+ANhnhSm6+76hwetCEGpt1sLN97ZW/+wxwx8sPQBs0+lPMyakXqmtqFQoFTTg72aurWQvz7vPmzMRrD4A2xQhSqSwhKXl04OCh/t40QbN4tQDoukYoKPzjQkZW8NjAoDHDaYJmlYsST5wJeG6qy6Cg4cHTE0+mtryn4Dk0JHLpavfBE2jpgvc//T1P8q/XF9E0lezac5D7muZLmVe8hoVSZeUqn3y+lp6p2ow5b5eUluGyADCCJqYMQqHeQM/+Pl5u3CxXTp088qMvKHA49suODVHLz1241CaykDU0xPz0/YaoZSeTz0795/wRw/yo5ssz/7bi643nL2Y+NBiprLp1cPfGHZu+vFZYvGrNpsZ738IEAIygQSlDf9c+luY9xLbWXu6uysTh+KnUbmam77/1qrWVpVs/59de+XvLFUki/5r5N3uxzfAhvgG+A1z7Ok55PphqTp083sxU9FAjKFfx9fYMfz4oPSP75s1buDIAjKBxKYO3p1tVdTU9XJwdlYlDVk5uj+5mhoYGXE3d1t+zyuPxuK9L1xEIDAz0+XwB993q1O11dHQaGxsf3JZyFcLYyJAChCZFE64M0DXR0PcaKEe4VV0T9d1WerQsVOM7DgAA7YgRuJSBYvhzxw9mp8bTIzVhnzJxcO3rVF5xs67uNle54WHDPgDg2TEClzKMGOpraKDPlYiMjQKH+HKJw/CAQZU3qz6P2vhHcemlzCvffb8TryIAz7IRuLcVRg7zb1k4dLDP7XopLerjaLf6k4Unks+OCp355qLPhg/xxasIgLrAt7MD8Kx3cnw7OwDg2ckaAAAwAgAARgAAwAgAABgBAAAjAABgBAAAjAAAgBEAADACAABGAADACAAAGAEAACMAAGAEAACAEQAAMAIAAEYAAMAIAADV6aRfcJFIJDjXADwl7DTOCHZ2dnhZAEDWAACAEQAAMAIAAEYAAMAIAAAYAQAAIwAAYAQAAIwAAIARAAAARgAAwAgAABgBAAAjAABgBAAAjAAAgBEAADACAABGAADACAAAGAEAACMAAGAEAACMAACAEQAAMAIAAEYAAMAIAAAYAQAAIwAAYAQAAIwAAIARAAAwwlPmxx9/fP7551etWiWXy5WFlZWVERER06dPz8nJ0dLTXdMMLjsAIzwOaWlp2dnZytn4+PiioiKtPt0bmsFlB2CEdqPfzP79+xsbG2m2tLT06NGjvXr10t5zTQdSV1eHaw7ACI+DiYnJhAkT0tPTMzMzafbYsWNSqTQoKIhbmpKSMmPGjMuXL3OztbW177zzzrp16xQKhbKF6urqb775ZurUqWFhYfPmzbtw4QJXTnUSEhJmz55NiQkt3bJli0wmo/KKioqVK1dOmTKFq8+FJ9SNf/75Z0pVqPKsWbNoRW4Tp06dapm/UJozZ86c8vJymv7yyy/nz5//2WefTZo0iVqj9qkRqjlz5szU1NTExERqilbHxQdghPbh7+9vbW29d+9eiURy+PDhkSNH0iy3qE+fPqampsnJydwsVSguLvbz8+PxeMrV9+zZQ8r46quvqLtS/TVr1ly/fp3KMzIyKHQPDAykvvrKK69QMrJv3z7qtFR49epV6snkEUtLy6+//poCk/3NzJ07lyqHh4dTHVU6M2U3bm5umzdvJmvExsYeP37c0dGRGuzbty8d1NatW318fHDxAQ1ER5N3jsIE6oRr166NiorS1dWlkCE3N5db1K1bN09PT4ogKBAQiUSkBiqh/tZydRqfaTQ2Nzen6bFjx1JPLigooLzjyJEjzs7OFGLo6elROU2TaPLz8ykYobHd1dWV6r/55pu3b98WCoUUm4SGhpKMqJBih7y8PHLToEGDHr3nTk5OFM4YGhoGBwefPHmSwpNRo0bRHuro6FCbPXr0wJUHECM8DjSWOjg4UD8cPXo0jdttIggaiq9cuVJVVUXROPVSihpaVqBZTgcE9UM+ny+Xy6mfU6RAi0gHVE4xhb29PU3fuHGjoaFB2QJNkDtKSkooERCLxVwhVbaxsaGNkob+4rTy+Vy0wimAuxUCAGKEJ8XAwOCFF17YsWOH8g6CEhrbqX9yiUNlZSUJok0FGpl/+OGHmzdvUnxBvZ1cgNcbAO02AuHl5UXRAYXcbcopWRg4cCAZgXRgZWVlZ2fXcikFDps2bfL29p49ezYN1zk5OUuXLuUUQ4M/jfwymYwLEyQSibGxsYWFBYmD1uJWr6+vp3LaLkX4lGsEBASw5luSFCCQhmjTAoGgqalJKpXiGgLIGjpXWjo6vXv3fugiyhQo2j99+rSfn5+RkVGbtfT19SsqKqjTUvemZJ5ihNraWgrgx4wZQ7nGrl27ysrKEhISPvjgg19++YWE0q9fv++//z4rK6uwsDAqKmrlypV1dXWU/9NSqkaVDxw4cObMmXHjxpFKKJUgj+zZs4fEQcHIkSNHVDwc2h9SGPIIgBhB/Tg4ODg6Ol67do2M0GYRCWLWrFkUJkybNo267uTJk318fDZv3kw92d3dfe7cudu3b4+OjjY0NJw4cSLVoQCBCjdu3Lh48WLqrk5OTh9++CGFA5MmTWLNnywiO5iZmVEdLl6gQIOmv/322zfeeIOqkbNIDY/eWzIUxSw7d+68ePHismXL2twHBUAT4NF1rLxz1lHbmM8U33RIy3K5nEZyGnWXLFnCpQAAgMfugJQga/FfOslkst+bGTx4MHQAQFe5j/BnpKWlLVy4UCQSPfguAwCgy91HoHz+4MGDeAkBQIwAAIARAAAwAgAARgAAwAgAABgBAAAjAABgBAAAjAAAgBEAADACAABGAADACAAAGAEAACMAAGAEAACMAACAEQAAMAIAAMAIAIAH4P3l744AALoO/y/AACtK/yTfOSpQAAAAAElFTkSuQmCC)
    
3.  Navigate to the **API Keys** section and select **companies, accounts, policies, network** and click the **Add** button:
    
    ![Add API Key](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAARkAAABqCAIAAAAHs7KbAAAACXBIWXMAAAsTAAALEwEAmpwYAAAGMmlUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgOS4wLWMwMDAgMTM3LmRhNGE3ZTUsIDIwMjIvMTEvMjctMDk6MzU6MDMgICAgICAgICI+IDxyZGY6UkRGIHhtbG5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI+IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6ZGM9Imh0dHA6Ly9wdXJsLm9yZy9kYy9lbGVtZW50cy8xLjEvIiB4bWxuczpwaG90b3Nob3A9Imh0dHA6Ly9ucy5hZG9iZS5jb20vcGhvdG9zaG9wLzEuMC8iIHhtbG5zOnhtcE1NPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvbW0vIiB4bWxuczpzdEV2dD0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL3NUeXBlL1Jlc291cmNlRXZlbnQjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hvcCAyNC4xIChXaW5kb3dzKSIgeG1wOkNyZWF0ZURhdGU9IjIwMjMtMDMtMTRUMTA6MDY6NTUrMDI6MDAiIHhtcDpNb2RpZnlEYXRlPSIyMDIzLTAzLTE0VDEwOjMxOjM4KzAyOjAwIiB4bXA6TWV0YWRhdGFEYXRlPSIyMDIzLTAzLTE0VDEwOjMxOjM4KzAyOjAwIiBkYzpmb3JtYXQ9ImltYWdlL3BuZyIgcGhvdG9zaG9wOkNvbG9yTW9kZT0iMyIgeG1wTU06SW5zdGFuY2VJRD0ieG1wLmlpZDpmNzhmOGQ0YS01NDIwLTVhNDMtYTBkNi1kNTJmNTE4NGZiMjIiIHhtcE1NOkRvY3VtZW50SUQ9ImFkb2JlOmRvY2lkOnBob3Rvc2hvcDo5MmQyOTJlZS1lYzFkLWQzNDYtOGNlOC1lYjFjNWJjZWVjMDAiIHhtcE1NOk9yaWdpbmFsRG9jdW1lbnRJRD0ieG1wLmRpZDo3ZmU0NzJhZS05NzQ2LTYxNGItODllYS01YTExNzMzNzQxNDkiPiA8eG1wTU06SGlzdG9yeT4gPHJkZjpTZXE+IDxyZGY6bGkgc3RFdnQ6YWN0aW9uPSJjcmVhdGVkIiBzdEV2dDppbnN0YW5jZUlEPSJ4bXAuaWlkOjdmZTQ3MmFlLTk3NDYtNjE0Yi04OWVhLTVhMTE3MzM3NDE0OSIgc3RFdnQ6d2hlbj0iMjAyMy0wMy0xNFQxMDowNjo1NSswMjowMCIgc3RFdnQ6c29mdHdhcmVBZ2VudD0iQWRvYmUgUGhvdG9zaG9wIDI0LjEgKFdpbmRvd3MpIi8+IDxyZGY6bGkgc3RFdnQ6YWN0aW9uPSJjb252ZXJ0ZWQiIHN0RXZ0OnBhcmFtZXRlcnM9ImZyb20gYXBwbGljYXRpb24vdm5kLmFkb2JlLnBob3Rvc2hvcCB0byBpbWFnZS9wbmciLz4gPHJkZjpsaSBzdEV2dDphY3Rpb249InNhdmVkIiBzdEV2dDppbnN0YW5jZUlEPSJ4bXAuaWlkOmY3OGY4ZDRhLTU0MjAtNWE0My1hMGQ2LWQ1MmY1MTg0ZmIyMiIgc3RFdnQ6d2hlbj0iMjAyMy0wMy0xNFQxMDozMTozOCswMjowMCIgc3RFdnQ6c29mdHdhcmVBZ2VudD0iQWRvYmUgUGhvdG9zaG9wIDI0LjEgKFdpbmRvd3MpIiBzdEV2dDpjaGFuZ2VkPSIvIi8+IDwvcmRmOlNlcT4gPC94bXBNTTpIaXN0b3J5PiA8L3JkZjpEZXNjcmlwdGlvbj4gPC9yZGY6UkRGPiA8L3g6eG1wbWV0YT4gPD94cGFja2V0IGVuZD0iciI/PvGGDd0AAA6vSURBVHic7d1fUFvXnQfwnwAF/THoSuavJP5JOEZgPDbGqWdgbAymsw9xYsckNk0mHTO78NI+7GQ3Ux7SpWlmvLPbp7YPNQ94nIE4cUidrftUDBYOdNL6bxNAuA7XgJASKpBkgf44AmkfTnV7IwkhXR1Acn+fyWTkc8/VPQP6nn/3WhYN9PcDQihpWQDwg9df3+lmIJTePhgYyNjpNiD0jMAsIUQHZgkhOjBLCNGBWUKIDswSQnRglhCiA7OEEB2YJYTowCwhREeWsNO6urpYlm1ubu7u7uYKW1tbw6r19fWVlJSQQzqd7uLFi2EVNipHKO0IGZfMZjPLsjqdbmRkJOyQTqcbCgGAjo4Os9lMoZkIpTwhWRobGwOAN998EwBiRKWjowMA5ufnhbYNoXQiJEtGo7G5ubmhoQFCuUrehQsXWltbx8fHyR9bQ7q6ukhJV1cXN4ccHx/nKpNyfk2EdkTCWSITvPLycgDQ6XRGo3Gjmn19fQBAIrfpe46MjHR0dJDKZBFFJoosy5KQNDU1AQDJz61btwCgtLT0ypUrLMv29PR0dHSwLMtFEaHtl3CWyEDU2NgIAE1NTSzL8qd5LMtyQwqE4rSp9957r7m5ub29HUJpIckBABISs9lMrkhSNDIyotPpyK4GKWxvbx8aGoontwhtkYT38chARD7HpaWlADA2NkZiAAACNuVYliX/J1uCZH3V19fHz+H8/HxDQwPZ7XjjjTcgFLb29naj0TgyMkJ2QXp6ejBOaKckNi6RCR6E1jM9PT0QSlcyyPtcuXIFQvns6OgY4iEJIbsd/f39EBoYAeDixYtDQ0PkHciohdCOSCxLZILH/6DrdLqwaV6idDpdQ0NDc3NzX1+f2WwmseHyyd9yIIf4Ezxux4IkkKziENoRiWWJfMS5MQFCc63kd/PIzI2MOWTLgQx9LMuSW1VEc3Mz8FZT3d3dOp2O7D3odDpuqonQ9hMN9Pen0XenXLhwYWRkBNdFKNWk33enkD0GDBJKQWmTJXJ/FkIbFQilGoHPtm6/hoYG/sIJoVSTNuMSQikOs4QQHZglhOjALCFERwJ7DzMzM+QBIoRQpASypNfr9Xr91jUFofSVfvdqEUpZmCWE6MAsIUQHZgkhOjBLCNGBWUKIDswSQnRglhCiA7OEEB2YJYTowCwhRAdmCSE6MEsI0YFZQogOzBJCdGCWEKIDs4QQHZglhOjALCFEB2YJITowSwjRgVlCiA7MEkJ0YJYQogOzhBAdmCWE6MAsIUQHZgkhOjBLCNGBWUKIDswSQnRglhCiA7OEEB2YJYTowCwhREcC/15tVGvB4C2b7bbdbvF6nwYCVNpES3ZGhkYqPaxSHc3PzxKJdro56BmXVJacfv+vv/rK7PHQag1dTwMB1u1m3e4/Li//qLKSEYt3ukXoWSY8S2vBIAlSQXb2K1qtISdHkplJsWXJ862vm1ZWfruwYPZ4fvXoUbfBgKMT2jrC10uf2Wxmj6dQIuk2GA4yTKoFCQAkmZkHGabbYCiUSBa83s9stp1uEXqWCc/Sn+12ADit0chSL0V8sszM0xoNhBqM0BYRPseb93gAwJCTE3lo2u67s7j60O61+9YAQCXJ2quS1hfuqlJJBF8uGaSR8zTWdVardWZmxmq1rq6uAsCuXbvUarVer1er1cm/OUprSa2XACBsaveNxz9gWlr5dr1Rk3OiTJEnFQOAzeOfXPZ8+HAp57nM1w15RbLt3gMgjSQNFszpdI6NjXm93qqqqtra2tzcXABwuVxms3l8fFwqlTY2NjIMQ6XBKS7V+soUkeyeON9fHb7f/GXxpUrlMW0uf41fLBcXyxUtpYrPLCu/uG3t3F/4vDLNfuhff/310NBQfX19dXU1v5xhGIZhamtrTSbT9evXT5w4UVxcvFON3Aap2VemCGpZ+sbj7/1i8d/2FxhU0qgVRABHNTkFUnHvF4v/cVidRj9xp9N548aNlpYWjUazUR2DwaBQKG7cuHHy5MlndXR6hvtKKug89xAEuDxpe1Gv3ChInCqV5EW98vKkLan51vYaHR09dOhQjCARarX60KFDo6Oj29Oqbcb1lU3fDRKH9JX/WlvY+8XiNx7/drcvBdAZl6btXt9a4Kg2N6y8a4gFgIutOn7hUW3uqNk1bfduGjzOR4/d54xLX55S71NGH81El+Yij0YtTJTFYvH7/QaDIZ7KBoNhamrKYrFsGjy73T44OMgvqaurq6+vj12/s7MznmZQF9lXPrB5huefzLmeigB0Csn3yxUGlfTTrxynKpWkr3z7sHrTe3kTDn/tp9bwa50vi3FK203bJ7MeAyOeOp3wZg+5XOz3TwadLN1ddDdqcuMc4zIAGjQ5dxfd8WfpZw+enCmX9TxwDh7PF9xIYViWraqqEsV3k1ckEu3du5dl2U2zRPCz0dvbCwAx4hTDVictrK/85JF9Yslzeo+qSiUNBGFyydNvWlJmZz1yeE9VKhPtK/kf7rabtupr1hg5+WTWk3z/uEXozPGm7d6avHiDAQA1u2XTdm+clSccfpPT33OA+WR2Bx5WslgsWq02/volJSUWi0XAhVpaWu7duyfgxG3A7yvv/80zseT5yQua/Xmy5zJEkkzRoUL5vt2yR46//0IzABo1uXcX3QIu1HOAMTk3nB9OOPwAkJpBAlrjksO3RrZ0CDK1i/wjN9nLl4kdvrU43/zqrPtMuWyfUnymXPbT+853DzKknEz8AOBMuYyrHLUwGW63m2x/E2T0iMSNCbm5uW63kI+RXq8fHh622+0qlYp/oaijTdhRMl3s7e1ta2uL5/RETdu9J8oU5PXQnPPM87uzM/8xUP/fjMNofsKvX5MnvfndEmFEl+bIi+D5Mm5CKLo097+HlX2PVgHA5PSTYY1fk7zgPgkAwB/KuPIPm/LOVsiTbySHzriUlbGFz7n9/MGTngMMALxaLhvkDU3njEsfNuUFz5dVM+LYhcnI3ManOhiGcTgcAHD16tWWlpbOzs66urqrV6+GVYs82tbWBgCdnZ0kSLFPF4DfV86vPK367uTtZb3yYquO/EdK8qQJ9JV8PQ+cXCdYfc1KfpXvHFBUX7PuU4q/PKUGgOD5sn/RSE1O/38dUJDkhNUkp5MFdvB82YdNea8Z//H42MezHlLIJY0WOuOSIjtzyevntrm5n2nUvQcAsHn8jCSuS3/02G1gxKRTOVshP2dc+uix+2yFnJSTfuXdg8zPHzzhKocVJkkmk7lcLm6be9Nu3uVyyeVJ9XZ2u93pdOr1egCor6+/d++enff0U+yjG1UgGROM31f+urkiap2n68H/vDX3y+PlALAeSGCblhtSAOCdAwoy7yATe/6vkkzw+GqY5zaqST4wk85v9ynFZyvk/PGH9MvkXLroZKlCIZlc8haVxjsUTC17K5m4bkH87METk9PP/3F/POs5WyGfjDarjlqYpIKCgoWFhfhvGS0sLBQVFQm7ltPpVCqV5PVGk8l4jsZTISH8vpKbsZ/Uq17UMVydhw5veW42eb3sW4uzr4TQrIxM4WqY8J3YGCfyF06RNYPny0SX5iKnc1u33KKTpReKdg3+dfl4aVxbeQGAMYvr1b27N61Juhz+Pg/5iU84/DWMeDCiftTCJFVWVn7++ec1NTXxbOUFg8Hp6ekjR44IuNDMzAwAqFQqMs6EDYBhg0/so5EVkhTZV7aUKfhB8qwFfvvI/sqev49+prj7Ss4+pZjMu2qY57iPe9j+deTQxIm6000KyQKJ7tIoKjrrperdUklWxq0FV1g5fw7NubXgkmRlxLNhyp89E2QH4uqs+2yF3OT0f/TYDQA/ve8kR6MWJkmr1YrFYpPJFE9lk8kkFosT2vfjDA8P19XVAYBKpWIYhkTLbreHjTAxjpJExT5dmBeKdo1ZXNzfmn5eJf2LzXN70e1ZC/jWgw9snv+5bT1YIN+fJ4NQX/m94l2JXuVshfxMuYysbfYpxQZGTH6VEw5/jAEqak3yIkb2tgKdcUkE8MOa/F/cthbKxLFDMm33/X7G8Vb95jfyIHQzIazw1XLZOePSuweZL0+paz+1njMuvXNAwR2NWpikY8eOXb9+XaFQxL5rZLVa7969e/Lkyfjfmf9Bb2lpIYscAHjttdd6e3uHh4chtK/AF3mU5GdwcJC8SezTBeD6yiZtLpnaTdt9f5hzfmBaCgSD5YrsV/aoSJAgkb4y0uDxfNGlubabtsHj+VOn1dwkLfJjwBdZk4xy3I3g2KdTM9DfHxSk886dzjt3+CUP7d5/vzl70/wkEK1+IBgcXXC9ZZx9aPcKu2IyIlubEKvVevny5cnJyY0qTE1Nvf/++1arVfAlUtzX7m/fMs5OLXtiVzMte98yzlpXv92eVqWOgf5+ms+JP6+UvP2C+vKkbdTsatTk7suT5knFa4Hgsm/NtOwds7gkWRnp9VQrp7i4+KWXXhodHZ2amqqqqiopKcnJyQkEAisrKxaLZXp6WiwWP8NPtQJAkUzcub8w6rOtRBDgM8vK776yd+4vLJan3684ecKzlCUSrQWDvvV1/l9hKpKJ3z6sNtm99xbdI+YnDt9aVoZImZ21Ryl5de9ug0q6I9+3QL4gKTsjqcUhwzAvv/zywsLC48ePJyYmVldXMzMz5XJ5cXHxkSNHhK2R0ssz3FdSITxLpTIZ63abVlYOfrczFgFUq6TVgqbLW2TK5QIAjZRCk7Ra7T9DbDaSmn1lihCepcMqFet2X7NY9ubkpPJXPnjW169ZLABwOLn7lYhIwb4yRQif9hzNz9dKpYs+3wWT6b7T6Vtfp9gsKnzr6/edzv+enl70+bRS6dH87X7GHP1TSWq99OM9e8hX5P1mZoZim6jTSqU/3rMHvxwPbamk9vEYsfgnVVWjNtuflpe/8flS8DuQiySS7+3efQy/AxltvWT3xLNEopaCgpaCAiqtQSh94b9zgRAdmCWE6MAsIUQHZgkhOjBLCNGBWUKIDswSQnRglhCiA7OEEB1ZAPDBwMBONwOhtPf/KgarpVnlP34AAAAASUVORK5CYII=)
    
4.  Enter a **description** for the API key and select the necessary APIs from the list:
    
    ![API Key Configuration](/assets/images/api-key-configuration-0a24b68d34e2821daa3e3232cd3ebcdb.png)
    
5.  Click **Generate** to create the API key.
    
6.  Click the **Copy** button to copy the key to your clipboard and **store it securely**.
    
7.  Close the API Key window.
    

Make sure to **keep your API key secure** and use while configuring integration.

## Configuration in JupiterOne

1.  From the top navigation bar of the **J1 Search** homepage, go to **Integrations**.
    
2.  Search for **Bitdefender** and select it.
    
3.  Click the **Add Instance** button and configure the following settings:
    
    -   **Bitdefender API Key**: Paste the Bitdefender API Key generated in Authentication Section.
    -   **Account Name**: Provide a name to identify this Bitdefender instance in JupiterOne. When the **Tag with Account Name** option is checked, ingested entities will store this value in `tag.AccountName`.
    -   **Description**: Add a description to assist your team in identifying this integration instance.
    -   **Polling Interval (optional)**: Select a polling interval that fits your monitoring needs. If unsure, leave this as `DISABLED` and manually execute the integration.
4.  Click **Create Configuration** to save your settings.
    

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Prerequisites

You must have a **Bitdefender account** with **Administrator user access**.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `bitdefender_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Endpoint | `bitdefender_endpoint` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Policy | `bitdefender_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| User | `bitdefender_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `bitdefender_account` | **HAS** | `bitdefender_user` |
| `bitdefender_account` | **HAS** | `bitdefender_endpoint` |
| `bitdefender_policy` | **ENFORCES** | `bitdefender_endpoint` |

### Bitdefender Account

`bitdefender_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountType` \*

 | `string` |  |  |
| `address` | `string` |  |  |
| 

`canBeManagedByParentCompany` \*

 | `boolean` |  |  |
| `contactPersonCompanyRole` | `string` |  |  |
| `contactPersonEmail` | `string` |  |  |
| `contactPersonName` | `string` |  |  |
| `contactPersonPhoneNumber` | `string` |  |  |
| 

`country` \*

 | `string` |  |  |
| `industry` | `number` |  |  |
| `mdrContactPersonEmail` | `string` |  |  |
| `mdrContactPersonName` | `string` |  |  |
| `mdrContactPersonPhoneNumber` | `string` |  |  |
| 

`phone` \*

 | `string` |  |  |
| `riskScoreAppVulnerabilities` | `string` |  |  |
| `riskScoreHumanRisk` | `string` |  |  |
| `riskScoreImpact` | `string` |  |  |
| `riskScoreIndustryModifier` | `string` |  |  |
| `riskScoreMisconfigurations` | `string` |  |  |
| `riskScoreValue` | `string` |  |  |
| `skip2FAPeriod` | `number` |  |  |
| 

`state` \*

 | `string` |  |  |

---

### Bitdefender Endpoint

`bitdefender_endpoint` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isContainerHost` | `boolean` |  |  |
| `isManaged` | `boolean` |  |  |
| `isManagedExchangeServer` | `boolean` |  |  |
| `isManagedRelay` | `boolean` | if this endpoint has Relay role |  |
| `isProductOutdated` | `boolean` | if the endpoint is missing one ore more agent updates. |  |
| `isSecurityServer` | `boolean` |  |  |
| `lastSuccessfulScanName` | `string` |  |  |
| `lastSuccessfulScanOn` | `number` |  |  |
| `machineType` | `string` |  |  |
| `managedWithBest` | `boolean` | if BEST is installed on this endpoint |  |
| `movingDestinationCompanyName` | `string` |  |  |
| `movingState` | `string` | Indicates the transfer status of the endpoint between two companies. |  |
| `ssid` | `string` |  |  |

---

### Bitdefender Policy

`bitdefender_policy` inherits from [Policy](/data-model/schemas/Policy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`createdBy` \*

 | `string` |  |  |
| `lastSuccessfulScanName` | `string` |  |  |
| `lastSuccessfulScanOn` | `number` |  |  |

---

### Bitdefender User

`bitdefender_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountID` \*

 | `string` |  |  |
| 

`accountLockdown` \*

 | `boolean` |  |  |
| `passwordLifetime` | `number` |  |  |
| 

`permissions` \*

 | `array` of `string`s |  |  |
| 

`role` \*

 | `string` |  |  |
| 

`timezone` \*

 | `string` |  |  |

---

---

Source: /integrations/directory/braintrust

# Braintrust

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `Owner`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://www.braintrust.dev/docs/reference/api](https://www.braintrust.dev/docs/reference/api)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (10)

| Step | Roles |
| --- | --- |
| Fetch AI Secrets | \- |
| Fetch API Keys | `Owner` |
| Fetch Datasets | \- |
| Fetch Groups | \- |
| Fetch Project Providers | \- |
| Fetch Projects | \- |
| Fetch Prompts | \- |
| Fetch Roles | \- |
| Fetch Service Tokens | \- |
| Fetch Users | \- |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Access Key | `braintrust_api_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Access Role | `braintrust_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Account | `braintrust_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AI Secret | `braintrust_ai_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Dataset | `braintrust_dataset` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Environment Variable | `braintrust_env_var` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Model | `braintrust_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| Project | `braintrust_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Prompt | `braintrust_prompt` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Service Token | `braintrust_service_token` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| User | `braintrust_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Group | `braintrust_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `braintrust_account` | **HAS** | `braintrust_user` |
| `braintrust_account` | **HAS** | `braintrust_group` |
| `braintrust_account` | **HAS** | `braintrust_role` |
| `braintrust_account` | **HAS** | `braintrust_project` |
| `braintrust_account` | **HAS** | `braintrust_api_key` |
| `braintrust_account` | **HAS** | `braintrust_ai_secret` |
| `braintrust_account` | **HAS** | `braintrust_service_token` |
| `braintrust_group` | **HAS** | `braintrust_user` |
| `braintrust_group` | **ASSIGNED** | `braintrust_role` |
| `braintrust_project` | **HAS** | `braintrust_prompt` |
| `braintrust_project` | **HAS** | `braintrust_dataset` |
| `braintrust_project` | **HAS** | `braintrust_env_var` |
| `braintrust_prompt` | **USES** | `braintrust_model` |
| `braintrust_user` | **CREATED** | `braintrust_project` |
| `braintrust_user` | **CREATED** | `braintrust_api_key` |
| `braintrust_user` | **ASSIGNED** | `braintrust_role` |

### Braintrust Account

`braintrust_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` | The Braintrust organization ID |  |

---

### Braintrust Ai Secret

`braintrust_ai_secret` inherits from [Secret](/data-model/schemas/Secret.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `previewSecret` | `string` | Masked preview of the secret value |  |
| `providerType` | `string` | The AI provider type (e.g. anthropic, bedrock, openai) |  |
| `updatedOn` | `number` | Timestamp of the last update |  |

---

### Braintrust Api Key

`braintrust_api_key` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `previewName` | `string` | Preview hint of the API key value |  |
| `userEmail` | `string` | Email of the user who owns this key |  |

---

### Braintrust Dataset

`braintrust_dataset` inherits from [DataStore](/data-model/schemas/DataStore.md)

---

### Braintrust Env Var

`braintrust_env_var` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `lastUsedOn` | `number` | Timestamp of last usage |  |
| `objectId` | `string` | ID of the scoped object |  |
| `objectType` | `string` | Scope type: organization, project, or function |  |
| `secretCategory` | `string` | Category: env\_var, ai\_provider, or sandbox\_provider |  |
| `secretType` | `string` | The AI provider type name |  |

---

### Braintrust Group

`braintrust_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `memberGroupCount` | `number` | Number of sub-groups in this group |  |
| `memberUserCount` | `number` | Number of users in this group |  |

---

### Braintrust Model

`braintrust_model` inherits from [Model](/data-model/schemas/Model.md)

---

### Braintrust Project

`braintrust_project` inherits from [Project](/data-model/schemas/Project.md)

---

### Braintrust Prompt

`braintrust_prompt` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `model` | `string` | AI model used by this prompt |  |
| `slug` | `string` | URL-safe identifier for the prompt |  |

---

### Braintrust Role

`braintrust_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `global` | `boolean` | Whether this is a global role (not org-specific) |  |
| `permissionCount` | `number` | Number of permissions granted by this role |  |

---

### Braintrust Service Token

`braintrust_service_token` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `previewName` | `string` | Preview hint of the token value |  |
| `serviceAccountEmail` | `string` | Email identifier of the service account |  |
| `serviceAccountId` | `string` | ID of the service account this token belongs to |  |
| `serviceAccountName` | `string` | Name of the service account |  |

---

### Braintrust User

`braintrust_user` inherits from [User](/data-model/schemas/User.md)

---

## Release Notes

-   **2026-04-10** — Added initial Braintrust integration, ingesting users, user groups, and access roles with their assignments.

---

Source: /integrations/directory/bugcrowd

# Bugcrowd

Visualize Bugcrowd bounty programs and submitted findings, and monitor changes through queries and alerts.

## Installation

### Configuration in JupiterOne

To install the Bugcrowd integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Bugcrowd. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Bugcrowd account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Bugcrowd **API Token** configured for read access. To generate an API token, log into your Bugcrowd account, navigate to the **API Credentials** page, specify a descriptive name, and click **Create credentials**. API tokens are automatically pinned to major version v1. If you have an existing token that is not pinned to v1.0.0, you must manually update the API version in your Bugcrowd account settings. If updating is not possible, you will need to generate a new token. See [Bugcrowd's API documentation](https://docs.bugcrowd.com/api/1.0.0/) for more information.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `bugcrowd_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Program | `bugcrowd_program` | [Program](https://docs.jupiterone.io/data-model/schemas/Program), [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Service | `bugcrowd_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service), [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Submission | `bugcrowd_submission` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `bugcrowd_account` | **PROVIDES** | `bugcrowd_service` |
| `bugcrowd_account` | **HAS** | `bugcrowd_program` |
| `bugcrowd_program` | **HAS** | `bugcrowd_submission` |
| `bugcrowd_service` | **MANAGES** | `bugcrowd_program` |

### Bugcrowd Account

`bugcrowd_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `description` | `string` |  |  |
| `displayName` | `string` |  |  |
| `name` | `string` |  |  |

---

### Bugcrowd Program

`bugcrowd_program` inherits from [Program](/data-model/schemas/Program.md), [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `code` | `string` |  |  |
| `createdAt` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `customFields` | `array` of `undefined`s |  |  |
| `demo` | `boolean` |  |  |
| `description` | `string` |  |  |
| `displayName` | `string` |  |  |
| `function` | `string` |  |  |
| `internal` | `boolean` |  |  |
| `maxReward` | `number` |  |  |
| `minReward` | `number` |  |  |
| `name` | `string` |  |  |
| `overview` | `string` |  |  |
| `participation` | `string` |  |  |
| `pointsOnly` | `boolean` |  |  |
| `programType` | `string` |  |  |
| `remainingPrizePool` | `number` |  |  |
| `serviceLevel` | `string` |  |  |
| `startedOn` | `number` |  |  |
| `status` | `string` |  |  |
| `stoppedOn` | `number` |  |  |
| `tagline` | `string` |  |  |
| `targetsOverview` | `string` |  |  |
| `totalPrizePool` | `number` |  |  |
| `trial` | `boolean` |  |  |
| `type` | `string` |  |  |
| `updatedAt` | `string` |  |  |
| `webLink` | `string` |  |  |

---

### Bugcrowd Service

`bugcrowd_service` inherits from [Service](/data-model/schemas/Service.md), [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `category` | `array` of `string`s |  |  |
| `description` | `string` |  |  |
| `displayName` | `string` |  |  |
| `function` | `array` of `string`s |  |  |
| `name` | `string` |  |  |

---

### Bugcrowd Submission

`bugcrowd_submission` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `bugUrl` | `string` |  |  |
| `category` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `description` | `string` |  |  |
| `details` | `string` |  |  |
| `displayName` | `string` |  |  |
| `extraInfo` | `string` |  |  |
| `name` | `string` |  |  |
| `numericSeverity` | `number` |  |  |
| `open` | `boolean` |  |  |
| 
`references` \*

 | `array` **|** `null` |  |  |
| 

`rewards` \*

 | `array` **|** `null` |  |  |
| `severity` | `string` |  |  |
| `state` | `string` |  |  |
| `submissionPriority` | `number` |  |  |
| `targetName` | `string` |  |  |
| 

`targets` \*

 | `array` **|** `null` |  |  |
| `title` | `string` |  |  |
| 

`totalAmountAwarded` \*

 | `number` **|** `null` |  |  |
| `vulnerabilityReferences` | `string` |  |  |
| `webLink` | `string` |  |  |

---

---

Source: /integrations/directory/cbdefense

# Carbon Black PSC

Visualize Carbon Black endpoint agents and findings on devices, map the agents to devices and their owners, and monitor findings and changes to endpoints through queries and alerts.

## Installation

To install this integration, you will need to configure settings both within Carbon Black and on JupiterOne. Before enabling in JupiterOne, ensure that you have completed the setup within your Carbon Black.

### Carbon Black configuration

The Carbon Black integration connects directly to Carbon Black APIs to obtain details about device sensors/agents and active alerts. To authorize access, you will need to create a **Connector** and an **API Key** in your target PSC account. These credentials will need to be provided in JupiterOne.

In Carbon Black, you will first need to set up an Access Level and API Key in the Carbon Black Cloud Console to allow access to the Devices and Alerts APIs.

This can be done by:

1.  In Carbon Black, go to **Settings > API Access > Access Levels: Add Access Level** and provide the following details:

-   Name "JupiterOne Read Only" (or match your naming patterns)
-   Permissions: `device: READ`, `org.alerts: READ`, `org.retention: READ`

2.  Next, go to **Settings > API Access > API Keys : Add API Key** and create the access key with the following details:

-   Name "JupiterOne" (or match your naming patterns),
    
-   Access Level Type "Custom", "JupiterOne Read Only".
    
    > **NOTE**
    > 
    > Capture the **API Secret Key** and **API ID** for input in JupiterOne.
    

With the Access Level and API Key now configured, you'll need to provide the parameters below for the integration instance in JupiterOne:

-   **Org Key** (`orgKey`): In **Settings > API Access**, capture the **Org Key**.
-   **API ID** (`connectorId`): Captured during API Key creation.
-   **API Key** (`apiKey`): Captured during API Key creation.

_Optional_

-   **Deployment Site/Environment** (`site`): The part immediately following defense- in your Carbon Black Cloud account URL. For example, if you access your account at `https://defense-prod05.conferdeploy.net/`, the site is prod05. See more details [here](https://developer.carbonblack.com/reference/carbon-black-cloud/authentication/#building-your-base-urls).

Once you've collected the above information, head to JupiterOne to create the integration instance.

### Configuration in JupiterOne

To install the Carbon Black integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Carbon Black Cloud. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Carbon Black account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Carbon Black **Deployment Site** and **Org Key** from the Carbon Black Console.
    
-   Lastly, the **API ID** and **API Key** generated for use with JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `carbonblack_psc_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `cbdefense_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| CarbonBlack Host | `cbdefense_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Device Sensor Agent | `cbdefense_sensor` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Service | `cb_endpoint_protection` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `carbonblack_psc_account` | **HAS** | `cb_endpoint_protection` |
| `carbonblack_psc_account` | **HAS** | `cbdefense_sensor` |
| `cbdefense_sensor` | **PROTECTS** | `cbdefense_host` |
| `cbdefense_sensor` | **IDENTIFIED** | `cbdefense_alert` |

### Cbdefense Host

`cbdefense_host` inherits from [Host](/data-model/schemas/Host.md)

---

---

Source: /integrations/directory/checkmarx

# Checkmarx

Visualize Checkmarx scan assessments, findings, and teams, and monitor changes through queries and alerts.

## Installation

The integration connects directly to Checkmarx SAST API. You will need Checkmarx service account user credentials and the associated Checkmarx Hostname to enable this integration.

### Required Permissions in Checkmarx

The service account must have **read-only access** with the following scope:

-   **OAuth Scope**: `sast_rest_api` (required for authentication)

The integration requires read access to:

-   **Projects** (`/cxrestapi/projects`) - to retrieve project configurations
-   **Teams** (`/cxrestapi/auth/teams`) - to retrieve team information
-   **Scans** (`/cxrestapi/sast/scans`) - to retrieve scan results
-   **Reports** (`/cxrestapi/reports/sastScan`) - to generate and download scan reports

The service account should be configured with **Viewer** or **Scanner** role permissions to access these resources without modification capabilities.

### Configuration in JupiterOne

To install the Checkmarx integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Checkmarx. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Checkmarx account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Checkmarx user's **Client username**, and **Client password** for the Checkmarx.
    
-   The **Client Hostname** for your Checkmarx instance. For example, `https://{hostname.checkmarx.net`.
    
    > If you are using a custom host, please make sure to include `.checkmarx.net` with the subdomain and omit the `https://` protocol.
    

Click **Create** once all values are provided to finalize the integration.

> **INFO**
> 
> The Checkmarx integration retrieves the latest project scan. If it has failed, then the integration will use the last successful scan instead.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `checkmarx_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Assessment | `checkmarx_scan` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Finding | `checkmarx_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Project | `checkmarx_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Service | `checkmarx_dast_scanner` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Team | `checkmarx_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `checkmarx_account` | **HAS** | `checkmarx_dast_scanner` |
| `checkmarx_account` | **HAS** | `checkmarx_team` |
| `checkmarx_dast_scanner` | **PERFORMED** | `checkmarx_scan` |
| `checkmarx_project` | **HAS** | `checkmarx_scan` |
| `checkmarx_scan` | **IDENTIFIED** | `checkmarx_finding` |
| `checkmarx_team` | **HAS** | `checkmarx_project` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `checkmarx_project` | **SCANS** | `CodeRepo` | FORWARD |

---

Source: /integrations/directory/checkpoint-harmony

# Checkpoint Harmony

Visualize Checkpoint Harmony Mobile devices, device groups and alerts through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create API Key with Read-only permissions as mentioned below.
> 
> -   Using a web browser, go to your Checkpoint Harmony Mobile tenant (e.g. `https://<REGION>.portal.checkpoint.com`) and log in with your credentials.
>     
> -   Hover over to the Gear Icon, and click on `API Keys` as shown in the image
>     
>     ![Api Token](/assets/images/select-api-token-page-0e691e77021db8c44706a19b1d68a987.png)
>     
> -   On the API Keys page, click on `New`
>     
> -   On the Create New API Key pop up, select the `Service` as `Harmony Mobile`. Select an `Expiration Date` for the API Key. Be Mindful that once the token is expired the Integration will fail. Lastly the select the `Roles` as `Read Only` and click on `CREATE`
>     
>     ![Api Key](/assets/images/create-api-key-924ba438770ed972eb6409ad637e571c.png)
>     
> -   Save the Credentials created an the next screen somewhere as they are required when configuring the integration in JupiterOne.**Note**: the Authentication Url inputted into the integration configuration should end in `.com` (remove `/auth/external` if present).
>     
>     ![Credentials Screen](/assets/images/credentials-screen-18f9b2b7607e24cc568a3375b5c41e2d.png)
>     

To install the Checkpoint Harmony Mobile integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Checkpoint Harmony Mobile. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Checkpoint Harmony Mobile account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Checkpoint Harmony Mobile **Tenant URL**, **API client ID** and **API client secret** to authenticate with the APIs.
    

Click **Create** once all values are provided to finalize the integration.

:::

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `checkpoint_harmony_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device | `user_endpoint` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Device | `checkpoint_harmony_device_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Device | `checkpoint_harmony_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Service | `checkpoint_harmony_mobile_protection` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `checkpoint_harmony_account` | **HAS** | `user_endpoint` |
| `checkpoint_harmony_account` | **HAS** | `checkpoint_harmony_device_group` |
| `checkpoint_harmony_account` | **HAS** | `checkpoint_harmony_mobile_protection` |
| `checkpoint_harmony_device_group` | **HAS** | `user_endpoint` |
| `user_endpoint` | **HAS** | `checkpoint_harmony_alert` |

---

Source: /integrations/directory/circleci

# CircleCI

Visualize CircleCI users, user groups, pipelines, and projects, map CircleCI users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need your CircleCI **User ID**, **VCS username**, and a **Personal API Token** to configure this integration. Find your User ID and create a token in CircleCI under **User Settings > Account Integrations** and **User Settings > Personal API Tokens**. See [Managing API Tokens](https://circleci.com/docs/managing-api-tokens/) for details.

### Required Permissions in CircleCI

The API Key must have **read-only access** to the following resources:

-   **User Information** (`/api/v2/me`) - to retrieve user and collaboration details
-   **Pipelines** (`/api/v2/pipeline`) - to retrieve pipeline configurations and executions
-   **Workflows** (`/api/v2/pipeline/{id}/workflow`) - to retrieve workflow details
-   **Jobs** (`/api/v2/workflow/{id}/job`) - to retrieve job executions
-   **Projects** (`/api/v2/project/{project_slug}`) - to retrieve project configurations
-   **Environment Variables** (`/api/v2/project/{project_slug}/envvar`) - to list project environment variable names (values are not exposed)
-   **Contexts** (`/api/v2/context`) - to retrieve context configurations
-   **Context Environment Variables** (`/api/v2/context/{id}/environment-variable`) - to list context variable names
-   **Context Restrictions** (`/api/v2/context/{id}/restrictions`) - to retrieve context access restrictions

The integration uses the CircleCI v2 API with token-based authentication and requires no write or modification permissions.

### Configuration in JupiterOne

To install the CircleCI integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select CircleCI. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **Account Name** used to identify the CircleCI account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **User ID** — your CircleCI user ID. Find this under **User Settings > Account Integrations** in the CircleCI web app.
    
-   **VCS username** — your version control system username (for example, your GitHub or Bitbucket username).
    
-   **API Key** — a CircleCI Personal API Token. Generate one in the CircleCI web app under **User Settings > Personal API Tokens**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `circleci_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Context | `circleci_context` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Context Environment Variable | `circleci_context_environment_variable` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Pipeline | `circleci_pipeline` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Pipeline Workflow | `circleci_workflow` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Project | `circleci_project` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| Project Environment Variable | `circleci_project_environment_variable` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| User | `circleci_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| UserGroup | `circleci_user_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Workflow Job | `circleci_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `circleci_account` | **HAS** | `circleci_user_group` |
| `circleci_account` | **HAS** | `circleci_user` |
| `circleci_context` | **HAS** | `circleci_context_environment_variable` |
| `circleci_pipeline` | **HAS** | `circleci_workflow` |
| `circleci_project` | **HAS** | `circleci_pipeline` |
| `circleci_project` | **HAS** | `circleci_project_environment_variable` |
| `circleci_project` | **USES** | `circleci_context_environment_variable` |
| `circleci_user_group` | **HAS** | `circleci_project` |
| `circleci_user_group` | **HAS** | `circleci_user` |
| `circleci_workflow` | **HAS** | `circleci_job` |

---

Source: /integrations/directory/cisco-aci

# Cisco ACI

Cisco Application Centric Infrastructure (ACI) is a software-defined networking solution that provides centralized automation and policy-driven application profiles for data center environments. This integration enables visibility into your ACI fabric topology, tenants, networking constructs (VRFs, Bridge Domains), application profiles, endpoint groups, and discovered endpoints with their IP and MAC addresses.

"## Installation\\n\\n### Prerequisites in Cisco ACI\\n\\nThe JupiterOne Cisco ACI integration requires read-only access to the APIC (Application Policy Infrastructure Controller) REST API. You will need to create a local user account with appropriate permissions.\\n\\n#### Creating a Local User Account\\n\\n1. Log in to the APIC GUI with administrator credentials.\\n\\n2. Navigate to **Admin > AAA > Users**.\\n\\n3. Select the **Local Users** tab.\\n\\n4. Click **Create Local User** and configure the following:\\n - **Login ID**: A unique username for the integration (e.g., `jupiterone-readonly`)\\n - **Password**: A strong password meeting APIC requirements (minimum 8 characters, including at least three character types: lowercase, uppercase, digits, or symbols)\\n\\n5. In the **Security** section:\\n - **Security Domain**: Select `all` to allow access to all tenants, or select specific tenant domains if you want to limit the integration's scope\\n\\n6. In the **Roles** section, assign the following role:\\n - **Role**: `read-all`\\n - **Privilege Type**: `Read`\\n\\n :::info\\n The `read-all` role with Read privilege provides read-only access to tenant configurations, fabric topology, and endpoint information without the ability to modify any settings.\\n :::\\n\\n7. Click **Submit** to create the user.\\n\\n#### Network Requirements\\n\\n- The JupiterOne integration must be able to reach the APIC controller over HTTPS (port 443)\\n- If using a self-signed certificate on the APIC, ensure your JupiterOne Collector is deployed in an environment that trusts the APIC's certificate\\n- For on-premises deployments, ensure the JupiterOne Collector has network access to the APIC URL\\n\\n### Configuration in JupiterOne\\n\\nTo install the Cisco ACI integration in JupiterOne, navigate to the **Integrations** tab and select **Cisco ACI**. Click **New Instance** to begin configuring your integration.\\n\\n#### Authentication Settings\\n\\n- **APIC URL**: The URL of your Cisco ACI APIC controller (e.g., `https://apic.example.com`). This should be the management IP or hostname of your primary APIC.\\n\\n- **Username**: The username of the read-only APIC user created for JupiterOne.\\n\\n- **Password**: The password for the APIC user.\\n\\n#### General Settings\\n\\n- **Account Name**: Used to identify the Cisco ACI account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **Account Name** toggle is enabled.\\n\\n- **Description**: Optional description to help identify the integration instance.\\n\\n- **Polling Interval**: Select the frequency for data synchronization. You may leave this as `DISABLED` and manually execute the integration.\\n\\n#### Data Sources\\n\\nThe integration provides granular control over what data is ingested. You can enable or disable specific ingestion sources:\\n\\n| Data Source | Description | Entities Created |\\n|-------------|-------------|------------------|\\n| **Fabric & Controllers** | ACI fabric topology, APIC controllers, and network switches | `cisco_aci_fabric`, `cisco_aci_controller`, `cisco_aci_switch` |\\n| **Tenants** | ACI tenants (logical containers for policies) | `cisco_aci_tenant` |\\n| **Networking** | VRFs (Virtual Routing and Forwarding contexts) and Bridge Domains | `cisco_aci_vrf`, `cisco_aci_bridge_domain` |\\n| **Applications** | Application Profiles and Endpoint Groups (EPGs) | `cisco_aci_application_profile`, `cisco_aci_epg` |\\n| **Endpoints** | Discovered client endpoints with IP/MAC addresses and DNS records | `cisco_aci_endpoint`, `cisco_aci_dns_record` |\\n| **L4-L7 Devices** | Firewall service devices attached to ACI tenants | `cisco_aci_firewall` |\\n\\nClick **Create** once all values are provided to finalize the integration.\\n\\n### Using a JupiterOne Collector\\n\\nFor on-premises Cisco ACI deployments that are not accessible from the internet, you can use a [JupiterOne Collector](https://docs.jupiterone.io/integrations/development/collector/collector) to run the integration within your network:\\n\\n1. Deploy a JupiterOne Collector in your network with access to the APIC controller\\n2. When configuring the integration instance, select the appropriate Collector\\n3. The Collector will execute the integration locally and securely upload data to JupiterOne\\n\\n### Next Steps\\n\\nNow that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.\\n\\n### Additional Resources\\n\\n- [Cisco APIC Basic Configuration Guide - User Access and Authentication](https://www.cisco.com/c/en/us/td/docs/dcn/aci/apic/6x/basic-configuration/cisco-apic-basic-configuration-guide-60x/user-access-authentication-and-accounting-60x.html)\\n- [Cisco APIC REST API Configuration Guide](https://www.cisco.com/c/en/us/td/docs/dcn/aci/apic/all/apic-rest-api-configuration-guide/cisco-apic-rest-api-configuration-guide/m_using_the_rest_api.html)\\n"

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Cisco ACI Account | `cisco_aci_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cisco ACI Application Profile | `cisco_aci_application_profile` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Cisco ACI Bridge Domain | `cisco_aci_bridge_domain` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Cisco ACI Controller | `cisco_aci_controller` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Cisco ACI DNS Record | `cisco_aci_dns_record` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |
| Cisco ACI Endpoint | `cisco_aci_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| Cisco ACI Endpoint Group | `cisco_aci_epg` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Cisco ACI Fabric | `cisco_aci_fabric` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| Cisco ACI Firewall | `cisco_aci_firewall` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Cisco ACI Switch | `cisco_aci_switch` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Cisco ACI Tenant | `cisco_aci_tenant` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cisco ACI VRF | `cisco_aci_vrf` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cisco_aci_account` | **HAS** | `cisco_aci_fabric` |
| `cisco_aci_account` | **HAS** | `cisco_aci_tenant` |
| `cisco_aci_application_profile` | **HAS** | `cisco_aci_epg` |
| `cisco_aci_bridge_domain` | **USES** | `cisco_aci_vrf` |
| `cisco_aci_endpoint` | **ASSIGNED** | `cisco_aci_epg` |
| `cisco_aci_endpoint` | **HAS** | `cisco_aci_dns_record` |
| `cisco_aci_epg` | **USES** | `cisco_aci_bridge_domain` |
| `cisco_aci_fabric` | **HAS** | `cisco_aci_controller` |
| `cisco_aci_fabric` | **HAS** | `cisco_aci_switch` |
| `cisco_aci_tenant` | **HAS** | `cisco_aci_vrf` |
| `cisco_aci_tenant` | **HAS** | `cisco_aci_bridge_domain` |
| `cisco_aci_tenant` | **HAS** | `cisco_aci_application_profile` |
| `cisco_aci_tenant` | **HAS** | `cisco_aci_firewall` |

### Cisco Aci Account

`cisco_aci_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Cisco Aci Application Profile

`cisco_aci_application_profile` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `qosPriority` | `string` |  |  |
| `tenantName` | `string` |  |  |

---

### Cisco Aci Bridge Domain

`cisco_aci_bridge_domain` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arpFlood` | `boolean` |  |  |
| `limitIpLearnToSubnets` | `boolean` |  |  |
| `multiDestinationPacketAction` | `string` |  |  |
| `subnets` | `array` of `string`s |  |  |
| `tenantName` | `string` |  |  |
| `unicastRoute` | `boolean` |  |  |
| `unknownMacUnicastAction` | `string` |  |  |
| `unknownMulticastAction` | `string` |  |  |
| `vrfName` | `string` |  |  |

---

### Cisco Aci Controller

`cisco_aci_controller` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agreementId` | `string` |  |  |
| `assetType` | `string` |  |  |
| `endOfLife` | `string` |  |  |
| `endOfSale` | `string` |  |  |
| `endOfSupport` | `string` |  |  |
| `manufacturingDate` | `string` |  |  |
| `operationalState` | `string` |  |  |
| `podId` | `string` |  |  |
| `role` | `string` |  |  |
| `serviceLevel` | `string` |  |  |
| `systemUpTime` | `string` |  |  |

---

### Cisco Aci Dns Record

`cisco_aci_dns_record` inherits from [DomainRecord](/data-model/schemas/DomainRecord.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `value` | `string` |  |  |

---

### Cisco Aci Endpoint

`cisco_aci_endpoint` inherits from [NetworkEndpoint](/data-model/schemas/NetworkEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `applicationProfileName` | `string` |  |  |
| `encapsulation` | `string` |  |  |
| `endpointGroupName` | `string` |  |  |
| `ipAddresses` | `array` of `string`s |  |  |
| `lifecycleClass` | `string` |  |  |
| `macAddress` | `string` |  |  |
| `tenantName` | `string` |  |  |

---

### Cisco Aci Epg

`cisco_aci_epg` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `applicationProfileName` | `string` |  |  |
| `bridgeDomainName` | `string` |  |  |
| `encapsulations` | `array` of `string`s |  |  |
| `floodOnEncapsulation` | `string` |  |  |
| `policyEnforcementPreference` | `string` |  |  |
| `preferredGroupMembership` | `string` |  |  |
| `qosPriority` | `string` |  |  |
| `tenantName` | `string` |  |  |

---

### Cisco Aci Fabric

`cisco_aci_fabric` inherits from [Site](/data-model/schemas/Site.md)

---

### Cisco Aci Firewall

`cisco_aci_firewall` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agreementId` | `string` |  |  |
| `assetType` | `string` |  |  |
| `configState` | `string` |  |  |
| `contextAware` | `string` |  |  |
| `deviceType` | `string` |  |  |
| `endOfLife` | `string` |  |  |
| `endOfSale` | `string` |  |  |
| `endOfSupport` | `string` |  |  |
| `isManaged` | `boolean` |  |  |
| `serviceLevel` | `string` |  |  |
| `tenantName` | `string` |  |  |

---

### Cisco Aci Switch

`cisco_aci_switch` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agreementId` | `string` |  |  |
| `assetType` | `string` |  |  |
| `endOfLife` | `string` |  |  |
| `endOfSale` | `string` |  |  |
| `endOfSupport` | `string` |  |  |
| `manufacturingDate` | `string` |  |  |
| `operationalState` | `string` |  |  |
| `podId` | `string` |  |  |
| `role` | `string` |  |  |
| `serviceLevel` | `string` |  |  |
| `systemUpTime` | `string` |  |  |

---

### Cisco Aci Tenant

`cisco_aci_tenant` inherits from [Account](/data-model/schemas/Account.md)

---

### Cisco Aci Vrf

`cisco_aci_vrf` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `dataPlaneLearning` | `string` |  |  |
| `policyEnforcementDirection` | `string` |  |  |
| `policyEnforcementPreference` | `string` |  |  |
| `tenantName` | `string` |  |  |

---

## Release Notes

-   **2026-03-06** — Added switches and firewalls as new entity types to the Cisco ACI integration.
-   **2026-01-27** — New Cisco ACI integration: ingests tenants, VRFs, bridge domains, application profiles, endpoint groups, endpoints, and DNS records with full fabric topology.

---

Source: /integrations/directory/cisco-amp

# Cisco Secure Endpoint

Visualize Cisco Secure Endpoint protected devices, map agents to devices and their respective owners, and monitor changes through queries and alerts.

## Installation

This integration connects directly to [Cisco Secure Endpoint REST API](https://api-docs.amp.cisco.com/) to obtain endpoint protection and configuration information.

Valid API Endpoints include:

-   `api.amp.cisco.com`
-   `api.apjc.amp.cisco.com`
-   `api.eu.amp.cisco.com`

> **INFO**
> 
> You will need to create a new Client ID and API Key with _read access_ in Cisco Secure Endpoint for this integration. See [their documentation](https://developer.cisco.com/docs/secure-endpoint/#!overview) for more information.

To install the Cisco Secure Endpoint integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Cisco Secure Endpoint. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Cisco Secure Endpoint account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **API Endpoint Hostname** associated with your Cisco Secure Endpoint account.
    
-   Your Cisco Secure Endpoint **Client ID** and **API Key** (configured for read access).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cisco_amp_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Computer | `cisco_amp_endpoint` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Vulnerability | `cisco_amp_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cisco_amp_account` | **HAS** | `cisco_amp_endpoint` |
| `cisco_amp_endpoint` | **HAS** | `cisco_amp_vulnerability` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `cisco_amp_endpoint` | **PROTECTS** | `user_endpoint` | FORWARD |

### Cisco Amp Endpoint

`cisco_amp_endpoint` inherits from [Host](/data-model/schemas/Host.md)

---

### Cisco Amp Vulnerability

`cisco_amp_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cvssScore` \*

 | `number` **|** `null` |  |  |

---

## Release Notes

-   **2025-06-03** — New Cisco Secure Endpoint integration: ingests endpoints, malware findings, and CVE vulnerabilities with device protection relationships.

---

Source: /integrations/directory/cisco-ise

# Cisco ISE

Cisco Identity Services Engine (ISE) is a security policy management and control platform that enables enterprises to automate and enforce security policies across their wired, wireless, and VPN networks. It's designed to provide comprehensive, identity-based access control and security compliance for devices and users on a network.

## Installation

### Configuration in Cisco ISE Platform

1.  Navigate to the Cisco ISE Dashboard
    
2.  Click on menú icon located in the top left corner.
    
3.  Under "System", click on "Settings".
    
4.  In the left bar, search for API settings.
    
5.  Under API Settings -> API Service Settings -> API Service Settings for Primary Administration Node, you should enable "Open API (Read/Write)".
    

### Required Permissions in Cisco ISE

The user account must have **read-only access** to the ERS (External RESTful Services) API:

-   **API Access**: Open API must be enabled on the Primary Administration Node
-   **User Role**: The account should be assigned an **Admin** role with at least **Read-Only** permissions
-   **Required API Access**:
    -   **Network Devices** (`/ers/config/networkdevice`) - to retrieve network device configurations
    -   **Network Device Groups** (`/ers/config/networkdevicegroup`) - to retrieve device groupings

The integration uses HTTP Basic authentication over HTTPS and accesses the ERS API endpoints. No write or modification permissions are required.

### Configuration in JupiterOne

To install the Cisco ISE integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Cisco ISE. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **PAN URL**: your PAN URL of the Primary Administration Node's address in a Cisco ISE deployment. Please do not include the http protocol (Ex: devnetsandbox.cisco.com). If you are using an non-standard port you can include it at the end of the url (Ex: devnetsandbox.cisco.com:9060)
    
-   **Username**: the username used for authentication.
    
-   **Password**: the password used for authentication.
    
-   The **Account Name** used to identify the Cisco ISE account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Data Source Settigns**: here you will be able to customize the steps to be ingested. If desired, specific steps can be enabled/disabled from here.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cisco_ise_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Network Device | `cisco_ise_network_device` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| Network Device Group | `cisco_ise_network_device_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cisco_ise_network_device_group` | **HAS** | `cisco_ise_network_device` |

---

Source: /integrations/directory/cisco-meraki

# Cisco Meraki

Visualize Cisco Meraki administrators, SAML roles, and devices within network sites, map Cisco Meraki users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need a Cisco Meraki API key with read access to your organization. The API key inherits the permissions of the administrator account that generates it, so a **read-only** organization administrator is sufficient.

### Generate a Meraki API key

1.  Log in to the [Meraki Dashboard](https://account.meraki.com/secure/login/dashboard_login) as an organization administrator.
2.  Go to **Organization** > **API & Webhooks**.
3.  Under **API access**, click **Generate new API key**.
4.  Copy the key and store it securely — it is shown only once.

> **NOTE**
> 
> The **API & Webhooks** page is visible only to organization administrators. If you do not see it, you will need to request organization admin access or have an existing admin generate the key.

For more information, see the [Cisco Meraki Dashboard API documentation](https://documentation.meraki.com/Platform_Management/Dashboard_Administration/Operate_and_Maintain/How-Tos/How_to_Use_the_Cisco_Meraki_Dashboard_API).

### Configuration in JupiterOne

To install the Cisco Meraki integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Cisco Meraki. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Cisco Meraki account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Cisco Meraki **API Key**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cisco_meraki_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Admin | `meraki_admin` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Device | `meraki_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Network | `meraki_network` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| Organization | `meraki_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| SAML Role | `meraki_saml_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| SSID | `meraki_wifi` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| VLAN | `meraki_vlan` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cisco_meraki_account` | **HAS** | `meraki_organization` |
| `meraki_network` | **HAS** | `meraki_device` |
| `meraki_network` | **HAS** | `meraki_vlan` |
| `meraki_network` | **HAS** | `meraki_wifi` |
| `meraki_organization` | **HAS** | `meraki_network` |
| `meraki_organization` | **HAS** | `meraki_admin` |
| `meraki_organization` | **HAS** | `meraki_saml_role` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `meraki_device` | **CONNECTS** | `internet` | FORWARD |
| `meraki_network` | **HAS** | `host` | FORWARD |
| `meraki_vlan` | **HAS** | `host` | FORWARD |

---

Source: /integrations/directory/cisco-secure-workload

# Cisco Secure Workload

Visualize Cisco Secure Workload user roles and scopes, and monitor changes through queries and alerts.

## Installation

To use the Cisco Secure Workload integration, you need an API Key and API Secret with the specific capabilities the integration requires. The integration authenticates using HMAC-SHA256 request signing — every request is signed with the API Secret, so no write access is granted.

### Prerequisites

1.  Log in to your Cisco Secure Workload dashboard.
2.  Click your account name in the upper right corner and choose **API Keys**.
3.  Click **Create API Key** and enter an optional description.
4.  Under **Capabilities**, select all three of the following:
    -   `user_role_scope_management` — read users, roles, and application scopes
    -   `flow_inventory_query` — query workload inventory, packages, and vulnerabilities
    -   `app_policy_management` — read application workspaces and security policies
5.  Click **Create**. Copy the API Key and API Secret and store them securely — the secret is shown only once.
6.  Note the URL of your Cisco Secure Workload dashboard (for example, `https://<tenant>.tetrationpreview.com`).

See [Cisco Secure Workload OpenAPIs](https://www.cisco.com/c/en/us/td/docs/security/workload_security/secure_workload/user-guide/3_10/cisco-secure-workload-user-guide-on-prem-v310/secure-workload-openapis.html) for full details on API key capabilities and authentication.

### Configuration in JupiterOne

Navigate to **Integrations** in JupiterOne, select **Cisco Secure Workload**, and click **New Instance**.

Creating an instance requires the following:

-   **API Key** — The API Key generated in Cisco Secure Workload.
-   **API Secret** — The API Secret generated alongside the API Key.
-   **API URI** — The base URL of your Cisco Secure Workload dashboard (for example, `https://<tenant>.tetrationpreview.com`).

Click **Create** to finish. The integration will begin running on the polling interval you selected, or you can trigger it manually at any time.

### Next steps

Once configured, your Cisco Secure Workload data will populate in JupiterOne. See the [Instance management guide](/integrations/instance-management.md) to learn how to edit, disable, or re-run your integration instance.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `csw_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Interface | `csw_interface` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Package | `csw_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Policy | `csw_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Role | `csw_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Scope | `csw_scope` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| User | `csw_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Workload | `csw_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Workload Finding | `csw_workload_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Workload Vulnerability | `csw_workload_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `csw_account` | **HAS** | `csw_user` |
| `csw_account` | **HAS** | `csw_role` |
| `csw_account` | **HAS** | `csw_policy` |
| `csw_interface` | **HAS** | `csw_scope` |
| `csw_package` | **HAS** | `csw_workload_finding` |
| `csw_policy` | **HAS** | `csw_scope` |
| `csw_project` | **HAS** | `csw_interface` |
| `csw_project` | **HAS** | `csw_package` |
| `csw_project` | **HAS** | `csw_workload_finding` |
| `csw_role` | **USES** | `csw_scope` |
| `csw_scope` | **HAS** | `csw_scope` |
| `csw_user` | **HAS** | `csw_role` |
| `csw_user` | **ASSIGNED** | `csw_scope` |

### Csw Workload Finding

`csw_workload_finding` inherits from [Finding](/data-model/schemas/Finding.md)

---

### Csw Workload Vulnerability

`csw_workload_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

---

## Release Notes

-   **2025-06-05** — Promoted Cisco Secure Workload vulnerability findings to carry both the Vulnerability and Finding entity classes, enabling cross-integration vulnerability queries.

---

Source: /integrations/directory/cisco-umbrella

# Cisco Umbrella

Visualize Cisco Umbrella networks, domains, destinations, users, and discovered applications in the JupiterOne graph. Use this integration to also map Cisco Umbrella users to employees in your JupiterOne account and to monitor changes to Cisco Umbrella entities using JupiterOne alerts.

## Installation

> **INFO**
> 
> Cisco Umbrella uses OAuth 2.0 client credentials (API Key and Key Secret) to authenticate API requests. You need access to an account with permission to create API keys. You must also have permission in JupiterOne to install new integrations.

### Configuration in Cisco Umbrella

1.  Sign in to [Cisco Umbrella](https://umbrella.cisco.com) and navigate to **Admin** > **API Keys**.
2.  Create a new API key with the following minimum scopes (all Read-Only):
    -   **Admin** — Roles, Users
    -   **Deployments**
    -   **Policies** — Destination Lists, Destinations
    -   **Reports** — App Discovery
3.  Record the **API Key** and **Key Secret** values.

> **NOTE**
> 
> Network Tunnel data requires an active **Cisco Umbrella SIG (Secure Internet Gateway)** license. If your account does not have SIG enabled, the integration will skip network tunnel ingestion and log a warning — all other data types will still be collected.

### Configuration in JupiterOne

To install the Cisco Umbrella integration in JupiterOne, navigate to the **Integrations** tab, select Cisco Umbrella, and click **New Instance**.

Creating an instance requires the following:

-   **API Key** — The Cisco Umbrella API key used for authentication.
-   **Key Secret** — The secret associated with the API key.

You can also set an optional **Description** and choose a **Polling Interval** for how often the integration runs. Leave the polling interval as `DISABLED` to trigger runs manually.

Click **Create** to save and activate the integration.

### Next steps

After creating the instance, the integration will run on the polling interval you configured and populate data in JupiterOne. See the [Instance management guide](/integrations/instance-management.md) for more on managing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (12)

-   `admin.roles:read`
-   `admin.users:read`
-   `deployments.internaldomains:read`
-   `deployments.internalnetworks:read`
-   `deployments.networkdevices:read`
-   `deployments.policies:read`
-   `deployments.sites:read`
-   `deployments.tunnels:read`
-   `deployments.virtualappliances:read`
-   `policies.destinationLists:read`
-   `policies.destinations:read`
-   `reports.appDiscovery:read`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (13)

-   `https://api.umbrella.com/admin/v2/roles`
-   `https://api.umbrella.com/admin/v2/users`
-   `https://api.umbrella.com/deployments/v2/internaldomains`
-   `https://api.umbrella.com/deployments/v2/internalnetworks`
-   `https://api.umbrella.com/deployments/v2/networkdevices`
-   `https://api.umbrella.com/deployments/v2/policies`
-   `https://api.umbrella.com/deployments/v2/sites`
-   `https://api.umbrella.com/deployments/v2/tunnels`
-   `https://api.umbrella.com/deployments/v2/virtualappliances`
-   `https://api.umbrella.com/policies/v2/destinationlists`
-   `https://api.umbrella.com/policies/v2/destinationlists/{destinationListId}/destinations`
-   `https://api.umbrella.com/reports/v2/appDiscovery/applicationCategories`
-   `https://api.umbrella.com/reports/v2/appDiscovery/applications`

### Licenses

Product licenses or SKUs required in the target environment.

Show Licenses (1)

-   `Cisco Umbrella SIG (Secure Internet Gateway)`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://developer.cisco.com/docs/cloud-security/umbrella-api-oauth-scopes/](https://developer.cisco.com/docs/cloud-security/umbrella-api-oauth-scopes/)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cisco_umbrella_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `cisco_umbrella_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Application Category | `cisco_umbrella_application_category` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Destination | `cisco_umbrella_destination` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Destination List | `cisco_umbrella_destination_list` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Domain | `cisco_umbrella_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| Network | `cisco_umbrella_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Network Device | `cisco_umbrella_network_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Network Tunnel | `cisco_umbrella_network_tunnel` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| Policy | `cisco_umbrella_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Site | `cisco_umbrella_site` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| System Role | `cisco_umbrella_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| System User | `cisco_umbrella_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Virtual Appliance | `cisco_umbrella_virtual_appliance` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cisco_umbrella_account` | **HAS** | `cisco_umbrella_application` |
| `cisco_umbrella_account` | **HAS** | `cisco_umbrella_destination_list` |
| `cisco_umbrella_account` | **HAS** | `cisco_umbrella_network_device` |
| `cisco_umbrella_account` | **HAS** | `cisco_umbrella_domain` |
| `cisco_umbrella_account` | **HAS** | `cisco_umbrella_network` |
| `cisco_umbrella_account` | **HAS** | `cisco_umbrella_policy` |
| `cisco_umbrella_account` | **HAS** | `cisco_umbrella_site` |
| `cisco_umbrella_account` | **HAS** | `cisco_umbrella_user` |
| `cisco_umbrella_application` | **HAS** | `cisco_umbrella_application_category` |
| `cisco_umbrella_destination_list` | **HAS** | `cisco_umbrella_destination` |
| `cisco_umbrella_site` | **HAS** | `cisco_umbrella_network_tunnel` |
| `cisco_umbrella_site` | **HAS** | `cisco_umbrella_virtual_appliance` |
| `cisco_umbrella_user` | **ASSIGNED** | `cisco_umbrella_role` |
| `cisco_umbrella_virtual_appliance` | **USES** | `cisco_umbrella_domain` |

---

Source: /integrations/directory/cloudbees

# Cloudbees

Visualize Cloudbees CI users, groups, roles, and accounts, map Cloudbees CI users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> For this integration, you will need to have a deployed Cloudbees CI Operations Center and user credentials for a user with administrator-level permissions.

To install the Cloudbees integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Cloudbees. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Cloudbees account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Cloudbees **User ID**, **API Key**, and **Hostname**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cloudbees_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Role | `cloudbees_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| User | `cloudbees_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| UserGroup | `cloudbees_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cloudbees_account` | **HAS** | `cloudbees_user` |
| `cloudbees_account` | **HAS** | `cloudbees_group` |
| `cloudbees_account` | **HAS** | `cloudbees_role` |
| `cloudbees_group` | **HAS** | `cloudbees_user` |
| `cloudbees_group` | **ASSIGNED** | `cloudbees_role` |

---

Source: /integrations/directory/cloudflare

# Cloudflare

Visualize Cloudflare users, access roles, domain zones, and domain records, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to create a [Cloudflare API Token](https://dash.cloudflare.com/profile/api-tokens) configured for read access with the following:

-   `Account` → `Access: Organizations, Identity Providers, and Groups` → `Read` to list identity provider information.
-   `Account` → `Account Settings` → `Read` to list accounts, members, and roles
-   `Account` → `DNS Firewall` → `Read` to list records in a zone
-   `Account` → `Zero Trust` → `Read` to list Zero Trust entities.
-   `Account` → `Access: Audit Logs` → `Read` to list Zero Trust entities.
-   `Account` → `Load Balancing: Monitors and Pools` → `Read` to list load balancer pools.
-   `Account` → `Account Rulesets` → `Read` to list account-level rulesets and their rules.
-   `Zone` → `Zone` → `Read` to get information about the zone
-   `Zone` → `DNS` → `Read` to list records in a zone.
-   `Zone` → `Load Balancers` → `Read` to list load balancers in a zone.
-   `Zone` → `Zone WAF` → `Read` to list zone-level rulesets and their rules.
-   `Zone` → `Logs` → `Read` to read the log retention flag of a zone. Only required when the **Ingest Log Retention Flag** configuration option is enabled.

![Token Creation](/assets/images/token-d5b36bbe4969e4be131e78397ee0868f.png)

Once created, obtain an API token from the bottom of the [**API Tokens** page](https://dash.cloudflare.com/profile/api-tokens) in your Cloudflare account. With the token, head to JupiterOne to complete the integration installation.

### Configuration in JupiterOne

To install the Cloudflare integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Cloudflare. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Cloudflare account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Cloudflare (read access) **API Token**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cloudflare_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Account Member | `cloudflare_account_member` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Account Role | `cloudflare_account_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| DNS Record | `cloudflare_dns_record` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |
| DNS Zone | `cloudflare_dns_zone` | [DomainZone](https://docs.jupiterone.io/data-model/schemas/DomainZone) |
| Load Balancer | `cloudflare_load_balancer` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Load Balancer Pool | `cloudflare_load_balancer_pool` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Ruleset | `cloudflare_ruleset` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| Ruleset Rule | `cloudflare_ruleset_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Zero Trust | `cloudflare_zero_trust_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Zero Trust Device | `cloudflare_zero_trust_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cloudflare_account` | **HAS** | `cloudflare_account_member` |
| `cloudflare_account` | **HAS** | `cloudflare_account_role` |
| `cloudflare_account` | **HAS** | `cloudflare_dns_zone` |
| `cloudflare_account` | **HAS** | `cloudflare_ruleset` |
| `cloudflare_account_member` | **ASSIGNED** | `cloudflare_account_role` |
| `cloudflare_dns_zone` | **HAS** | `cloudflare_dns_record` |
| `cloudflare_dns_zone` | **HAS** | `cloudflare_load_balancer` |
| `cloudflare_dns_zone` | **HAS** | `cloudflare_ruleset` |
| `cloudflare_load_balancer` | **USES** | `cloudflare_load_balancer_pool` |
| `cloudflare_ruleset` | **CONTAINS** | `cloudflare_ruleset_rule` |
| `cloudflare_zero_trust_user` | **OWNS** | `cloudflare_zero_trust_device` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `cloudflare_account` | **CONNECTS** | `cloudflare_account` | REVERSE |
| `cloudflare_dns_record` | **CONNECTS** | `cloudflare_load_balancer` | FORWARD |
| `cloudflare_dns_record` | **CONNECTS** | `aws_alb` | FORWARD |
| `cloudflare_load_balancer_pool` | **USES** | `cloudflare_dns_record` | FORWARD |

### Cloudflare Load Balancer

`cloudflare_load_balancer` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `adaptiveRoutingFailoverAcrossPools` | `boolean` |  |  |
| `countryPools` | `array` of `string`s |  |  |
| `createdOn` | `number` |  |  |
| `defaultPoolCount` | `number` |  |  |
| `defaultPoolIds` | `array` of `string`s |  |  |
| `description` | `string` |  |  |
| `displayName` | `string` |  |  |
| `enabled` | `boolean` |  |  |
| `fallbackPoolId` | `string` |  |  |
| `id` | `string` |  |  |
| `locationStrategyMode` | `string` |  |  |
| `locationStrategyPreferEcs` | `string` |  |  |
| `modifiedOn` | `number` |  |  |
| `popPools` | `array` of `string`s |  |  |
| `proxied` | `boolean` |  |  |
| `randomSteeringDefaultWeight` | `number` |  |  |
| `randomSteeringPoolWeights` | `array` of `string`s |  |  |
| `regionPools` | `array` of `string`s |  |  |
| `rules` | `array` of `string`s |  |  |
| `sessionAffinity` | `string` |  |  |
| `sessionAffinityDrainDuration` | `number` |  |  |
| `sessionAffinityHeaders` | `array` of `string`s |  |  |
| `sessionAffinityRequireAllHeaders` | `boolean` |  |  |
| `sessionAffinitySamesite` | `string` |  |  |
| `sessionAffinitySecure` | `string` |  |  |
| `sessionAffinityTTL` | `number` |  |  |
| `sessionAffinityZeroDowntimeFailover` | `string` |  |  |
| `steeringPolicy` | `string` |  |  |
| `ttl` | `number` |  |  |
| `zoneName` | `string` |  |  |

---

### Cloudflare Load Balancer Pool

`cloudflare_load_balancer_pool` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `checkRegions` | `array` of `string`s |  |  |
| `createdOn` | `number` |  |  |
| `description` | `string` |  |  |
| `id` | `string` |  |  |
| `latitude` | `number` |  |  |
| `loadSheddingDefaultPercent` | `number` |  |  |
| `loadSheddingDefaultPolicy` | `string` |  |  |
| `loadSheddingSessionPercent` | `number` |  |  |
| `loadSheddingSessionPolicy` | `string` |  |  |
| `longitude` | `number` |  |  |
| `minimumOrigins` | `number` |  |  |
| `modifiedOn` | `number` |  |  |
| `monitor` | `string` |  |  |
| `networks` | `array` of `string`s |  |  |
| `originAddresses` | `array` of `string`s |  |  |

---

### Cloudflare Ruleset

`cloudflare_ruleset` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` |  |  |
| 

`phase` \*

 | `string` **|** `null` |  |  |
| 

`source` \*

 | `string` **|** `null` |  |  |
| 

`version` \*

 | `string` **|** `null` |  |  |
| 

`zoneId` \*

 | `string` **|** `null` |  |  |

---

### Cloudflare Ruleset Rule

`cloudflare_ruleset_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `string` **|** `null` |  |  |
| 

`actionParametersId` \*

 | `string` **|** `null` |  |  |
| 

`actionParametersOverridesAction` \*

 | `string` **|** `null` |  |  |
| 

`actionParametersVersion` \*

 | `string` **|** `null` |  |  |
| 

`expression` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isActionParametersOverridesEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` |  |  |
| 

`position` \*

 | `number` **|** `null` |  |  |
| 

`ref` \*

 | `string` **|** `null` |  |  |
| 

`rulesetId` \*

 | `string` **|** `null` |  |  |
| 

`version` \*

 | `string` **|** `null` |  |  |

---

### Cloudflare Zero Trust Device

`cloudflare_zero_trust_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdOn` | `number` |  |  |
| `deleted` | `boolean` |  |  |
| `deviceType` | `string` |  |  |
| `id` | `string` |  |  |
| `ip` | `string` |  |  |
| `key` | `string` |  |  |
| `macAddress` | `string` |  |  |
| `manufacturer` | `string` |  |  |
| `name` | `string` |  |  |
| `osDistroName` | `string` |  |  |
| `osDistroRevision` | `string` |  |  |
| `osVersionExtra` | `string` |  |  |
| `revokedOn` | `number` |  |  |
| `serialNumber` | `string` |  |  |
| `updatedOn` | `number` |  |  |
| `userEmail` | `string` |  |  |
| `userName` | `string` |  |  |
| `version` | `string` |  |  |

---

### Cloudflare Zero Trust User

`cloudflare_zero_trust_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessSeat` | `boolean` |  |  |
| `activeDeviceCount` | `number` |  |  |
| `gatewaySeat` | `boolean` |  |  |
| `lastSuccessfulLoginOn` | `number` |  |  |
| `seatUid` | `string` |  |  |
| `uid` | `string` |  |  |

---

## Release Notes

-   **2025-10-24** — Improved accuracy of Zero Trust device properties including public IP, OS version, hardware ID, and last-seen timestamps.
-   **2025-09-05** — Added Cloudflare ruleset ingestion at both the account and zone scopes, including ruleset rules as queryable entities.
-   **2025-05-21** — Added mapped relationships from DNS CNAME records to AWS Application Load Balancers, and from load balancer pools to their DNS records.
-   **2025-04-28** — Added Cloudflare Load Balancer ingestion, including load balancers and their pools, with relationships to DNS zones.

---

Source: /integrations/directory/cobalt

# Cobalt

Visualize Cobalt pentests and findings, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> For this integration, you will need to create and copy an API Token in Cobalt. See [their documentation](https://developer.cobalt.io/platform-deep-dive/cobalt-account/account-settings/#create-and-manage-api-tokens) for more information.

### Configuration in JupiterOne

To install the Cobalt integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Cobalt. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Cobalt account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Cobalt **API Key**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Cobalt | `cobalt_vendor` | [Vendor](https://docs.jupiterone.io/data-model/schemas/Vendor) |
| Cobalt Account | `cobalt_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cobalt Asset | `cobalt_asset` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Cobalt Asset | `cobalt_asset` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| Cobalt Asset | `cobalt_asset` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Cobalt Asset | `cobalt_asset` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cobalt Finding | `cobalt_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Cobalt Pentest | `cobalt_pentest` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Cobalt pentest service | `cobalt_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cobalt_account` | **HAS** | `cobalt_service` |
| `cobalt_account` | **HAS** | `cobalt_asset` |
| `cobalt_asset` | **HAS** | `cobalt_finding` |
| `cobalt_pentest` | **IDENTIFIED** | `cobalt_finding` |
| `cobalt_service` | **PERFORMED** | `cobalt_pentest` |
| `cobalt_vendor` | **PROVIDES** | `cobalt_service` |
| `cobalt_vendor` | **PERFORMED** | `cobalt_pentest` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `cobalt_finding` | **IS** | `cve` | FORWARD |
| `cobalt_finding` | **IS** | `cwe` | FORWARD |

### Cobalt Finding

`cobalt_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetId` \*

 | `string` **|** `null` |  |  |
| 

`category` \*

 | `string` **|** `null` |  |  |
| 

`cobaltHashtag` \*

 | `string` **|** `null` |  |  |
| 

`impact` \*

 | `number` **|** `null` |  |  |
| 

`likelihood` \*

 | `number` **|** `null` |  |  |
| 

`pentestId` \*

 | `string` **|** `null` |  |  |
| 

`prerequisites` \*

 | `string` **|** `null` |  |  |
| 

`proofOfConcept` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`suggestedFix` \*

 | `string` **|** `null` |  |  |
| 

`targets` \*

 | `array` **|** `null` |  |  |

---

## Release Notes

-   **2025-06-06** — Promoted Cobalt finding entities to carry both the Vulnerability and Finding entity classes, enabling broader query compatibility.

---

Source: /integrations/directory/confluent-cloud

# Confluent Cloud

Visualize Confluent Cloud Organization, Environments, Clusters, and monitor changes through queries and alerts.

## Installation

### Requirements

-   JupiterOne requires API Key Id & API Key Secret. You need permission to create a service account in Confluent Cloud that will be used to obtain the API Key Id & Secret. The Service Account should have the `MetricsViewer` permission to allow the ability to pull data.
-   You must have permission in JupiterOne to install new integrations.

### Configuration in Confluent Cloud

#### Create a Service Account and Grant Required Permissions

1.  Visit the [Accounts Page](https://confluent.cloud/settings/org/accounts).
2.  Toggle to the "Service Accounts" tab.
3.  Click the "+ Add Service Account" button.
4.  Enter a meaningful name and description for the service account.
5.  Click the "+ Add Role Assignment" button.
6.  Select "Organization" and choose the role "MetricsViewer".
7.  Click "Next" and then "Create Service Account."

#### Generate an API Key

1.  Visit the [API Key Page](https://confluent.cloud/settings/api-keys).
2.  Click the "Add API Key" button.
3.  Select "Service Account".
4.  Choose the service account you created earlier with the "MetricsViewer" role and click "Next".
5.  Select "Cloud Resource Management" as the scope for the API key and click "Next."
6.  Enter a meaningful name and description for the API key and create it.
7.  Copy or download the API Key & API Secret. It will disappear once you close the page.

### Configuration in JupiterOne

1.  From the top navigation of the J1 Search homepage, select **Integrations**
2.  Scroll to the **Confluent Cloud** integration tile and click it.
3.  Click the **Add Configuration** button and configure the following settings:

-   Enter the **Account Name** by which you'd like to identify this Confluent Cloud instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
-   Enter a **Description** that will further assist your team when identifying the integration instance.
-   Select a **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
-   Enter the **Confluent Cloud API Key** generated for use by JupiterOne.
-   Enter the **Confluent Cloud API Secret** generated for use by JupiterOne.

4.  Click **Create Configuration** once all values are provided.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Confluent Cloud Environment | `confluent_cloud_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Confluent Cloud Kafka Cluster | `confluent_cloud_kafka_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Confluent Cloud KSQL DB Cluster | `confluent_cloud_ksql_db_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Confluent Cloud Organization | `confluent_cloud_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `confluent_cloud_environment` | **CONTAINS** | `confluent_cloud_kafka_cluster` |
| `confluent_cloud_kafka_cluster` | **CONTAINS** | `confluent_cloud_ksql_db_cluster` |
| `confluent_cloud_organization` | **CONTAINS** | `confluent_cloud_environment` |

---

Source: /integrations/directory/controlup

# Controlup

Visualize Hosts, users, and Host Agents in Controlup while monitoring changes through advanced queries and automated alerts.

## Installation

### Requirements

-   User must have the **Manage Users** role to access User details in ControlUp account.
-   User must have permission in JupiterOne to install new integrations.

### Configuration in ControlUp

#### Generate API Key and collect Organization ID from ControlUp

1.  Log in to your ControlUp account at [https://app.controlup.com](https://app.controlup.com).
2.  Click on **Profile Icon** in the top-right corner.
3.  Go to **API Key Management > Create new**
4.  Provide **Name** and **Duration** for the API key and click on **Create**.
5.  Copy the **API key** and store it securely for further use.
6.  Go to **API Key Management** or **AccountSettings**
7.  Copy the **Organization ID**.

### Configuration in JupiterOne

1.  From the top navigation of the J1 Search homepage, select **Integrations**
2.  Search for the **ControlUp** and select it.
3.  Click on the **Add Instance** button and configure the following settings:

-   Enter the **ControlUp API Key** generated for use by JupiterOne.
-   Enter the **ControlUp Organization ID** generated for use by JupiterOne.
-   Enter the **Account Name** by which you'd like to identify this ControlUp Cloud instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
-   Enter a **Description** that will further assist your team when identifying the integration instance.
-   Select a **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.

4.  Click **Create Instance** once all values are provided.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Host | `controlup_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Host Agent | `controlup_hostagent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| User | `controlup_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `controlup_hostAgent` | **MONITORS** | `controlup_host` |

### Controlup Host

`controlup_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activeUsernames` | `array` of `string`s |  |  |
| `agentConfigGroup` | `string` |  |  |
| `bssids` | `array` of `string`s |  |  |
| `cpuPCoreCount` | `number` | Count of Physical CPU cores in a processor |  |
| `cpuVCoreCount` | `number` | Count of Virtual CPU cores in a processor |  |
| `displayCount` | `number` |  |  |
| `dnsFriendlyName` | `string` |  |  |
| `dsGroups` | `array` of `string`s |  |  |
| `firewallStatus` | `string` |  |  |
| `gpuMemory` | `number` | Memory of Graphical Processing Unit |  |
| `gpuName` | `string` | Name of Graphical Processing Unit |  |
| `gpuVersion` | `string` | Version of Graphical Processing Unit |  |
| `group` | `array` of `string`s |  |  |
| `hasWiredMacAddress` | `boolean` |  |  |
| `hasWirelessMacAddress` | `boolean` |  |  |
| `interfaceTypes` | `array` of `string`s |  |  |
| `lastCommunicatedOn` | `number` |  |  |
| `memory` | `number` |  |  |
| `networkData` | `string` |  |  |
| `osDiskConfigurationFreespace` | `number` |  |  |
| `osDiskConfigurationUsedspace` | `number` |  |  |
| `osDomainSite` | `string` |  |  |
| `osPatch` | `string` |  |  |
| `platformFriendlyName` | `string` |  |  |
| `publicIPCity` | `string` |  |  |
| `publicIPCountry` | `string` |  |  |
| `publicIPState` | `string` |  |  |
| `remoteAddress` | `string` |  |  |
| `remoteAddressGeo` | `string` |  |  |
| `remoteAddressISP` | `string` |  |  |
| `serialNumber` | `string` |  |  |
| `ssids` | `array` of `string`s |  |  |
| `wifiMACAddresses` | `array` of `string`s |  |  |
| `wifiNames` | `array` of `string`s |  |  |
| `wiredMacAddresses` | `array` of `string`s |  |  |
| `wirelessMacAddresses` | `array` of `string`s |  |  |

---

### Controlup Hostagent

`controlup_hostagent` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentVersion` | `string` |  |  |
| `autoUpdateMode` | `string` |  |  |
| `build` | `string` |  |  |
| `configUpdateInterval` | `number` |  |  |
| `debugLevel` | `number` |  |  |
| `deviceGroup` | `string` |  |  |
| `geoLocation` | `string` |  |  |
| `isAgentAutoUpdateEnabled` | `boolean` |  |  |
| `refreshInterval` | `number` |  |  |
| `statusInterval` | `number` |  |  |
| `triggerIntervalShort` | `number` |  |  |

---

### Controlup User

`controlup_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `eulaVersion` | `string` |  |  |
| `loginMethods` | `array` of `string`s |  |  |
| `phone` | `string` |  |  |
| `region` | `string` |  |  |
| `roleNames` | `array` of `string`s |  |  |
| `vdiDaasLdapLogin` | `boolean` |  |  |

---

---

Source: /integrations/directory/cribl-edge

# Cribl Edge

Visualize your Cribl Edge deployment in JupiterOne — the Fleets you organize your telemetry agents into and the Edge Nodes reporting to your Leader, with the host, OS, and version each Node reports. Edge Nodes running on EC2 instances or Azure VMs are correlated to those hosts in the graph, so you can see which of your compute is covered by telemetry collection and monitor Fleet membership and agent versions through queries and alerts.

## Installation

This integration reads your Cribl Edge deployment through the [Cribl Control Plane REST API](https://docs.cribl.io/cribl-as-code/api-reference/control-plane/cribl-edge) — the Edge Fleets configured on your Leader and the Edge Nodes reporting into them, including each Node's hostname, operating system, architecture, Cribl version, and connection state. It is read-only: it issues only `GET` requests against the Fleets and Nodes collections and never modifies your Cribl configuration.

Nodes that report AWS or Azure metadata are mapped to the matching `aws_instance` or `azure_vm` entity already in your graph. Those relationships are only created when the target host is present — the integration never creates placeholder cloud instances.

### Prerequisites

-   A **Cribl Edge** deployment, either on Cribl.Cloud (including Hybrid) or a customer-managed (on-premises) Leader.
-   The base URL of that deployment:
    -   **Cribl.Cloud** — your workspace URL, in the form `https://${workspaceName}-${organizationId}.cribl.cloud`.
    -   **On-premises** — your Leader URL, including the port, for example `https://leader.example.com:9000`.
-   Credentials with read access to Worker Groups and Fleets — see below.
-   Access to JupiterOne with permission to configure integrations.

> **NOTE**
> 
> Customer-managed Leaders are commonly deployed inside a private network and are not reachable from the internet. In that case, run this integration through a [JupiterOne Collector](/integrations/development/collector.md) inside your network.

### Configuration in Cribl

This integration supports two authentication methods. Choose the one that matches your deployment when you create the instance in JupiterOne; each presents its own set of fields.

#### Cribl.Cloud / Hybrid (OAuth2)

An Organization Owner or Admin creates an API Credential in the Cribl.Cloud UI, which yields a **Client ID** and a **Client Secret**. The integration exchanges those for a bearer token against `https://login.cribl.cloud/oauth/token`.

The credential needs the `user:read:workergroups` scope, which grants read access to Worker Groups and Edge Fleets. This scope is part of the default set granted to API Credentials.

> **CAUTION**
> 
> The Client Secret is shown only when the credential is created. Record it before leaving the page — if you lose it, you must create a new credential.

See the Cribl [API authentication guide](https://docs.cribl.io/cribl-as-code/api-auth) for the current steps.

#### On-premises (Username/Password)

The integration posts a username and password to `/api/v1/auth/login` on your Leader and uses the returned bearer token. Create a dedicated Cribl user for it rather than reusing an operator account.

Grant that user read access to your Edge Fleets. In the Roles and Policies model this is the built-in **`reader_all`** role, which carries the **`GroupRead`** policy across all Worker Groups and Fleets; in the Members and Permissions model, grant Read Only at the Worker Group level.

> **NOTE**
> 
> Role- and permission-based access control requires a Cribl Enterprise license. On deployments without one, any authenticated user has full access and no explicit grant is needed.

See the Cribl [Roles documentation](https://docs.cribl.io/stream/roles/) for details.

### Configuration in JupiterOne

To install the Cribl Edge integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Cribl Edge**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Cribl Edge account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The authentication method matching your deployment, and its fields:
    
    **Cribl.Cloud / Hybrid (OAuth2)**
    
    -   Your **Workspace URL** — for example `https://main-acmecorp-abcd1234.cribl.cloud`.
    -   The **Client ID** and **Client Secret** of the API Credential you created.
    
    **On-Premises (Username/Password)**
    
    -   Your **Leader URL** — for example `https://leader.example.com:9000`.
    -   The **Username** and **Password** of the Cribl user you created.
-   Optionally, **Ingest Disconnected Nodes**. Enabled by default, meaning Edge Nodes the Leader currently reports as disconnected are still ingested. Disable it to ingest only Nodes actively connected to the Leader.
    

Click **Create** once all values are provided to finalize the integration.

> **NOTE**
> 
> The `/api/v1` suffix is appended to your URL automatically. A trailing slash, or a URL you paste with `/api/v1` already on it, is handled for you.

#### Data sources

You can narrow what the integration collects from the instance's ingestion source settings. **Fetch Edge Fleets** underpins **Fetch Edge Nodes** — Nodes are attached to the graph through their Fleet, so disabling Fleets also disables Node collection.

| Ingestion source | Data collected |
| --- | --- |
| **Fetch Edge Fleets** | Edge Fleets on the Leader, their deployed configuration version and Node count, and Subfleet nesting. |
| **Fetch Edge Nodes** | Edge Nodes, with hostname, OS and architecture, Cribl version, connection state, and cloud metadata. |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Authenticate with the Cribl API](https://docs.cribl.io/cribl-as-code/api-auth) — token endpoints and lifetimes for both deployment types
-   [Cribl Edge API reference](https://docs.cribl.io/cribl-as-code/api-reference/control-plane/cribl-edge)
-   [Roles](https://docs.cribl.io/stream/roles/) — on-premises roles and policies
-   [Manage Edge Fleets](https://docs.cribl.io/edge/fleets/)

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (1)

-   `GroupRead`

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `reader_all`

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (1)

-   `user:read:workergroups`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (2)

-   `GET /api/v1/products/edge/groups`
-   `GET /api/v1/products/edge/workers`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (3)

-   [https://docs.cribl.io/cribl-as-code/api-auth](https://docs.cribl.io/cribl-as-code/api-auth)
-   [https://docs.cribl.io/cribl-as-code/api-reference/control-plane/cribl-edge](https://docs.cribl.io/cribl-as-code/api-reference/control-plane/cribl-edge)
-   [https://docs.cribl.io/stream/roles/](https://docs.cribl.io/stream/roles/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (1)

| Step | Permissions | Roles | OAuth Scopes | Endpoints |
| --- | --- | --- | --- | --- |
| Fetch Edge Nodes | `GroupRead` | `reader_all` | `user:read:workergroups` | `GET /api/v1/products/edge/workers` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cribl_edge_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Edge Fleet | `cribl_edge_fleet` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Edge Node | `cribl_edge_node` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Service | `cribl_edge_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cribl_edge_account` | **PROVIDES** | `cribl_edge_service` |
| `cribl_edge_account` | **HAS** | `cribl_edge_fleet` |
| `cribl_edge_fleet` | **HAS** | `cribl_edge_fleet` |
| `cribl_edge_fleet` | **HAS** | `cribl_edge_node` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `cribl_edge_node` | **MONITORS** | `aws_instance` | FORWARD |
| `cribl_edge_node` | **MONITORS** | `azure_vm` | FORWARD |
| `cribl_edge_node` | **MONITORS** | `host` | FORWARD |
| `cribl_edge_node` | **MONITORS** | `device` | FORWARD |

### Cribl Edge Account

`cribl_edge_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`deploymentType` \*

 | `string` **|** `null` | The deployment mode of the Cribl account: 'cloud' (Cribl.Cloud) or 'on-prem'. |  |
| 

`hostname` \*

 | `string` **|** `null` | The configured Cribl Leader hostname or Cribl.Cloud workspace URL. |  |

---

### Cribl Edge Fleet

`cribl_edge_fleet` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`configVersion` \*

 | `string` **|** `null` | Commit hash of the deployed configuration version for the Fleet. |  |
| 

`fleetId` \*

 | `string` | The Cribl Fleet id (unique within the deployment). |  |
| 

`fleetType` \*

 | `string` **|** `null` | Explicit Cribl group type (always 'edge' for Fleets). |  |
| 

`isOnPrem` \*

 | `boolean` **|** `null` | Whether the Fleet uses customer-hosted (on-prem) Nodes rather than Cribl.Cloud. |  |
| 

`nodeCount` \*

 | `number` **|** `null` | Number of Nodes currently in the Fleet (workerCount). |  |

---

### Cribl Edge Node

`cribl_edge_node` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`architecture` \*

 | `string` **|** `null` | CPU architecture reported by the Node (e.g. 'x64', 'arm64'). |  |
| 

`awsInstanceId` \*

 | `string` **|** `null` | AWS EC2 instance id, when the AWS metadata collector is enabled. |  |
| 

`awsRegion` \*

 | `string` **|** `null` | AWS region, when the AWS metadata collector is enabled. |  |
| 

`azureVmId` \*

 | `string` **|** `null` | Azure VM id, when the Azure metadata collector is enabled. |  |
| 

`connectionProtocol` \*

 | `string` **|** `null` | Node-to-Leader connection protocol ('tcp', 'tls', or 'http2'). |  |
| 

`firstSeenOn` \*

 | `number` **|** `null` | Epoch milliseconds when the Leader first received a message from the Node. |  |
| 

`guid` \*

 | `string` **|** `null` | The unique Cribl instance identifier (guid) for the Node. |  |
| 

`hostname` \*

 | `string` **|** `null` | Hostname reported by the Node. |  |
| 

`installType` \*

 | `string` **|** `null` | The Cribl install type reported by the Node (CRIBL\_INSTALL\_TYPE). |  |
| 

`ipAddresses` \*

 | `array` **|** `null` | Network addresses reported by the host operating system. |  |
| 

`isConnected` \*

 | `boolean` **|** `null` | Whether the Node is currently connected to the Leader. |  |
| 

`nodeId` \*

 | `string` | The Cribl Node id (unique within the deployment). |  |
| 

`osName` \*

 | `string` **|** `null` | Host operating system distribution name reported by the Node. |  |
| 

`osRelease` \*

 | `string` **|** `null` | OS release string reported by the Node. |  |
| 

`osVersion` \*

 | `string` **|** `null` | Host operating system version reported by the Node. |  |
| 

`platform` \*

 | `string` **|** `null` | OS platform reported by the Node (e.g. 'linux', 'win32', 'darwin'). |  |
| 

`version` \*

 | `string` **|** `null` | Cribl software version running on the Node. |  |

---

### Cribl Edge Service

`cribl_edge_service` inherits from [Service](/data-model/schemas/Service.md)

---

---

Source: /integrations/directory/crowdstrike

# CrowdStrike

Visualize Crowdstrike endpoint agents and protected devices, map agents to devices and their respective owners, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create an API client in the CrowdStrike Falcon console. See the [CrowdStrike API Clients and Configuration](https://developer.crowdstrike.com/crowdstrike/docs/api-clients-and-configuration) documentation for details.

When creating the API client, grant (at minimum) read access to the following scopes:

-   **Hosts**
-   **Prevention Policies**

Additional scopes are required to enable optional ingestion steps:

-   **Alerts**
-   **Apps** (Falcon Discover applications)
-   **Cloud Security API Assets** (Compliance Controls)
-   **Cloud Security API Detections** (IOM Findings)
-   **Cloud Security AWS Registration** (CSPM)
-   **Cloud Security Azure Registration** (CSPM)
-   **Device control policies**
-   **External Assets** (EASM Findings)
-   **Falcon Container Image** (Container Security, Serverless Vulnerabilities)
-   **Firewall management**
-   **Kubernetes Protection** (Container–host relationships)
-   **SaaS Security (Falcon Shield)**
-   **Spotlight Vulnerabilities** (Vulnerabilities, Remediations, EASM Findings)
-   **User management**
-   **Zero Trust Assessment**

To install the CrowdStrike integration in JupiterOne, navigate to the **Integrations** tab and select **CrowdStrike**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the CrowdStrike account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   An optional **Description** to help identify the integration instance.
    
-   A **Polling Interval** for how frequently data is refreshed. Leave this as `DISABLED` to trigger runs manually.
    
-   Your CrowdStrike **API client ID** and **API client secret** to authenticate with the Falcon API.
    
-   An optional **Availability Zone** for API calls. Leave blank to use the main endpoint (`api.crowdstrike.com`). For example, entering `us-2` routes requests to `api.us-2.crowdstrike.com`.
    

Click **Create** once all values are provided to start the integration.

> **NOTE**
> 
> The CrowdStrike integration only ingests applications that have vulnerabilities. Applications without vulnerabilities will not appear in JupiterOne.

## Data Volume Configuration

### Ingestion Windows

Define how far back in time data is collected during each ingestion run. Each data type has its own configurable window.

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Device Ingestion Window** | Days to look back for devices by last-seen date. | 50 | 7, 15, 30, 50, 60, 90, 180, 275, 365 |
| **Vulnerabilities Ingestion Window** | Days to look back for updated vulnerabilities. | 90 | 90, 180, 275, 365 |
| **Alerts Ingestion Window** | Days to look back for updated alerts. | 90 | 90, 180, 275, 365 |
| **Applications Ingestion Window** | Days to look back for last-used applications. | 90 | 90, 180, 275, 365 |
| **Containers Ingestion Window** | Days to look back for containers by first-seen date. | 50 | 7, 15, 30, 50, 60, 90, 180, 275, 365 |
| **Container Image Vulnerabilities Ingestion Window** | Days to look back for container image vulnerabilities by first-seen date. | 365 | 90, 180, 275, 365 |
| **EASM Findings Ingestion Window** | Days to look back for EASM findings by created date. | 90 | 7, 15, 30, 50, 60, 90, 180, 275, 365 |
| **Serverless Vulnerabilities Ingestion Window** | Days to look back for serverless vulnerabilities. | 90 | 90, 180, 275, 365 |
| **Serverless Vulnerabilities Page Size** | Maximum number of serverless vulnerabilities fetched per API request. Must be a whole number between 1 and 500. | _(not set)_ | — |

### Data Filtering Options

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Included Vulnerability Severities** | Vulnerability severity levels to ingest. Configure this field **or** **Included Vulnerability Exprt Ratings** — not both simultaneously. | Critical, High, Medium, Unknown | Critical, High, Medium, Low, None, Unknown |
| **Included Vulnerability Exprt Ratings** | ExPRT ratings to use as a vulnerability filter instead of severity levels. When set, severity-based filters are ignored. | _(not set)_ | Critical, High, Medium, Low, Unknown |
| **Include Closed Vulnerabilities** | When enabled, ingests vulnerabilities that are marked as closed in CrowdStrike. | Disabled | — |
| **Included Alerts Severities** | Alert severity levels to ingest. | Critical, High, Medium | Critical, High, Medium, Low, Informational |
| **Ingest suspicious applications only** | When enabled, only applications flagged as suspicious in CrowdStrike are ingested. | Disabled | — |
| **CSPM Cloud Providers** | Cloud providers to monitor for CSPM findings, cloud accounts, and IOM findings. If nothing is selected, CSPM data is not ingested. | _(not set)_ | AWS, Azure |
| **IOM Severity Filter** | IOM finding severity levels to ingest. | Critical | Critical, High, Medium, Informational |
| **Compliance Control Severities** | Compliance control severity levels to ingest. | Critical, High | Critical, High, Medium, Informational, Unknown |
| **Included EASM Finding Severities** | EASM finding severity levels to ingest. | Critical, High | Critical, High, Medium, Low, Unknown |
| **Included Image Vulnerability Severities** | Container image vulnerability severity levels to ingest. | Critical, High | Critical, High, Medium, Low, Unknown |
| **Serverless Cloud Providers** | Cloud providers to ingest serverless vulnerabilities for. | AWS | AWS, GCP, Azure |
| **Included Serverless Vulnerability Severities** | Serverless vulnerability severity levels to ingest. | Critical, High | Critical, High, Medium, Low, None, Unknown |

## Multi-Tenant (MSSP) Configuration

CrowdStrike Flight Control allows a parent account to manage multiple child CIDs. To enable multi-tenant ingestion:

1.  Enable **Configure Child CIDs**.
2.  Enter the **Parent CID** — the CID of the parent CrowdStrike account.

When configured, JupiterOne automatically creates a separate integration instance for each child CID discovered under the parent account.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (15)

-   `alerts:read`
-   `assets:read`
-   `cloud-security-assets:read`
-   `cspm-registration:read`
-   `device-control-policies:read`
-   `discover:read`
-   `falcon-container-image:read`
-   `firewall-policies:read`
-   `hosts:read`
-   `kubernetes-protection:read`
-   `prevention-policies:read`
-   `saas-security:read`
-   `spotlight-vulnerabilities:read`
-   `user-management:read`
-   `zero-trust-assessment:read`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (33)

-   `/alerts/combined/alerts/v1`
-   `/cloud-connect-cspm-aws/entities/account/v1`
-   `/cloud-connect-cspm-azure/entities/account/v1`
-   `/cloud-security-assets/combined/compliance-controls/by-account-region-and-resource-type/v1`
-   `/container-security/combined/containers/v1`
-   `/container-security/combined/image-assessment/images/v1`
-   `/container-security/combined/images/export/v1`
-   `/container-security/combined/vulnerabilities/v1`
-   `/detects/entities/iom/v2`
-   `/detects/queries/iom/v2`
-   `/devices/entities/devices/v2`
-   `/devices/queries/devices-hidden/v1`
-   `/devices/queries/devices-scroll/v1`
-   `/discover/combined/applications/v1`
-   `/fem/entities/external-assets/v1`
-   `/fem/queries/external-assets/v1`
-   `/lambdas/combined/vulnerabilities/sarif/v1`
-   `/policy/combined/device-control/v1`
-   `/policy/combined/firewall/v1`
-   `/policy/combined/prevention/v1`
-   `/policy/queries/device-control-members/v1`
-   `/policy/queries/firewall-members/v1`
-   `/policy/queries/prevention-members/v1`
-   `/saas-security/entities/alerts/v3`
-   `/saas-security/entities/apps/v3`
-   `/saas-security/entities/integrations/v3`
-   `/settings/entities/policy/v1`
-   `/spotlight/combined/vulnerabilities/v1`
-   `/spotlight/entities/remediations/v2`
-   `/user-management/entities/users/GET/v1`
-   `/user-management/queries/users/v1`
-   `/zero-trust-assessment/entities/assessments/v1`
-   `/zero-trust-assessment/queries/assessments/v1`

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (15)

| Step | OAuth Scopes | Endpoints |
| --- | --- | --- |
| Build Host to Container Image Relationships | `kubernetes-protection:read` | `/container-security/combined/containers/v1` |
| Compliance Controls | `cloud-security-assets:read` | `/cloud-security-assets/combined/compliance-controls/by-account-region-and-resource-type/v1` |
| Fetch Alerts | `alerts:read` | `/alerts/combined/alerts/v1` |
| Fetch Applications | `discover:read` | `/discover/combined/applications/v1` |
| Fetch Container Images Vulnerabilities | `falcon-container-image:read` | `/container-security/combined/vulnerabilities/v1` |
| Fetch Device Control Policy Relationships | `device-control-policies:read` | `/policy/combined/device-control/v1`, `/policy/queries/device-control-members/v1` |
| Fetch Device Policies | `prevention-policies:read` | `/policy/queries/prevention-members/v1` |
| Fetch EASM Findings | `spotlight-vulnerabilities:read`, `assets:read` | `/spotlight/combined/vulnerabilities/v1` |
| Fetch Falcon Shield Alerts | `saas-security:read` | `/saas-security/entities/alerts/v3` |
| Fetch Falcon Shield Apps | `saas-security:read` | `/saas-security/entities/apps/v3` |
| Fetch Firewall Policy Relationships | `firewall-policies:read` | `/policy/combined/firewall/v1`, `/policy/queries/firewall-members/v1` |
| Fetch Remediations | `spotlight-vulnerabilities:read` | `/spotlight/entities/remediations/v2` |
| Fetch Vulnerabilities | `spotlight-vulnerabilities:read` | `/spotlight/combined/vulnerabilities/v1` |
| IOM Findings | `cspm-registration:read` | `/detects/queries/iom/v2`, `/detects/entities/iom/v2` |
| IOM Rules | `cspm-registration:read` | `/settings/entities/policy/v1` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `crowdstrike_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `crowdstrike_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Application | `crowdstrike_detected_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS API Gateway Resource | `crowdstrike_aws_api_gateway_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS API Gateway REST API | `crowdstrike_aws_api_gateway_rest_api` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Athena Work Group | `crowdstrike_aws_athena_work_group` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Auto Scaling Launch Configuration | `crowdstrike_aws_autoscaling_launch_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS CloudFormation Stack | `crowdstrike_aws_cloudformation_stack` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS CloudFront Domain | `crowdstrike_aws_cloudfront_domain` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudTrail | `crowdstrike_aws_cloudtrail` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudTrail Account | `crowdstrike_aws_cloudtrail_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AWS CloudTrail Bucket | `crowdstrike_aws_cloudtrail_bucket` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS CodeBuild Project | `crowdstrike_aws_codebuild_project` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cognito User Pool | `crowdstrike_aws_cognito_user_pool` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Config Account | `crowdstrike_aws_config_account` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS DynamoDB Table | `crowdstrike_aws_dynamodb_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| AWS EBS Snapshot | `crowdstrike_aws_ebs_snapshot` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| AWS EBS Volume | `crowdstrike_aws_ebs_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS EC2 Instance | `crowdstrike_aws_ec2_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS EC2 Network Acl | `crowdstrike_aws_ec2_network_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS EC2 Security Group | `crowdstrike_aws_ec2_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS ECR Repository | `crowdstrike_aws_ecr_repository` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| AWS ECS Task Definition | `crowdstrike_aws_ecs_task_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS EFS File System | `crowdstrike_aws_efs_file_system` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS EKS Cluster | `crowdstrike_aws_eks_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS ElastiCache Cluster | `crowdstrike_aws_elasticache_cluster` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| AWS ELB Azure Tenant | `crowdstrike_aws_elb_azure_tenant` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS ELB Load Balancer | `crowdstrike_aws_elb_load_balancer` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Event Bridge Event Bus | `crowdstrike_aws_eventbridge_event_bus` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| AWS IAM Account | `crowdstrike_aws_iam_account` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS IAM Group | `crowdstrike_aws_iam_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| AWS IAM Policy | `crowdstrike_aws_iam_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| AWS IAM Role | `crowdstrike_aws_iam_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| AWS IAM S3 Policy | `crowdstrike_aws_iam_s3_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| AWS IAM User | `crowdstrike_aws_iam_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| AWS Kinesis Stream | `crowdstrike_aws_kinesis_stream` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS KMS Key | `crowdstrike_aws_kms_key` | [CryptoKey](https://docs.jupiterone.io/data-model/schemas/CryptoKey), [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| AWS Lambda Disk | `crowdstrike_aws_lambda_disk` | [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| AWS Lambda Function | `crowdstrike_aws_lambda_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| AWS NLB/ALB Load Balancer | `crowdstrike_aws_nlb_alb_load_balancer` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS RDS Database | `crowdstrike_aws_rds_database` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| AWS Route 53 Domain | `crowdstrike_aws_route53_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| AWS S3 Bucket | `crowdstrike_aws_s3_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS SageMaker Workbench Instance | `crowdstrike_aws_sagemaker_notebook_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS Secrets Manager Secret | `crowdstrike_aws_secrets_manager_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| AWS SES | `crowdstrike_aws_ses` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS SNS Topic | `crowdstrike_aws_sns_topic` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| AWS SQS Queue | `crowdstrike_aws_sqs_queue` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| AWS SSM Parameter | `crowdstrike_aws_ssm_parameter` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS VPC | `crowdstrike_aws_vpc` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS VPC Bucket | `crowdstrike_aws_vpc_bucket` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS VPC Endpoint | `crowdstrike_aws_vpc_endpoint` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS VPC Route Table | `crowdstrike_aws_vpc_route_table` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS VPC Subnet | `crowdstrike_aws_vpc_subnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS WAF VPC Endpoint | `crowdstrike_aws_waf_vpc_endpoint` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Azure AD Domain Service | `crowdstrike_azure_ad_domain_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Azure App Service | `crowdstrike_azure_app_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Azure App Service | `crowdstrike_azure_web_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Azure CDN Profile | `crowdstrike_azure_cdn_profile` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Azure Container Apps | `crowdstrike_azure_container_app` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Azure Cosmos DB | `crowdstrike_azure_cosmosdb_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account), [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Azure Event Hub | `crowdstrike_azure_event_hub` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Azure Firewall | `crowdstrike_azure_firewall` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Azure Key Vault | `crowdstrike_azure_key_vault` | KeyStore |
| Azure Kubernetes Cluster | `crowdstrike_azure_kubernetes_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Azure Managed Disk | `crowdstrike_azure_managed_disk` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| Azure MySQL Server | `crowdstrike_azure_mysql_server` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Azure Security Group | `crowdstrike_azure_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Azure Storage Account | `crowdstrike_azure_storage_account` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Azure Subscription | `crowdstrike_azure_subscription` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Azure Virtual Machine | `crowdstrike_azure_vm` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Azure Virtual Network | `crowdstrike_azure_vnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Cloud Account | `crowdstrike_cloud_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cloud Entity | `crowdstrike_cloud_entity` | [Entity](https://docs.jupiterone.io/data-model/schemas/Entity) |
| Compliance Control | `crowdstrike_compliance_control` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Container Image | `crowdstrike_container_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Device | `crowdstrike_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Device Control Policy | `crowdstrike_device_control_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Device Sensor Agent | `crowdstrike_sensor` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Discover Application | `crowdstrike_discover_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| EASM Finding | `crowdstrike_easm_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| External Asset | `crowdstrike_external_asset` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Falcon Shield Alert | `crowdstrike_falcon_shield_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Falcon Shield App | `crowdstrike_falcon_shield_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Falcon Shield Integration | `crowdstrike_falcon_shield_integration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Firewall Policy | `crowdstrike_firewall_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Image Vulnerability | `crowdstrike_image_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Image Vulnerability | `crowdstrike_image_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| IOM Finding | `crowdstrike_iom_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| IOM Rule | `crowdstrike_iom_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Prevention Policy | `crowdstrike_prevention_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Prevention Policy Setting | `crowdstrike_prevention_policy_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Remediation | `crowdstrike_remediation` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Serverless Vulnerability | `crowdstrike_serverless_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Service | `crowdstrike_endpoint_protection` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `crowdstrike_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vulnerability | `crowdstrike_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Vulnerability | `crowdstrike_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Zero Trust Assessment | `crowdstrike_zero_trust_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `crowdstrike_account` | **HAS** | `crowdstrike_endpoint_protection` |
| `crowdstrike_account` | **HAS** | `crowdstrike_sensor` |
| `crowdstrike_account` | **HAS** | `crowdstrike_container_image` |
| `crowdstrike_account` | **HAS** | `crowdstrike_user` |
| `crowdstrike_account` | **HAS** | `crowdstrike_remediation` |
| `crowdstrike_account` | **HAS** | `crowdstrike_cloud_account` |
| `crowdstrike_account` | **HAS** | `crowdstrike_external_asset` |
| `crowdstrike_account` | **HAS** | `crowdstrike_serverless_vulnerability` |
| `crowdstrike_account` | **HAS** | `crowdstrike_falcon_shield_integration` |
| `crowdstrike_cloud_account` | **HAS** | `crowdstrike_compliance_control` |
| `crowdstrike_cloud_account` | **HAS** | `crowdstrike_cloud_entity` |
| `crowdstrike_cloud_entity` | **HAS** | `crowdstrike_iom_finding` |
| `crowdstrike_compliance_control` | **HAS** | `crowdstrike_iom_rule` |
| `crowdstrike_container_image` | **EXPLOITS** | `crowdstrike_vulnerability` |
| `crowdstrike_detected_application` | **HAS** | `crowdstrike_vulnerability` |
| `crowdstrike_external_asset` | **HAS** | `crowdstrike_easm_finding` |
| `crowdstrike_falcon_shield_integration` | **HAS** | `crowdstrike_falcon_shield_app` |
| `crowdstrike_falcon_shield_integration` | **HAS** | `crowdstrike_falcon_shield_alert` |
| `crowdstrike_host` | **HAS** | `crowdstrike_vulnerability` |
| `crowdstrike_host` | **USES** | `crowdstrike_container_image` |
| `crowdstrike_iom_rule` | **IDENTIFIED** | `crowdstrike_iom_finding` |
| `crowdstrike_prevention_policy` | **ENFORCES** | `crowdstrike_endpoint_protection` |
| `crowdstrike_prevention_policy` | **HAS** | `crowdstrike_prevention_policy_setting` |
| `crowdstrike_sensor` | **PROTECTS** | `crowdstrike_host` |
| `crowdstrike_sensor` | **ASSIGNED** | `crowdstrike_prevention_policy` |
| `crowdstrike_sensor` | **IDENTIFIED** | `crowdstrike_vulnerability` |
| `crowdstrike_sensor` | **HAS** | `crowdstrike_zero_trust_assessment` |
| `crowdstrike_sensor` | **ASSIGNED** | `crowdstrike_device_control_policy` |
| `crowdstrike_sensor` | **ASSIGNED** | `crowdstrike_firewall_policy` |
| `crowdstrike_sensor` | **INSTALLED** | `crowdstrike_discover_application` |
| `crowdstrike_sensor` | **HAS** | `crowdstrike_alert` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `crowdstrike_sensor` | **ASSIGNED** | `crowdstrike_device_control_policy` | FORWARD |
| `crowdstrike_sensor` | **ASSIGNED** | `crowdstrike_firewall_policy` | FORWARD |
| `crowdstrike_serverless_vulnerability` | **HAS** | `aws_lambda_function` | REVERSE |
| `crowdstrike_serverless_vulnerability` | **HAS** | `google_cloud_function` | REVERSE |
| `crowdstrike_serverless_vulnerability` | **HAS** | `azure_function_app` | REVERSE |
| `crowdstrike_vulnerability` | **IS** | `cve` | FORWARD |

### Crowdstrike Account

`crowdstrike_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cid` | `string` |  |  |

---

### Crowdstrike Alert

`crowdstrike_alert` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aggregateId` | `string` |  |  |
| `childProcessIds` | `array` of `string`s |  |  |
| `cid` | `string` |  |  |
| `cmdline` | `string` |  |  |
| `compositeId` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `dataDomains` | `array` of `string`s |  |  |
| `description` | `string` |  |  |
| `detectedOn` | `number` |  |  |
| `deviceExternalIp` | `string` |  |  |
| `deviceHostname` | `string` |  |  |
| `deviceId` | `string` |  |  |
| `deviceLocalIp` | `string` |  |  |
| `deviceMacAddress` | `string` |  |  |
| `deviceOsVersion` | `string` |  |  |
| `devicePlatformName` | `string` |  |  |
| `deviceStatus` | `string` |  |  |
| `falconHostLink` | `string` |  |  |
| `filename` | `string` |  |  |
| `filepath` | `string` |  |  |
| `filesAccessed` | `array` of `string`s |  |  |
| `id` | `string` |  |  |
| `mitreAttack` | `array` of `string`s |  |  |
| `objective` | `string` |  |  |
| `parentCmdline` | `string` |  |  |
| `parentFilename` | `string` |  |  |
| `product` | `string` |  |  |
| `scenario` | `string` |  |  |
| `severityName` | `string` |  |  |
| `sourceProducts` | `array` of `string`s |  |  |
| `sourceVendors` | `array` of `string`s |  |  |
| `status` | `string` |  |  |
| `tactic` | `string` |  |  |
| `tacticId` | `string` |  |  |
| `technique` | `string` |  |  |
| `techniqueId` | `string` |  |  |
| `updatedOn` | `number` |  |  |
| `userId` | `string` |  |  |
| `userName` | `string` |  |  |
| `userPrincipal` | `string` |  |  |

---

### Crowdstrike Cloud Account

`crowdstrike_cloud_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountAlias` \*

 | `string` **|** `null` |  |  |
| 

`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`accountType` \*

 | `string` **|** `null` |  |  |
| 

`availableRegions` \*

 | `array` **|** `null` |  |  |
| 

`azureTenantId` \*

 | `string` **|** `null` |  |  |
| 

`cid` \*

 | `string` **|** `null` |  |  |
| 

`cloudformationUpdateUrl` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`cloudtrailBucketName` \*

 | `string` **|** `null` |  |  |
| 

`cloudtrailRegion` \*

 | `string` **|** `null` |  |  |
| 

`dsprmRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`enabledServices` \*

 | `array` **|** `null` |  |  |
| 

`endedOn` \*

 | `number` **|** `null` |  |  |
| 

`eventbusArn` \*

 | `string` **|** `null` |  |  |
| 

`eventbusName` \*

 | `string` **|** `null` |  |  |
| 

`externalId` \*

 | `string` **|** `null` |  |  |
| 

`falconClientId` \*

 | `string` **|** `null` |  |  |
| 

`healthyConditionsCount` \*

 | `number` **|** `null` |  |  |
| 

`iamRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`intermediateRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isBehaviorAssessmentEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCloudRegistration` \*

 | `boolean` **|** `null` |  |  |
| 

`isCSPMEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCSPMLite` \*

 | `boolean` **|** `null` |  |  |
| 

`isCustomRolename` \*

 | `boolean` **|** `null` |  |  |
| 

`isD4CMigrated` \*

 | `boolean` **|** `null` |  |  |
| 

`isDSPMEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isManaged` \*

 | `boolean` **|** `null` |  |  |
| 

`isMaster` \*

 | `boolean` **|** `null` |  |  |
| 

`isSensorManagementEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isUsingExistingCloudtrail` \*

 | `boolean` **|** `null` |  |  |
| 

`isValid` \*

 | `boolean` **|** `null` |  |  |
| 

`lastScanOn` \*

 | `number` **|** `null` |  |  |
| 

`onboardedOn` \*

 | `number` **|** `null` |  |  |
| 

`operationalServicesCount` \*

 | `number` **|** `null` |  |  |
| 

`organizationId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`remediationCloudformationUrl` \*

 | `string` **|** `null` |  |  |
| 

`s3Url` \*

 | `string` **|** `null` |  |  |
| 

`startedOn` \*

 | `number` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`totalConditionsCount` \*

 | `number` **|** `null` |  |  |
| 

`totalServicesCount` \*

 | `number` **|** `null` |  |  |
| 

`vendor` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Compliance Control

`crowdstrike_compliance_control` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`assessmentId` \*

 | `string` |  |  |
| 

`benchmarkId` \*

 | `string` **|** `null` |  |  |
| 

`benchmarkName` \*

 | `string` **|** `null` |  |  |
| 

`benchmarkVersion` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`compliantResources` \*

 | `number` **|** `null` |  |  |
| 

`controlFramework` \*

 | `string` **|** `null` |  |  |
| 

`controlName` \*

 | `string` **|** `null` |  |  |
| 

`controlType` \*

 | `string` **|** `null` |  |  |
| 

`controlVersion` \*

 | `string` **|** `null` |  |  |
| 

`criticalNonCompliant` \*

 | `number` **|** `null` |  |  |
| 

`highNonCompliant` \*

 | `number` **|** `null` |  |  |
| 

`informationalNonCompliant` \*

 | `number` **|** `null` |  |  |
| 

`lastEvaluatedOn` \*

 | `number` **|** `null` |  |  |
| 

`mediumNonCompliant` \*

 | `number` **|** `null` |  |  |
| 

`nonCompliantResources` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resourceProvider` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`ruleIds` \*

 | `array` **|** `null` |  |  |
| 

`ruleNames` \*

 | `array` **|** `null` |  |  |
| 

`ruleOrigins` \*

 | `array` **|** `null` |  |  |
| 

`rulePolicyIds` \*

 | `array` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |
| 

`severities` \*

 | `array` **|** `null` |  |  |
| 

`totalResources` \*

 | `number` **|** `null` |  |  |

---

### Crowdstrike Container Image

`crowdstrike_container_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cid` | `string` |  |  |
| `digest` | `string` |  |  |
| `imageId` | `string` |  |  |
| `lastSeen` | `number` |  |  |
| `registry` | `string` |  |  |
| `repository` | `string` |  |  |
| `tag` | `string` |  |  |

---

### Crowdstrike Detected Application

`crowdstrike_detected_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `dataProvider` | `string` | Source that produced the detection, e.g. "Falcon sensor" or "Falcon EASM". |  |
| 
`evaluationLogicId` \*

 | `string` | ID of the Spotlight evaluation logic that matched the application on the host. |  |
| `installPath` | `string` | Filesystem path where the application was detected on the host, when available. |  |
| 

`open` \*

 | `boolean` | Whether the application still has an open vulnerability sub-status. |  |
| `productName` | `string` | Normalized product name without version (e.g. "Firefox"). |  |
| `remediationIds` | `array` of `string`s |  |  |
| `vendor` | `string` | Normalized vendor of the application (e.g. "Mozilla"). |  |
| `version` | `string` | Installed version of the application. For macOS software this is parsed from the Spotlight evaluation logic; for other platforms it is taken from the affected product name. |  |

---

### Crowdstrike Device Control Policy

`crowdstrike_device_control_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cid` \*

 | `string` |  |  |
| 

`createdBy` \*

 | `string` |  |  |
| 

`description` \*

 | `string` |  |  |
| 

`enabled` \*

 | `boolean` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`modifiedBy` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`platformName` \*

 | `string` |  |  |
| 

`settingsClasses` \*

 | `array` of `string`s |  |  |
| 

`settingsEndUserNotification` \*

 | `string` |  |  |
| 

`settingsEnforcementMode` \*

 | `string` |  |  |

---

### Crowdstrike Discover Application

`crowdstrike_discover_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `architectures` | `array` of `string`s |  |  |
| `category` | `string` |  |  |
| `firstSeenOn` | `number` |  |  |
| `installedOn` | `number` |  |  |
| `isNormalized` | `boolean` |  |  |
| `isSuspicious` | `boolean` |  |  |
| `lastUpdatedOn` | `number` |  |  |
| `lastUsedOn` | `number` |  |  |
| `vendor` | `string` |  |  |
| `version` | `string` |  |  |
| `versioningScheme` | `string` |  |  |

---

### Crowdstrike Easm Finding

`crowdstrike_easm_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`actors` \*

 | `array` **|** `null` |  |  |
| 

`aid` \*

 | `string` |  |  |
| 

`assetCriticality` \*

 | `string` **|** `null` |  |  |
| 

`baseScore` \*

 | `number` **|** `null` |  |  |
| 

`cid` \*

 | `string` |  |  |
| 

`cisaDueDate` \*

 | `string` **|** `null` |  |  |
| 

`closedOn` \*

 | `number` **|** `null` |  |  |
| 

`exploitabilityScore` \*

 | `number` **|** `null` |  |  |
| 

`exploitStatus` \*

 | `number` **|** `null` |  |  |
| 

`exprtRating` \*

 | `string` **|** `null` |  |  |
| 

`hostname` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`impactScore` \*

 | `number` **|** `null` |  |  |
| 

`instanceId` \*

 | `string` **|** `null` |  |  |
| 

`isCisaKev` \*

 | `boolean` **|** `null` |  |  |
| 

`isInternetExposed` \*

 | `boolean` **|** `null` |  |  |
| 

`isSuppressed` \*

 | `boolean` **|** `null` |  |  |
| 

`localIp` \*

 | `string` **|** `null` |  |  |
| 

`osVersion` \*

 | `string` **|** `null` |  |  |
| 

`platform` \*

 | `string` **|** `null` |  |  |
| 

`productName` \*

 | `string` **|** `null` |  |  |
| 

`productVersion` \*

 | `string` **|** `null` |  |  |
| 

`publishedOn` \*

 | `number` **|** `null` |  |  |
| 

`remediationLevel` \*

 | `string` **|** `null` |  |  |
| 

`servicePorts` \*

 | `array` **|** `null` |  |  |
| 

`serviceProvider` \*

 | `string` **|** `null` |  |  |
| 

`suppressionReason` \*

 | `string` **|** `null` |  |  |
| 

`vendor` \*

 | `string` **|** `null` |  |  |
| 

`vendorAdvisory` \*

 | `array` **|** `null` |  |  |
| 

`vulnerabilityId` \*

 | `string` |  |  |

---

### Crowdstrike Endpoint Protection

`crowdstrike_endpoint_protection` inherits from [Service](/data-model/schemas/Service.md)

---

### Crowdstrike External Asset

`crowdstrike_external_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicableActions` \*

 | `array` **|** `null` |  |  |
| 

`asn` \*

 | `number` **|** `null` |  |  |
| 

`assetType` \*

 | `string` |  |  |
| 

`awsRegion` \*

 | `string` **|** `null` |  |  |
| 

`cid` \*

 | `string` |  |  |
| 

`cloudProvider` \*

 | `string` **|** `null` |  |  |
| 

`confidence` \*

 | `number` **|** `null` |  |  |
| 

`countryCode` \*

 | `string` **|** `null` |  |  |
| 

`countryName` \*

 | `string` **|** `null` |  |  |
| 

`criticalityDescription` \*

 | `string` **|** `null` |  |  |
| 

`dataProviders` \*

 | `array` **|** `null` |  |  |
| 

`discoveredBy` \*

 | `string` **|** `null` |  |  |
| 

`dnsType` \*

 | `string` **|** `null` |  |  |
| 

`domainName` \*

 | `string` **|** `null` |  |  |
| 

`entityType` \*

 | `string` **|** `null` |  |  |
| 

`firstSeenOn` \*

 | `number` **|** `null` |  |  |
| 

`fqdn` \*

 | `string` **|** `null` |  |  |
| 

`hostingProviders` \*

 | `array` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`ipAddress` \*

 | `string` **|** `null` |  |  |
| 

`isAwsHosted` \*

 | `boolean` **|** `null` |  |  |
| 

`isAzureHosted` \*

 | `boolean` **|** `null` |  |  |
| 

`isGcpHosted` \*

 | `boolean` **|** `null` |  |  |
| 

`isInternetExposed` \*

 | `boolean` **|** `null` |  |  |
| 

`isp` \*

 | `string` **|** `null` |  |  |
| 

`isps` \*

 | `array` **|** `null` |  |  |
| 

`lastSeenOn` \*

 | `number` **|** `null` |  |  |
| 

`manual` \*

 | `boolean` **|** `null` |  |  |
| 

`parentDomain` \*

 | `string` **|** `null` |  |  |
| 

`perimeter` \*

 | `string` **|** `null` |  |  |
| 

`ptr` \*

 | `string` **|** `null` |  |  |
| 

`resolvedIps` \*

 | `array` **|** `null` |  |  |
| 

`serviceCount` \*

 | `number` **|** `null` |  |  |
| 

`servicePorts` \*

 | `array` **|** `null` |  |  |
| 

`serviceProtocols` \*

 | `array` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`subsidiaryIds` \*

 | `array` **|** `null` |  |  |
| 

`subsidiaryNames` \*

 | `array` **|** `null` |  |  |
| 

`timezone` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Falcon Shield Alert

`crowdstrike_falcon_shield_alert` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| `alertSource` | `string` |  |  |
| `alertType` | `string` |  |  |
| `detectedOn` | `number` |  |  |
| `integrationId` | `string` |  |  |
| `integrationName` | `string` |  |  |
| `isArchived` | `boolean` |  |  |
| `newAffectedCount` | `number` |  |  |
| `securityCheckApiLink` | `string` |  |  |
| `sourceId` | `string` |  |  |
| `threatApiLink` | `string` |  |  |

---

### Crowdstrike Falcon Shield App

`crowdstrike_falcon_shield_app` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessLevel` | `string` |  |  |
| `accountId` | `string` |  |  |
| `appDisplayName` | `string` |  |  |
| `appId` | `string` |  |  |
| `appStatus` | `string` |  |  |
| `appStatusReason` | `string` |  |  |
| `appType` | `string` |  |  |
| `clientId` | `string` |  |  |
| `integrationAlias` | `string` |  |  |
| `integrationId` | `string` |  |  |
| `integrationName` | `string` |  |  |
| `lastActivityOn` | `number` |  |  |
| `scopes` | `array` of `string`s |  |  |

---

### Crowdstrike Falcon Shield Integration

`crowdstrike_falcon_shield_integration` inherits from [Configuration](/data-model/schemas/Configuration.md), [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| `alias` | `string` |  |  |
| `enabled` | `boolean` |  |  |
| `integrationStatus` | `string` |  |  |
| `lastRunOn` | `number` |  |  |
| `saasId` | `string` |  |  |
| `saasName` | `string` |  |  |

---

### Crowdstrike Firewall Policy

`crowdstrike_firewall_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`channelVersion` \*

 | `number` |  |  |
| 

`cid` \*

 | `string` |  |  |
| 

`createdBy` \*

 | `string` |  |  |
| 

`description` \*

 | `string` |  |  |
| 

`enabled` \*

 | `boolean` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`modifiedBy` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`platformName` \*

 | `string` |  |  |
| 

`ruleSetId` \*

 | `string` |  |  |

---

### Crowdstrike Host

`crowdstrike_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentVersion` | `string` |  |  |
| 
`appliedPolicyCount` \*

 | `number` **|** `null` |  |  |
| 

`biosManufacturer` \*

 | `string` **|** `null` |  |  |
| 

`biosVersion` \*

 | `string` **|** `null` |  |  |
| `chassisTypeDescription` | `string` |  |  |
| 

`cid` \*

 | `string` |  |  |
| 

`cloudProvider` \*

 | `string` **|** `null` | Canonical, lowercased cloud provider ('aws', 'azure', 'gcp', 'oci') derived from the raw serviceProvider so it matches the cloudProvider on CrowdStrike findings/CSPM entities. Null for non-cloud devices. |  |
| 

`defaultGatewayIp` \*

 | `string` **|** `null` |  |  |
| 

`deploymentType` \*

 | `string` **|** `null` |  |  |
| `ec2InstanceArn` | `string` |  |  |
| 

`emails` \*

 | `array` **|** `null` | Email addresses associated with the host. email and associated\_email\_addresses are referenced. |  |
| 

`externalIp` \*

 | `string` **|** `null` |  |  |
| `filesystemContainmentStatus` | `string` |  |  |
| `firstSeenOn` | `number` |  |  |
| `groupHash` | `string` |  |  |
| 

`groupIds` \*

 | `array` **|** `null` |  |  |
| 

`instanceId` \*

 | `string` **|** `null` | CrowdStrike's ID of the cloud VM. Per provider: AWS EC2 id (`i-...`), Azure VM `vmId` GUID, GCP numeric instance id, or OCI OCID. |  |
| 

`isContentUpdatePolicyApplied` \*

 | `boolean` **|** `null` |  |  |
| 

`isExposureManagementPolicyApplied` \*

 | `boolean` **|** `null` |  |  |
| 

`isGlobalConfigPolicyApplied` \*

 | `boolean` **|** `null` |  |  |
| 

`isHostRetentionPolicyApplied` \*

 | `boolean` **|** `null` |  |  |
| 

`isPreventionPolicyApplied` \*

 | `boolean` **|** `null` |  |  |
| 

`isReducedFunctionalityMode` \*

 | `boolean` **|** `null` |  |  |
| 

`isRemoteResponsePolicyApplied` \*

 | `boolean` **|** `null` |  |  |
| 

`isScaPolicyApplied` \*

 | `boolean` **|** `null` |  |  |
| 

`isSensorUpdatePolicyApplied` \*

 | `boolean` **|** `null` |  |  |
| `kernelVersion` | `string` |  |  |
| `lastLoginUser` | `string` |  |  |
| `lastLoginUserSid` | `string` |  |  |
| 

`linuxSensorMode` \*

 | `string` **|** `null` |  |  |
| 

`majorVersion` \*

 | `string` **|** `null` |  |  |
| 

`minorVersion` \*

 | `string` **|** `null` |  |  |
| `osKernel` | `string` |  |  |
| `ou` | `array` of `string`s |  |  |
| 

`platformId` \*

 | `string` **|** `null` |  |  |
| 

`podAnnotations` \*

 | `array` **|** `null` |  |  |
| 

`podLabels` \*

 | `array` **|** `null` |  |  |
| 

`policyIds` \*

 | `array` **|** `null` |  |  |
| 

`policyTypes` \*

 | `array` **|** `null` |  |  |
| `provisionStatus` | `string` |  |  |
| 

`serviceProvider` \*

 | `string` **|** `null` | Raw CrowdStrike service provider of the asset, e.g. 'AWS\_EC2\_V2' or 'AZURE'. Use `cloudProvider` for the normalized value. |  |
| 

`serviceProviderAccountId` \*

 | `string` **|** `null` |  |  |
| 

`zoneGroup` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Image Vulnerability

`crowdstrike_image_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cpsCurrentRating` | `string` |  |  |
| `cvssScore` | `number` |  |  |
| `exploitedStatus` | `number` |  |  |
| `remediationAvailable` | `boolean` |  |  |

---

### Crowdstrike Image Vulnerability

`crowdstrike_image_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cpsCurrentRating` | `string` |  |  |
| `cvssScore` | `number` |  |  |
| `exploitedStatus` | `number` |  |  |
| `remediationAvailable` | `boolean` |  |  |

---

### Crowdstrike Iom Finding

`crowdstrike_iom_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`azureTenantId` \*

 | `string` **|** `null` |  |  |
| 

`cid` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`numericSeverity` \*

 | `number` **|** `null` |  |  |
| 

`policyId` \*

 | `number` |  |  |
| 

`policyStatement` \*

 | `string` |  |  |
| 

`policyType` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`reportedOn` \*

 | `number` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`resourceUuid` \*

 | `string` **|** `null` |  |  |
| 

`scannedOn` \*

 | `number` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |
| 

`severity` \*

 | `string` |  |  |
| 

`status` \*

 | `string` |  |  |

---

### Crowdstrike Iom Rule

`crowdstrike_iom_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountScope` \*

 | `string` **|** `null` |  |  |
| 

`attackTypes` \*

 | `array` **|** `null` |  |  |
| 

`cid` \*

 | `string` **|** `null` |  |  |
| 

`cloudAssetType` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` **|** `null` |  |  |
| 

`cloudService` \*

 | `string` **|** `null` |  |  |
| 

`cloudServiceFriendly` \*

 | `string` **|** `null` |  |  |
| 

`cloudServiceSubtype` \*

 | `string` **|** `null` |  |  |
| 

`defaultSeverity` \*

 | `string` **|** `null` |  |  |
| 

`fqlPolicy` \*

 | `string` **|** `null` |  |  |
| 

`isGlobal` \*

 | `boolean` **|** `null` |  |  |
| 

`isRemediable` \*

 | `boolean` **|** `null` |  |  |
| 

`policyId` \*

 | `number` |  |  |
| 

`policyTimestampOn` \*

 | `number` **|** `null` |  |  |
| 

`policyType` \*

 | `string` **|** `null` |  |  |
| 

`remediationSummary` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Prevention Policy

`crowdstrike_prevention_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cid` \*

 | `string` |  |  |

---

### Crowdstrike Prevention Policy Setting

`crowdstrike_prevention_policy_setting` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`categoryName` \*

 | `string` |  |  |
| `configured` | `boolean` |  |  |
| 

`description` \*

 | `string` |  |  |
| `enabled` | `boolean` |  |  |
| 

`type` \*

 | `string` |  |  |

---

### Crowdstrike Remediation

`crowdstrike_remediation` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `string` **|** `null` |  |  |
| 

`link` \*

 | `string` **|** `null` |  |  |
| 

`patchPublishedOn` \*

 | `number` **|** `null` |  |  |
| 

`recommendationType` \*

 | `string` **|** `null` |  |  |
| 

`reference` \*

 | `string` **|** `null` |  |  |
| 

`vendorUrl` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Sensor

`crowdstrike_sensor` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cloudProvider` \*

 | `string` **|** `null` | Canonical, lowercased cloud provider ('aws', 'azure', 'gcp', 'oci') derived from the raw serviceProvider so it matches the cloudProvider on CrowdStrike findings/CSPM entities. Null for non-cloud devices. |  |
| `ec2InstanceArn` | `string` |  |  |
| `firstSeenOn` | `number` |  |  |
| `macAddress` | `string` | A normalized MAC address for the device's network interface |  |
| 

`originalMacAddress` \*

 |  | The original MAC address for the device's network interface |  |

---

### Crowdstrike Serverless Vulnerability

`crowdstrike_serverless_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`exploitStatus` \*

 | `string` **|** `null` |  |  |
| 

`exprtRating` \*

 | `string` **|** `null` |  |  |
| 

`exprtRatingHighest` \*

 | `string` **|** `null` |  |  |
| 

`firstSeenOn` \*

 | `number` **|** `null` |  |  |
| 

`remediations` \*

 | `array` **|** `null` |  |  |
| 

`runtime` \*

 | `string` **|** `null` |  |  |
| 

`scannerVersion` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike User

`crowdstrike_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cid` | `string` |  |  |
| `lastLoginOn` | `number` |  |  |
| `uid` | `string` |  |  |

---

### Crowdstrike Vulnerability

`crowdstrike_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aid` | `string` |  |  |
| 
`cid` \*

 | `string` |  |  |
| `closedOn` | `number` |  |  |
| 

`confidenceLabel` \*

 | `string` **|** `null` | CrowdStrike's confidence that the detection is a true positive (e.g. 'Low', 'Medium', 'High'). The Spotlight console hides 'Low' by default; filter on this to reconcile J1 counts with the dashboard. |  |
| `exploitStatus` | `number` |  |  |
| `exprtRating` | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isSuppressed` \*

 | `boolean` **|** `null` | Whether the detection is hidden by a Spotlight suppression rule. Suppressed detections are excluded from the console by default. |  |
| `productNameVersion` | `string` |  |  |
| `publishedOn` | `number` |  |  |
| `remediationIds` | `array` of `string`s |  |  |
| 

`suppressionReason` \*

 | `string` **|** `null` | Reason the detection was suppressed, when suppressed. |  |
| `vendorAdvisory` | `array` of `string`s |  |  |

---

### Crowdstrike Vulnerability

`crowdstrike_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aid` | `string` |  |  |
| 
`cid` \*

 | `string` |  |  |
| `closedOn` | `number` |  |  |
| 

`confidenceLabel` \*

 | `string` **|** `null` | CrowdStrike's confidence that the detection is a true positive (e.g. 'Low', 'Medium', 'High'). The Spotlight console hides 'Low' by default; filter on this to reconcile J1 counts with the dashboard. |  |
| `exploitStatus` | `number` |  |  |
| `exprtRating` | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isSuppressed` \*

 | `boolean` **|** `null` | Whether the detection is hidden by a Spotlight suppression rule. Suppressed detections are excluded from the console by default. |  |
| `productNameVersion` | `string` |  |  |
| `publishedOn` | `number` |  |  |
| `remediationIds` | `array` of `string`s |  |  |
| 

`suppressionReason` \*

 | `string` **|** `null` | Reason the detection was suppressed, when suppressed. |  |
| `vendorAdvisory` | `array` of `string`s |  |  |

---

### Crowdstrike Zero Trust Assessment

`crowdstrike_zero_trust_assessment` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aid` | `string` |  |  |
| 
`cid` \*

 | `string` |  |  |
| 

`eventPlatform` \*

 | `string` |  |  |
| 

`metOsSignals` \*

 | `array` of `string`s |  |  |
| 

`metSensorSignals` \*

 | `array` of `string`s |  |  |
| 

`osScore` \*

 | `number` |  |  |
| 

`overallScore` \*

 | `number` |  |  |
| 

`productTypeDescription` \*

 | `string` |  |  |
| 

`sensorConfigScore` \*

 | `number` |  |  |
| 

`sensorFileStatus` \*

 | `string` |  |  |
| 

`systemSerialNumber` \*

 | `string` |  |  |
| 

`unmetOsSignals` \*

 | `array` of `string`s |  |  |
| 

`unmetSensorSignals` \*

 | `array` of `string`s |  |  |
| 

`version` \*

 | `string` |  |  |

---

## Release Notes

-   **2026-07-14** — Vulnerability findings now include a confidence label and suppression status, indicating whether a detection is a confirmed true positive and whether it is hidden in the Spotlight console.
-   **2026-03-31** — Promoted OS kernel version property to CrowdStrike host entities, exposing the operating system kernel version.
-   **2026-02-20** — Added container image vulnerability assessments via the Image Assessments API, available behind a configuration flag.
-   **2026-01-06** — Added CrowdStrike External Attack Surface Management (EASM) vulnerabilities ingestion as new findable entity types.
-   **2025-12-10** — Added filtering of CrowdStrike compliance controls by severity.
-   **2025-11-05** — Added remediation actions property to CrowdStrike vulnerability entities.
-   **2025-10-08** — Added CrowdStrike container vulnerability ingestion, relating containers to their image vulnerabilities.
-   **2025-10-03** — Added CrowdStrike Alerts ingestion as alert entities.
-   **2025-09-30** — Added Device Unification support for CrowdStrike CSPM resources.
-   **2025-09-10** — Added CrowdStrike Azure CSPM ingestion, covering Azure resource findings alongside existing AWS coverage.
-   **2025-08-27** — Added host to container image relationships linking CrowdStrike hosts to their running container images.
-   **2025-08-22** — Added CrowdStrike compliance controls ingestion as compliance finding entities with policy framework relationships.
-   **2025-08-12** — Added CrowdStrike CSPM Phase 2, expanding cloud security posture findings coverage with additional ARN types.
-   **2025-08-08** — Added CrowdStrike CSPM Phase 1, ingesting cloud security posture management findings for AWS resources.
-   **2025-07-08** — Added image digest property to CrowdStrike container image entities for content-addressable image identification.
-   **2025-06-16** — Added CrowdStrike application ingestion using the combined apps endpoint with configurable date filtering.
-   **2025-06-02** — Added device remediation actions as device remediation entities.
-   **2025-04-22** — Added CrowdStrike Users and device-user relationships ingestion.
-   **2025-04-10** — Added CrowdStrike Firewall Policy and Device Control Policy ingestion.

---

Source: /integrations/directory/crowdstrike-fcs

# CrowdStrike Falcon Cloud Security

Visualize your cloud security posture across AWS, Azure, and GCP with CrowdStrike Falcon Cloud Security. Ingest cloud accounts and resources, map Indicators of Misconfiguration (IOM) findings to the rules that detect them, and monitor compliance controls through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create an API client ID and an API client secret in CrowdStrike. See [their documentation](https://www.crowdstrike.com/blog/tech-center/get-access-falcon-apis/) for more information.

CrowdStrike Falcon Cloud Security ingests cloud security posture data. When creating the API client ID and API client secret, grant read access to the following API Scopes:

-   CSPM registration (`cspm-registration:read`)
-   Cloud security assets (`cloud-security-assets:read`)

🎯 2. Data Filtering Options

These options control which findings and controls are ingested. Leave defaults for a focused, high-signal first run.

| Field | Type | Description | Default |
| --- | --- | --- | --- |
| **CSPM Cloud Providers** | MultiSelect | Cloud providers to monitor for CSPM findings. | AWS, Azure |
| **IOM Severity Filter** | MultiSelect | Severity levels to include for Indicator of Misconfiguration (IOM) findings. | Critical |
| **Compliance Control Severities** | MultiSelect | Severity levels to include for compliance controls. | Critical, High |

To install the CrowdStrike Falcon Cloud Security integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select CrowdStrike Falcon Cloud Security. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the CrowdStrike account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your CrowdStrike **API client ID** and **API client secret** to authenticate with the CrowdStrike Falcon API.
    
-   Enter the **Availability Zone** you'd like to use for API calls. Leave blank to use the main API endpoint. For example, entering `us-2` as the availability zone will result in the use of a CrowdStrike API endpoint of `api.us-2.crowdstrike.com`.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (4)

-   `cloud-google-cloud-registration:read`
-   `cloud-security-assets:read`
-   `cloud-security-detections:read`
-   `cspm-registration:read`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (9)

-   `/cloud-connect-cspm-aws/entities/account/v1`
-   `/cloud-connect-cspm-azure/entities/account/v1`
-   `/cloud-security-assets/combined/compliance-controls/by-account-region-and-resource-type/v1`
-   `/cloud-security-assets/entities/resources/v1`
-   `/cloud-security-assets/queries/resources/v1`
-   `/cloud-security-evaluations/entities/ioms/v1`
-   `/cloud-security-evaluations/queries/ioms/v1`
-   `/cloud-security-registration-google-cloud/entities/accounts/v1`
-   `/settings/entities/policy/v1`

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | OAuth Scopes | Endpoints |
| --- | --- | --- |
| Compliance Controls | `cloud-security-assets:read` | `/cloud-security-assets/combined/compliance-controls/by-account-region-and-resource-type/v1` |
| Fetch Cloud Entities | `cloud-security-assets:read` | `/cloud-security-assets/queries/resources/v1`, `/cloud-security-assets/entities/resources/v1` |
| IOM Findings | `cloud-security-detections:read` | `/cloud-security-evaluations/queries/ioms/v1`, `/cloud-security-evaluations/entities/ioms/v1` |
| IOM Rules | `cspm-registration:read` | `/settings/entities/policy/v1` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `crowdstrike_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cloud Account | `crowdstrike_cloud_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cloud Entity | `crowdstrike_cloud_entity` | [Entity](https://docs.jupiterone.io/data-model/schemas/Entity) |
| Cloud Entity | `crowdstrike_aws_iam_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Cloud Entity | `crowdstrike_aws_iam_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Cloud Entity | `crowdstrike_aws_iam_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Cloud Entity | `crowdstrike_aws_iam_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Cloud Entity | `crowdstrike_aws_ec2_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Cloud Entity | `crowdstrike_aws_ec2_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Cloud Entity | `crowdstrike_aws_ec2_network_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Cloud Entity | `crowdstrike_aws_vpc` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Cloud Entity | `crowdstrike_aws_vpc_subnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Cloud Entity | `crowdstrike_aws_vpc_route_table` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Entity | `crowdstrike_aws_vpc_endpoint` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Cloud Entity | `crowdstrike_aws_ebs_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Cloud Entity | `crowdstrike_aws_ebs_snapshot` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Cloud Entity | `crowdstrike_aws_s3_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Cloud Entity | `crowdstrike_aws_dynamodb_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Cloud Entity | `crowdstrike_aws_rds_database` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Cloud Entity | `crowdstrike_aws_efs_file_system` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Cloud Entity | `crowdstrike_aws_elasticache_cluster` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Cloud Entity | `crowdstrike_aws_kinesis_stream` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Cloud Entity | `crowdstrike_aws_ecr_repository` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Cloud Entity | `crowdstrike_aws_eks_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Cloud Entity | `crowdstrike_aws_ecs_task_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Entity | `crowdstrike_aws_lambda_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| Cloud Entity | `crowdstrike_aws_sns_topic` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| Cloud Entity | `crowdstrike_aws_sqs_queue` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| Cloud Entity | `crowdstrike_aws_kms_key` | [CryptoKey](https://docs.jupiterone.io/data-model/schemas/CryptoKey), [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| Cloud Entity | `crowdstrike_aws_secrets_manager_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Cloud Entity | `crowdstrike_aws_ssm_parameter` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Entity | `crowdstrike_aws_route53_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| Cloud Entity | `crowdstrike_aws_api_gateway_rest_api` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_aws_cloudformation_stack` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Entity | `crowdstrike_aws_cloudtrail` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_aws_athena_work_group` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_aws_cognito_user_pool` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_aws_sagemaker_notebook_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Cloud Entity | `crowdstrike_azure_vm` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Cloud Entity | `crowdstrike_azure_managed_disk` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| Cloud Entity | `crowdstrike_azure_storage_account` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_azure_vnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Cloud Entity | `crowdstrike_azure_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Cloud Entity | `crowdstrike_azure_firewall` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Cloud Entity | `crowdstrike_azure_key_vault` | KeyStore |
| Cloud Entity | `crowdstrike_azure_kubernetes_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Cloud Entity | `crowdstrike_azure_cosmosdb_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account), [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_azure_container_app` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_azure_web_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Cloud Entity | `crowdstrike_azure_cdn_profile` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_azure_event_hub` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_azure_subscription` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cloud Entity | `crowdstrike_azure_mysql_server` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Cloud Entity | `crowdstrike_azure_ad_domain_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_azure_role_definition` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Cloud Entity | `crowdstrike_azure_role_assignment` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Cloud Entity | `crowdstrike_azure_deny_assignment` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Cloud Entity | `crowdstrike_azure_policy_definition` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Cloud Entity | `crowdstrike_azure_policy_assignment` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Cloud Entity | `crowdstrike_azure_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Cloud Entity | `crowdstrike_azure_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Cloud Entity | `crowdstrike_azure_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Cloud Entity | `crowdstrike_azure_service_principal` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Cloud Entity | `crowdstrike_azure_directory_role_definition` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Cloud Entity | `crowdstrike_gcp_compute_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Cloud Entity | `crowdstrike_gcp_storage_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Cloud Entity | `crowdstrike_gcp_iam_service_account` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Cloud Entity | `crowdstrike_gcp_iam_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Cloud Entity | `crowdstrike_gcp_iam_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Cloud Entity | `crowdstrike_gcp_bigquery_dataset` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Cloud Entity | `crowdstrike_gcp_bigquery_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Cloud Entity | `crowdstrike_gcp_kubernetes_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Cloud Entity | `crowdstrike_gcp_kms_key` | [CryptoKey](https://docs.jupiterone.io/data-model/schemas/CryptoKey), [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| Cloud Entity | `crowdstrike_gcp_sql_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Cloud Entity | `crowdstrike_gcp_cloud_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| Cloud Entity | `crowdstrike_gcp_cloud_run_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_gcp_compute_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Cloud Entity | `crowdstrike_gcp_compute_subnetwork` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Cloud Entity | `crowdstrike_gcp_compute_firewall` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Cloud Entity | `crowdstrike_gcp_compute_route` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Entity | `crowdstrike_gcp_compute_disk` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| Cloud Entity | `crowdstrike_gcp_iam_service_account_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Cloud Entity | `crowdstrike_gcp_secret_manager_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Cloud Entity | `crowdstrike_gcp_secret_manager_secret_version` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Cloud Entity | `crowdstrike_gcp_pubsub_topic` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| Cloud Entity | `crowdstrike_gcp_pubsub_subscription` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| Cloud Entity | `crowdstrike_gcp_logging_sink` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Entity | `crowdstrike_gcp_logging_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Compliance Control | `crowdstrike_compliance_control` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| IOM Finding | `crowdstrike_iom_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| IOM Rule | `crowdstrike_iom_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Service | `crowdstrike_endpoint_protection` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `crowdstrike_account` | **HAS** | `crowdstrike_endpoint_protection` |
| `crowdstrike_account` | **HAS** | `crowdstrike_cloud_account` |
| `crowdstrike_cloud_account` | **HAS** | `crowdstrike_cloud_entity` |
| `crowdstrike_cloud_entity` | **HAS** | `crowdstrike_iom_finding` |
| `crowdstrike_compliance_control` | **HAS** | `crowdstrike_iom_rule` |

### Crowdstrike Account

`crowdstrike_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cid` | `string` |  |  |

---

### Crowdstrike Cloud Account

`crowdstrike_cloud_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountAlias` \*

 | `string` **|** `null` |  |  |
| 

`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`accountType` \*

 | `string` **|** `null` |  |  |
| 

`availableRegions` \*

 | `array` **|** `null` |  |  |
| 

`azureTenantId` \*

 | `string` **|** `null` |  |  |
| 

`cid` \*

 | `string` **|** `null` |  |  |
| 

`cloudformationUpdateUrl` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`cloudtrailBucketName` \*

 | `string` **|** `null` |  |  |
| 

`cloudtrailRegion` \*

 | `string` **|** `null` |  |  |
| 

`dsprmRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`enabledServices` \*

 | `array` **|** `null` |  |  |
| 

`endedOn` \*

 | `number` **|** `null` |  |  |
| 

`eventbusArn` \*

 | `string` **|** `null` |  |  |
| 

`eventbusName` \*

 | `string` **|** `null` |  |  |
| 

`externalId` \*

 | `string` **|** `null` |  |  |
| 

`falconClientId` \*

 | `string` **|** `null` |  |  |
| 

`healthyConditionsCount` \*

 | `number` **|** `null` |  |  |
| 

`iamRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`intermediateRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isBehaviorAssessmentEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCloudRegistration` \*

 | `boolean` **|** `null` |  |  |
| 

`isCSPMEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCSPMLite` \*

 | `boolean` **|** `null` |  |  |
| 

`isCustomRolename` \*

 | `boolean` **|** `null` |  |  |
| 

`isD4CMigrated` \*

 | `boolean` **|** `null` |  |  |
| 

`isDSPMEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isManaged` \*

 | `boolean` **|** `null` |  |  |
| 

`isMaster` \*

 | `boolean` **|** `null` |  |  |
| 

`isSensorManagementEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isUsingExistingCloudtrail` \*

 | `boolean` **|** `null` |  |  |
| 

`isValid` \*

 | `boolean` **|** `null` |  |  |
| 

`lastScanOn` \*

 | `number` **|** `null` |  |  |
| 

`onboardedOn` \*

 | `number` **|** `null` |  |  |
| 

`operationalServicesCount` \*

 | `number` **|** `null` |  |  |
| 

`organizationId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`remediationCloudformationUrl` \*

 | `string` **|** `null` |  |  |
| 

`s3Url` \*

 | `string` **|** `null` |  |  |
| 

`startedOn` \*

 | `number` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`totalConditionsCount` \*

 | `number` **|** `null` |  |  |
| 

`totalServicesCount` \*

 | `number` **|** `null` |  |  |
| 

`vendor` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Compliance Control

`crowdstrike_compliance_control` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`assessmentId` \*

 | `string` |  |  |
| 

`benchmarkId` \*

 | `string` **|** `null` |  |  |
| 

`benchmarkName` \*

 | `string` **|** `null` |  |  |
| 

`benchmarkVersion` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`compliantResources` \*

 | `number` **|** `null` |  |  |
| 

`controlFramework` \*

 | `string` **|** `null` |  |  |
| 

`controlName` \*

 | `string` **|** `null` |  |  |
| 

`controlType` \*

 | `string` **|** `null` |  |  |
| 

`controlVersion` \*

 | `string` **|** `null` |  |  |
| 

`criticalNonCompliant` \*

 | `number` **|** `null` |  |  |
| 

`highNonCompliant` \*

 | `number` **|** `null` |  |  |
| 

`informationalNonCompliant` \*

 | `number` **|** `null` |  |  |
| 

`lastEvaluatedOn` \*

 | `number` **|** `null` |  |  |
| 

`mediumNonCompliant` \*

 | `number` **|** `null` |  |  |
| 

`nonCompliantResources` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resourceProvider` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`ruleIds` \*

 | `array` **|** `null` |  |  |
| 

`ruleNames` \*

 | `array` **|** `null` |  |  |
| 

`ruleOrigins` \*

 | `array` **|** `null` |  |  |
| 

`rulePolicyIds` \*

 | `array` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |
| 

`severities` \*

 | `array` **|** `null` |  |  |
| 

`totalResources` \*

 | `number` **|** `null` |  |  |

---

### Crowdstrike Endpoint Protection

`crowdstrike_endpoint_protection` inherits from [Service](/data-model/schemas/Service.md)

---

### Crowdstrike Iom Finding

`crowdstrike_iom_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`attackTypes` \*

 | `array` **|** `null` |  |  |
| 

`cid` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`evaluationStatus` \*

 | `string` **|** `null` |  |  |
| 

`extensionStatus` \*

 | `string` **|** `null` |  |  |
| 

`firstDetectedOn` \*

 | `number` **|** `null` |  |  |
| 

`frameworks` \*

 | `array` **|** `null` |  |  |
| 

`gcrn` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lastDetectedOn` \*

 | `number` **|** `null` |  |  |
| 

`policyId` \*

 | `number` |  |  |
| 

`policyName` \*

 | `string` **|** `null` |  |  |
| 

`policyStatement` \*

 | `string` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceName` \*

 | `string` **|** `null` |  |  |
| 

`resourceStatus` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`ruleDescription` \*

 | `string` **|** `null` |  |  |
| 

`ruleId` \*

 | `string` **|** `null` |  |  |
| 

`ruleName` \*

 | `string` **|** `null` |  |  |
| 

`ruleOrigin` \*

 | `string` **|** `null` |  |  |
| 

`ruleRemediation` \*

 | `string` **|** `null` |  |  |
| 

`scannedOn` \*

 | `number` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Iom Rule

`crowdstrike_iom_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountScope` \*

 | `string` **|** `null` |  |  |
| 

`attackTypes` \*

 | `array` **|** `null` |  |  |
| 

`cid` \*

 | `string` **|** `null` |  |  |
| 

`cloudAssetType` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` **|** `null` |  |  |
| 

`cloudService` \*

 | `string` **|** `null` |  |  |
| 

`cloudServiceFriendly` \*

 | `string` **|** `null` |  |  |
| 

`cloudServiceSubtype` \*

 | `string` **|** `null` |  |  |
| 

`defaultSeverity` \*

 | `string` **|** `null` |  |  |
| 

`fqlPolicy` \*

 | `string` **|** `null` |  |  |
| 

`isGlobal` \*

 | `boolean` **|** `null` |  |  |
| 

`isRemediable` \*

 | `boolean` **|** `null` |  |  |
| 

`policyId` \*

 | `number` |  |  |
| 

`policyTimestampOn` \*

 | `number` **|** `null` |  |  |
| 

`policyType` \*

 | `string` **|** `null` |  |  |
| 

`remediationSummary` \*

 | `string` **|** `null` |  |  |

---

## Release Notes

-   **2026-06-25** — Initial release of the CrowdStrike Falcon Cloud Security integration, ingesting cloud accounts and resources, Indicators of Misconfiguration (IOM) findings and rules, and compliance controls across AWS, Azure, and GCP.

---

Source: /integrations/directory/cyberark-epm

# CyberArk EPM

Visualize CyberArk EPM account, policies, devices, application groups and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You must create a CyberArk EPM user with read-only permissions before configuring this integration. The EPM web services documentation recommends a dedicated user with read-only access for API integrations.

-   Using a web browser, log in to your CyberArk tenant (e.g., [https://tenant-id.epm.cyberark.com/](https://tenant-id.epm.cyberark.com/)) ![Login](/assets/images/cyberarkepm-login-f344ad6663daf781cd52f7880b739c9d.png)
    
-   Click on the **Administration** tile ![Administration](/assets/images/cybereark-administration-c2cf7ddb24cb4c8fd43b75a39c7b6407.png)
    
-   Click on **Create** and select **Create User** ![Create User](/assets/images/cybereark-create-user-f953f136cac23fe6062206853a93a9aa.png)
    
-   A pop-up will appear to fill in the credentials and permission details for the user. Complete the form and click **Finish** ![Permissions](/assets/images/cybereark-permissions-4a08284db3af64ae5a172d73bbd35f15.png)
    
-   You can use the Username and Password to log in to the portal as well as for generating the session token using the EPM Authentication API.
    

### Configuration in JupiterOne

To install the CyberArk EPM integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select CyberArk EPM. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **CyberArk EPM Dispatcher Server URL** — the dispatcher server name for your region. Valid values follow the pattern `<region>.epm.cyberark.com` (commercial, e.g. `login.epm.cyberark.com`, `eu.epm.cyberark.com`, `uk.epm.cyberark.com`) or `<region>.epm.cyberarkgov.cloud` (US government tenants).
    
-   **CyberArk EPM Username** — the username of the EPM user created in the previous step.
    
-   **CyberArk EPM Password** — the password of the EPM user created in the previous step.
    

Click **Create** once all values are provided to finalize the integration.

### Advanced Configuration

| Field | Description | Default |
| --- | --- | --- |
| Disable TLS Verification | When enabled, skips TLS certificate verification when connecting to the EPM server. Not recommended; install valid TLS certificates instead. | Disabled |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cyberark_epm_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| ApplicationGroup | `cyberark_epm_applicationgroup` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Device | `cyberark_epm_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| HostAgent | `cyberark_epm_hostagent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Policy | `cyberark_epm_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Service | `cyberark_epm_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cyberark_epm_account` | **HAS** | `cyberark_epm_service` |
| `cyberark_epm_account` | **HAS** | `cyberark_epm_hostagent` |
| `cyberark_epm_hostagent` | **PROTECTS** | `cyberark_epm_device` |
| `cyberark_epm_policy` | **ENFORCES** | `cyberark_epm_service` |
| `cyberark_epm_policy` | **ENFORCES** | `cyberark_epm_applicationgroup` |

### Cyberark Epm Device

`cyberark_epm_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `setid` | `string` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS type accuracy for CyberArk EPM device entities.

---

Source: /integrations/directory/cyberark-idaptive

# CyberArk Idaptive

Visualize CyberArk Idaptive Devices, Users, Applications, Roles, Accounts and monitor changes through queries and alerts.

This integration ingests devices, users, accounts, applications, and roles from the CyberArk Idaptive REST API. Setup involves two parts: creating a service account and an OAuth2 client application in your CyberArk Idaptive tenant, then configuring the integration in JupiterOne using the credentials you generate.

## Installation

To complete setup you need:

-   A CyberArk Idaptive tenant (e.g., `https://my-tenant.id.cyberark.cloud`). You log in with a tenant admin account to create the service user and the OAuth2 application.
-   The CyberArk Idaptive [Identity APIs reference](https://api-docs.cyberark.com/identity-docs-api/docs/identity-apis).

### Step 1: Create a service account

1.  Log in to your CyberArk Idaptive tenant and navigate to the **Admin portal**.
    
    ![Admin Portal](/assets/images/select-admin-portal-9254bd1e1cebdf5be92024a8799ec080.png)
    
2.  Go to **Core Services** > **Users**. Fill in all required fields. Check **Password never expires**, **Is service user**, and **Is OAuth Credential Client** in the status section, then click **Create user**.
    
    ![Create User](/assets/images/create-service-user-0077d5373e76f923f214cbd86124baef.png)
    

### Step 2: Create an OAuth2 client application

3.  In the Admin portal, click **Apps & Widgets** > **Web Apps**, then click **Add Web Apps**.
    
    ![Web Apps page](/assets/images/select-web-apps-38bb8390e7698539153ab36f42d2b089.png)
    
4.  Select **Custom** and choose **OAuth2 Client** from the list.
    
    ![Select client web app](/assets/images/select-oauth-client-94e65c7e60398cc51026db84fde41ecc.png)
    
5.  Select the **Organization** from the dropdown and click **Add**.
    
    ![Select organization](/assets/images/select-org-7224be474e10ba7b5ac9b39d3e50619d.png)
    
6.  On the **Settings** page, enter an ID for the application. Save this ID — you will need it as the **CyberArk Idaptive Client Application Id** when configuring the JupiterOne integration.
    
    ![Application page](/assets/images/application-id-9fa46d3bce19b61db5d4d42cde22a811.png)
    
7.  Click **General Usage** in the sidebar. Select **Confidential** and check **Must be OAuth Client**.
    
    ![OAuth client](/assets/images/select-oauth-confidential-04661aac9b33531c5c52440f2db77d63.png)
    
8.  Go to **Tokens** in the sidebar, select **Client credentials**, and set a token validity period greater than 10 minutes. Enable refresh tokens.
    
    ![Client credentials](/assets/images/select-client-creds-f7c3f869b9237a48bc6414f9b14cf997.png)
    
9.  Go to **Scope** in the sidebar and click **Add**. Name the scope `all` and set the regex to:
    
    ```text
    CDirectoryService/GetUsers|redrock/query|Roles/GetRoleMembers|SysInfo/About|UPRest/GetResultantAppsForUser|Acl/GetRowAces
    ```
    
    ![Scopes](/assets/images/select-scopes-c0e574f9a9b11f53345440ebd2518c7c.png)
    
10.  Go to **Permissions** in the sidebar, search for the service account you created in step 2, and click **Add**. Grant the **Run** permission to the service account, then click **Save**.
     
     ![Add service account](/assets/images/add-permission-91118d9f8ada8a22db3f1f4206f92d05.png)
     

### Step 3: Grant the System Administrator role

11.  In the Admin portal, navigate to **Roles** > **System Administrator**.
     
     ![Admin role](/assets/images/add-role-5fe197c818352158871f954569a3e2f1.png)
     
12.  Go to **Members** and add the service account as a member.
     
     ![Assign role](/assets/images/add-service-account-74549de992010477572f655ea12d12d1.png)
     

### Configuration in JupiterOne

To install the CyberArk Idaptive integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select CyberArk Idaptive. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the CyberArk Idaptive account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **CyberArk Idaptive instance URL** — The URL of your CyberArk Idaptive tenant, for example `https://my-tenant.id.cyberark.cloud`.
    
-   **CyberArk Idaptive Client Application Id** — The application ID you assigned when creating the OAuth2 client app (step 6 above).
    
-   **CyberArk Idaptive Service Account Username** — The username of the service account you created in step 2.
    
-   **CyberArk Idaptive Service Account Password** — The password for the service account.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cyberark_idaptive_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `cyberark_idaptive_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Device | `cyberark_idaptive_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Role | `cyberark_idaptive_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Service | `cyberark_idaptive` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `cyberark_idaptive_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cyberark_idaptive_account` | **HAS** | `cyberark_idaptive_user` |
| `cyberark_idaptive_account` | **HAS** | `cyberark_idaptive_application` |
| `cyberark_idaptive_account` | **PROVIDES** | `cyberark_idaptive` |
| `cyberark_idaptive_role` | **ASSIGNED** | `cyberark_idaptive_application` |
| `cyberark_idaptive_user` | **OWNS** | `cyberark_idaptive_device` |
| `cyberark_idaptive_user` | **ASSIGNED** | `cyberark_idaptive_role` |
| `cyberark_idaptive_user` | **ASSIGNED** | `cyberark_idaptive_application` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `cyberark_idaptive_user` | **IS** | `Person` | FORWARD |

### Cyberark Idaptive

`cyberark_idaptive` inherits from [Service](/data-model/schemas/Service.md)

---

### Cyberark Idaptive Account

`cyberark_idaptive_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessURL` | `string` |  |  |
| `podFqdn` | `string` |  |  |
| `podName` | `string` |  |  |
| `podRegion` | `string` |  |  |
| `version` | `string` |  |  |

---

### Cyberark Idaptive Application

`cyberark_idaptive_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `adminTag` | `string` |  |  |
| `appType` | `string` |  |  |
| `appTypeDisplayName` | `string` |  |  |
| `authChallengeDefinitionFlowId` | `string` |  |  |
| `authChallengeDefinitionId` | `string` |  |  |
| `brand` | `string` |  |  |
| `bypassLoginMFA` | `boolean` |  |  |
| `catalogVisibility` | `string` |  |  |
| `category` | `string` |  |  |
| `certBasedAuthEnabled` | `boolean` |  |  |
| `childLinkedApps` | `string` |  |  |
| `corpIdentifier` | `string` |  |  |
| `deepLinkUrl` | `string` |  |  |
| `derivedCredsSupported` | `boolean` |  |  |
| `directoryId` | `string` |  |  |
| `entityKeys` | `array` of `string`s |  |  |
| `featured` | `boolean` |  |  |
| `generic` | `boolean` |  |  |
| `handler` | `string` |  |  |
| `icon` | `string` |  |  |
| `id` | `string` |  |  |
| `isGatewayed` | `boolean` |  |  |
| `isMarketplaceApp` | `boolean` |  |  |
| `isScaEnabled` | `boolean` |  |  |
| `isSwsEnabled` | `boolean` |  |  |
| `isTestApp` | `boolean` |  |  |
| `isThirdPartyIdpEnabled` | `boolean` |  |  |
| `lastUsedCentrifyUrl` | `string` |  |  |
| `lastUsedPodUrl` | `string` |  |  |
| `mobileAppSource` | `string` |  |  |
| `mobileAppType` | `string` |  |  |
| `munkiMetadata` | `string` |  |  |
| `notSelfService` | `boolean` |  |  |
| `onPrem` | `boolean` |  |  |
| `orgId` | `string` |  |  |
| `orgPath` | `string` |  |  |
| `parentApp` | `string` |  |  |
| `parentAppTemplateName` | `string` |  |  |
| `policyScript` | `string` |  |  |
| `popular` | `boolean` |  |  |
| `portalApp` | `boolean` |  |  |
| `provCapable` | `boolean` |  |  |
| `provConfigured` | `boolean` |  |  |
| `provSettingEnabled` | `boolean` |  |  |
| `provSettingPreview` | `boolean` |  |  |
| `provSettingsIsEnterpriseScimUser` | `string` |  |  |
| `provSettingsValidateEmailAttribute` | `string` |  |  |
| `serviceName` | `string` |  |  |
| `shadowAppLink` | `string` |  |  |
| `skipSwsForAwsCli` | `boolean` |  |  |
| `state` | `string` |  |  |
| `tableName` | `string` |  |  |
| `templateName` | `string` |  |  |
| `version` | `string` |  |  |
| `versionName` | `string` |  |  |
| `webAppLoginType` | `string` |  |  |
| `webAppType` | `string` |  |  |
| `webAppTypeDisplayName` | `string` |  |  |
| `webUPAppType` | `string` |  |  |
| `workflowEnabled` | `boolean` |  |  |

---

### Cyberark Idaptive Device

`cyberark_idaptive_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `afwDeviceId` | `string` **|** `null` |  |  |
| `agentAccount` | `string` **|** `null` |  |  |
| `amsPolicyEnforced` | `boolean` **|** `null` |  |  |
| `androidAppReleaseVersion` | `string` |  |  |
| `apps` | `string` **|** `null` |  |  |
| `availableDeviceCapacity` | `string` **|** `null` |  |  |
| `availableDeviceCapacityDisplay` | `string` **|** `null` |  |  |
| `batteryLevel` | `string` **|** `null` |  |  |
| `bytesReceivedNetwork` | `string` **|** `null` |  |  |
| `bytesReceivedWIFI` | `string` **|** `null` |  |  |
| `bytesSentNetwork` | `string` **|** `null` |  |  |
| `bytesSentWIFI` | `string` **|** `null` |  |  |
| `capabilities` | `string` |  |  |
| `carrier` | `string` **|** `null` |  |  |
| `cellularTechnology` | `string` **|** `null` |  |  |
| `clientPackageId` | `string` **|** `null` |  |  |
| `commandCountThisWeek` | `number` |  |  |
| `commandCountToday` | `number` |  |  |
| `complianceState` | `string` **|** `null` |  |  |
| `corporateOwned` | `boolean` |  |  |
| `customerID` | `string` |  |  |
| `deviceCapacity` | `string` **|** `null` |  |  |
| `deviceCapacityDisplay` | `string` **|** `null` |  |  |
| `deviceDetails` | `string` |  |  |
| `displayModelName` | `string` **|** `null` |  |  |
| `displayOsVersion` | `string` |  |  |
| `displayOwner` | `string` |  |  |
| `displayState` | `string` |  |  |
| `displayStateString` | `string` |  |  |
| `enrollmentType` | `string` |  |  |
| `entityKeys` | `array` of `string`s |  |  |
| `fileVaultStatus` | `string` **|** `null` |  |  |
| `hasNonExportableKeychainData` | `boolean` |  |  |
| `id` | `string` |  |  |
| `imei` | `string` **|** `null` |  |  |
| `internalDeviceType` | `string` |  |  |
| `ipAddress` | `string` **|** `null` |  |  |
| `isAdminLocationTrackingEnabled` | `boolean` **|** `null` |  |  |
| `jailbroken` | `number` |  |  |
| `knoxApiLevel` | `string` **|** `null` |  |  |
| `knoxContainerStatus` | `string` **|** `null` |  |  |
| `knoxLicenseActivated` | `boolean` **|** `null` |  |  |
| `knoxSdkVersion` | `string` **|** `null` |  |  |
| `knoxVersionDisplay` | `string` **|** `null` |  |  |
| `lastAttestationState` | `string` **|** `null` |  |  |
| `lastAttestationSucceeded` | `boolean` **|** `null` |  |  |
| `lastDeviceOwnerLogin` | `string` **|** `null` |  |  |
| `lastInfoReceived` | `string` |  |  |
| `lastNotify` | `string` |  |  |
| `lastUsedCentrifyUrl` | `string` **|** `null` |  |  |
| `lastUsedPodUrl` | `string` **|** `null` |  |  |
| `latitude` | `string` **|** `null` |  |  |
| `latitudeDisplay` | `string` **|** `null` |  |  |
| `locationAccuracy` | `string` **|** `null` |  |  |
| `locationTime` | `string` **|** `null` |  |  |
| `loggingCallInfo` | `string` **|** `null` |  |  |
| `loggingCarrierDataUsage` | `boolean` **|** `null` |  |  |
| `loggingSMS` | `boolean` **|** `null` |  |  |
| `longitude` | `string` **|** `null` |  |  |
| `longitudeDisplay` | `string` **|** `null` |  |  |
| `missedCallsCount` | `string` **|** `null` |  |  |
| `mobileManagerVersion` | `string` |  |  |
| `modelName` | `string` **|** `null` |  |  |
| `orgId` | `string` **|** `null` |  |  |
| `osBuild` | `string` **|** `null` |  |  |
| `osPlatform` | `string` **|** `null` |  |  |
| `ownerID` | `string` |  |  |
| `phoneNumber` | `string` **|** `null` |  |  |
| `primaryEnrolledTenant` | `string` **|** `null` |  |  |
| `primaryEnrolledUser` | `string` **|** `null` |  |  |
| `product` | `string` **|** `null` |  |  |
| `safeKeyVersion` | `string` **|** `null` |  |  |
| `safeSdkVersion` | `string` **|** `null` |  |  |
| `ssoEnabled` | `boolean` |  |  |
| `state` | `number` |  |  |
| `statusFlags` | `string` |  |  |
| `successCallsCount` | `string` **|** `null` |  |  |
| `tableName` | `string` |  |  |

---

### Cyberark Idaptive Role

`cyberark_idaptive_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `category` | `string` **|** `null` |  |  |
| `directoryServiceUuid` | `string` |  |  |
| `entityKeys` | `array` of `string`s |  |  |
| `id` | `string` |  |  |
| `isHidden` | `boolean` **|** `null` |  |  |
| `orgId` | `string` |  |  |
| `orgPath` | `string` **|** `null` |  |  |
| `readOnly` | `boolean` **|** `null` |  |  |

---

### Cyberark Idaptive User

`cyberark_idaptive_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `endDate` | `string` **|** `null` |  |  |
| `entityKeys` | `array` of `string`s |  |  |
| `homeNumber` | `string` **|** `null` |  |  |
| `id` | `string` |  |  |
| `mail` | `string` **|** `null` |  |  |
| `mobileNumber` | `string` **|** `null` |  |  |
| `officeNumber` | `string` **|** `null` |  |  |
| `pictureUri` | `string` **|** `null` |  |  |
| `preferredCulture` | `string` **|** `null` |  |  |
| `reportsTo` | `string` **|** `null` |  |  |
| `startDate` | `string` **|** `null` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name accuracy for CyberArk Idaptive device entities, using human-readable names for iOS, iPadOS, tvOS, macOS, Android, and Windows devices.

---

Source: /integrations/directory/cyberark-pam

# CyberArk PAM

Visualize CyberArk PAM users, groups, safes, privileged accounts, platforms, and applications in JupiterOne. Map CyberArk users to employees, monitor safe access assignments, and track privileged account management through queries and alerts.

## Installation

To install this integration, you will need to configure settings both within CyberArk PAM and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your CyberArk PAM environment.

### Configuration on CyberArk PAM

> **NOTE**
> 
> A CyberArk PAM user's `Base URL`, `Username`, and `Password` are required for the JupiterOne integration to interact with CyberArk PAM.

The integration authenticates using the CyberArk PAM REST API (v14.6+). An administrator of the CyberArk PAM vault will need to create or designate a user account for JupiterOne with the appropriate permissions.

To configure a CyberArk PAM user for use with JupiterOne:

1.  Log in to the CyberArk PrivateArk Client or PVWA (Password Vault Web Access).
2.  Create a new CyberArk user or designate an existing user for JupiterOne.
3.  Assign the user the following minimum vault-level authorizations:
    -   `List Accounts` — required to enumerate users and groups.
    -   `Audit Users` — required to retrieve user details.
4.  For each safe you want JupiterOne to ingest, add the JupiterOne user as a safe member with the following permission:
    -   `View Safe Members` — required to list members of a safe.
5.  Note the **Base URL** of your CyberArk PVWA instance (e.g., `https://cyberark.example.com`).

> **INFO**
> 
> The integration supports CyberArk, LDAP, RADIUS, and Windows authentication methods. The default authentication type is `Cyberark`. If your environment uses a different authentication method, you can specify it in the JupiterOne configuration.

> **NOTE**
> 
> The integration automatically appends `/PasswordVault` to the base URL if it is not already present. Do not include a trailing slash.

### Permissions

The API user requires the following permissions to ingest all supported resources:

| Resource | Required Permission |
| --- | --- |
| Users | Vault-level `List Accounts` and `Audit Users` |
| Groups | Vault-level `List Accounts` |
| Safes | Vault-level `List Accounts` |
| Safe Members | Safe-level `View Safe Members` on each target safe |
| Privileged Accounts | Safe-level `List Accounts` on each target safe |
| Platforms | Vault-level `List Accounts` |
| Applications | Vault-level `List Accounts` |

> **NOTE**
> 
> If the API user lacks permissions for a specific resource, the integration will log a warning and continue ingesting other resources rather than failing entirely.

### Configuration in JupiterOne

To install the CyberArk PAM integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select CyberArk PAM. Click **New Instance** to begin configuring the integration.

Creating a CyberArk PAM instance requires the following:

-   The **Account Name** used to identify the CyberArk PAM account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Enter the **Base URL** for your CyberArk PVWA instance (e.g., `https://cyberark.example.com`). Do not include `/PasswordVault` — it is appended automatically.
    
-   Enter the **Username** of the CyberArk user designated for JupiterOne.
    
-   Enter the **Password** for the CyberArk user designated for JupiterOne.
    
-   Optionally, enter the **Authentication Type** if your environment uses a method other than the default CyberArk authentication (e.g., `LDAP`, `RADIUS`, or `Windows`).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cyberark_pam_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `cyberark_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Group | `cyberark_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Platform | `cyberark_platform` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Privileged Account | `cyberark_privileged_account` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Safe | `cyberark_safe` | [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |
| User | `cyberark_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cyberark_group` | **HAS** | `cyberark_user` |
| `cyberark_group` | **ASSIGNED** | `cyberark_safe` |
| `cyberark_pam_account` | **HAS** | `cyberark_user` |
| `cyberark_pam_account` | **HAS** | `cyberark_group` |
| `cyberark_pam_account` | **HAS** | `cyberark_safe` |
| `cyberark_pam_account` | **HAS** | `cyberark_platform` |
| `cyberark_pam_account` | **HAS** | `cyberark_application` |
| `cyberark_safe` | **CONTAINS** | `cyberark_privileged_account` |
| `cyberark_user` | **ASSIGNED** | `cyberark_safe` |

## Release Notes

-   **2026-03-18** — Renamed the CyberArk PAM account entity type for consistency, aligning it with other CyberArk integration entity naming conventions.
-   **2026-03-04** — New CyberArk PAM integration: ingests users, groups, safes, privileged accounts, platforms, and applications with full access and ownership relationships.

---

Source: /integrations/directory/cyberhaven

# Cyberhaven

Visualize Cyberhaven Endpoints and monitor changes through queries and alerts.

## Installation

### Requirements

-   An account with permissions to fetch Cyberhaven API endpoints.
-   Appropriate permissions in JupiterOne to setup new integration.

---

### Configuration in Cyberhaven

#### Authentication

Cyberhaven uses token-based authentication to secure its API endpoints. To authenticate, you must first create an API key in the Cyberhaven Console and use it to generate a temporary bearer token.

> **Note:** Ensure that you've created a role with the necessary API permissions before proceeding.

Refer to the Cyberhaven documentation for guidance on creating an API role: [Creating an API Role](https://docs.cyberhaven.io/24-09/docs/roles-and-scopes#creating-an-api-role)

##### Generate an API Key

1.  Navigate to **Preferences > Users and API keys**, then open the **API Keys** tab.
2.  Click **New API Key**.
3.  Provide a name to identify the API key.
4.  Select a role from the list.
5.  Specify a validity period (up to one year).
6.  Click **Save**.
7.  Copy and securely store the generated API key.

---

### Configuration in JupiterOne

1.  From the JupiterOne Search homepage, navigate to **Integrations** from the top menu.
2.  Search for **Cyberhaven**, then select it.
3.  Click **Add Instance**, then provide the following information:

-   **Cyberhaven API Key**: Use the key generated in the _Generate an API Key_ section.
-   **Cyberhaven Tenant Name**: Your tenant's name within Cyberhaven.
-   **Account Name**: A label for identifying this Cyberhaven instance in JupiterOne. If **Tag with Account Name** is enabled, this value is stored in `tag.AccountName` for all ingested entities.
-   **Description**: (Optional) A brief description to help your team identify this integration.
-   **Polling Interval**: Choose an appropriate interval for your monitoring needs. You can also select `DISABLED` to manually execute the integration.

4.  Once all values are entered, click **Create Instance**.

---

### Next Steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cyberhaven_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Endpoint | `cyberhaven_endpoint` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cyberhaven_account` | **HAS** | `cyberhaven_endpoint` |

### Cyberhaven Account

`cyberhaven_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Cyberhaven Endpoint

`cyberhaven_endpoint` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `deploymentGroup` | `string` |  |  |
| `lastActiveUserId` | `string` |  |  |
| `lastActiveUsername` | `string` |  |  |
| `sensorVersion` | `string` |  |  |

---

## Release Notes

-   **2025-04-22** — New Cyberhaven integration: ingests endpoint devices and account information with host entity types.

---

Source: /integrations/directory/cycognito

# CyCognito

Visualize CyCognito assets and issues, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> For this integration, you will need to request an Access Token from an Admin on Cycognito.

To install the CyCongnito integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select CyCongnito. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the CyCongnito account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your CyCognito **Access Token**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cycognito_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Certificate | `cycognito_asset_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| Domain | `cycognito_asset_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| IP | `cycognito_asset_ip` | [IpAddress](https://docs.jupiterone.io/data-model/schemas/IpAddress) |
| Issue | `cycognito_issue` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Web App | `cycognito_asset_web_app` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cycognito_account` | **HAS** | `cycognito_issue` |
| `cycognito_account` | **HAS** | `cycognito_asset_ip` |
| `cycognito_account` | **HAS** | `cycognito_asset_domain` |
| `cycognito_account` | **HAS** | `cycognito_asset_certificate` |
| `cycognito_account` | **HAS** | `cycognito_asset_web_app` |
| `cycognito_asset_certificate` | **HAS** | `cycognito_issue` |
| `cycognito_asset_certificate` | **HAS** | `cycognito_asset_ip` |
| `cycognito_asset_certificate` | **HAS** | `cycognito_asset_domain` |
| `cycognito_asset_domain` | **HAS** | `cycognito_issue` |
| `cycognito_asset_domain` | **HAS** | `cycognito_asset_ip` |
| `cycognito_asset_domain` | **CONTAINS** | `cycognito_asset_domain` |
| `cycognito_asset_ip` | **HAS** | `cycognito_issue` |
| `cycognito_asset_ip` | **HAS** | `cycognito_asset_domain` |
| `cycognito_asset_web_app` | **HAS** | `cycognito_issue` |
| `cycognito_issue` | **IS** | `cve` |
| `cycognito_issue` | **IS** | `cyc` |

---

Source: /integrations/directory/databricks

# Databricks

Visualize Databricks workspace groups, users, and clusters, map Databrick users to employees, and monitor changes through queries and alerts.

## Installation

To install this integration, you will need to configure settings both within Databricks and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your Databricks account.

### Configuration in Databricks

The integration authenticates against a single Databricks workspace with a personal access token. Follow the steps for the cloud your workspace runs on to find the workspace URL, then generate the token.

#### Databricks on AWS

1.  Go to the [Databricks AWS account console](https://accounts.cloud.databricks.com/login) and log in.
2.  In the **Workspaces** section, choose the workspace you want to ingest.
3.  The workspace URL has the format `https://[deployment-name].cloud.databricks.com`, for example `https://dbc-c50dbe80-ed72.cloud.databricks.com`. Take note of it and supply it on the integration configuration page.

#### Databricks on GCP

1.  Go to the [Databricks GCP dashboard](https://accounts.gcp.databricks.com/login) and log in.
2.  In the [Workspaces section](https://accounts.gcp.databricks.com/workspaces), choose the workspace.
3.  You will be able to see the URL on the following page that has the following format: `https://[numbers].[number].gcp.databricks.com`
4.  Take note of it and supply it on the integration configuration page. For example, `https://1122334455.6.gcp.databricks.com`

#### Generating the access token

1.  Click the workspace URL to go to the workspace dashboard. Once there, click on the settings icon (bottom part of left side menu) and choose **User settings**.
2.  Click **Generate New Token**, add comment/description, and press **Generate**. Retain this for use in JupiterOne.

> **INFO**
> 
> For additional assistance generating an API Token on Databricks, see [their documentation](https://docs.databricks.com/dev-tools/auth.html#databricks-personal-access-tokens) for more information.

### Required Permissions in Databricks

The Personal Access Token must have appropriate permissions to access the following resources:

-   **Groups** (`/api/2.0/groups/list`) - to retrieve group information
-   **Group Members** (`/api/2.0/groups/list-members`) - to retrieve user memberships in groups
-   **Clusters** (`/api/2.0/clusters/list`) - to retrieve cluster configurations

**Important**: The token user must have **CAN\_ATTACH\_TO** permission on clusters to successfully retrieve cluster information. Without this permission, the cluster list will return empty results. This permission can be granted through cluster access control lists (ACLs) in the Databricks workspace settings.

### Optional: AWS configuration of a Databricks on AWS workspace

The AWS resources backing a workspace — its region, VPC, subnets, security groups, root S3 bucket, KMS keys and PrivateLink settings — are only exposed through the Databricks **account-level** API, which a personal access token cannot call: ["You can't use personal access tokens to automate Databricks account-level functionality."](https://docs.databricks.com/aws/en/dev-tools/auth/pat)

To ingest them, additionally configure an account-level service principal with an OAuth secret:

1.  Go to the [Databricks AWS account console](https://accounts.cloud.databricks.com/login) and log in as an account admin.
2.  Copy your **Account ID** from the user menu in the top right corner.
3.  Go to **User management > Service principals** and either select an existing service principal or click **Add service principal**.
4.  On the service principal's **Roles** tab, enable **Account admin**. Account-level APIs [require the service principal to be an account admin](https://docs.databricks.com/aws/en/dev-tools/auth/oauth-m2m).
5.  On the **Secrets** tab, click **Generate secret**. Retain the **Client ID** and the **Secret** — the secret is only shown once.

The service principal reads the following account-level endpoints:

-   `GET /api/2.0/accounts/{account_id}/workspaces` - to find the account record of the configured workspace
-   `GET /api/2.0/accounts/{account_id}/networks/{network_id}` - to retrieve the VPC, subnets and security groups
-   `GET /api/2.0/accounts/{account_id}/storage-configurations/{storage_configuration_id}` - to retrieve the root S3 bucket
-   `GET /api/2.0/accounts/{account_id}/credentials/{credentials_id}` - to retrieve the cross-account IAM role, which identifies the AWS account
-   `GET /api/2.0/accounts/{account_id}/customer-managed-keys/{customer_managed_key_id}` - to retrieve the KMS keys
-   `GET /api/2.0/accounts/{account_id}/private-access-settings/{private_access_settings_id}` - to retrieve the PrivateLink settings

> **NOTE**
> 
> These fields are optional. When they are left empty, the integration ingests the workspace, its groups, users and clusters exactly as before. They have no effect on workspaces hosted on GCP or Azure.

### Configuration in JupiterOne

To install the Databricks integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Databricks. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Databricks account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Databricks **Host** and **Access token**.
    
-   Optionally, for a Databricks on AWS workspace, your **Databricks Account ID**, the **Service Principal Client ID** and the **Service Principal OAuth Secret** of the account-level service principal described above.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Cluster | `databricks_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Group | `databricks_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| User | `databricks_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Workspace | `databricks_workspace` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `databricks_group` | **HAS** | `databricks_user` |
| `databricks_user` | **CREATED** | `databricks_cluster` |
| `databricks_workspace` | **HAS** | `databricks_group` |
| `databricks_workspace` | **HAS** | `databricks_cluster` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `databricks_cluster` | **IS** | `aws_instance` | FORWARD |
| `databricks_workspace` | **USES** | `aws_vpc` | FORWARD |
| `databricks_workspace` | **USES** | `aws_subnet` | FORWARD |
| `databricks_workspace` | **USES** | `aws_s3_bucket` | FORWARD |
| `databricks_workspace` | **USES** | `aws_kms_key` | FORWARD |
| `databricks_workspace` | **USES** | `aws_cloudwatch` | FORWARD |
| `databricks_workspace` | **USES** | `aws_config` | FORWARD |

### Databricks Cluster

`databricks_cluster` inherits from [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `autoTerminationMinutes` | `number` | The idle time in minutes after which the cluster is terminated automatically. Zero disables automatic termination. |  |
| `availabilityZone` | `string` | The AWS availability zone the cluster nodes run in, e.g. us-east-1a. Only set on clusters in a Databricks on AWS workspace. |  |
| `awsAvailability` | `string` | The AWS instance purchasing strategy of the cluster: SPOT, ON\_DEMAND or SPOT\_WITH\_FALLBACK. |  |
| `creator` | `string` | The user name of the principal that created the cluster. |  |
| `ebsVolumeCount` | `number` | The number of EBS volumes attached to each of the cluster nodes. |  |
| `ebsVolumeSize` | `number` | The size in GiB of each EBS volume attached to the cluster nodes. |  |
| `ebsVolumeType` | `string` | The type of the EBS volumes attached to the cluster nodes: GENERAL\_PURPOSE\_SSD or THROUGHPUT\_OPTIMIZED\_HDD. |  |
| `enableElasticDisk` | `boolean` | Whether the cluster acquires additional disk space when its workers run low on it. |  |
| `enableLocalDiskEncryption` | `boolean` | Whether the local disks attached to the cluster nodes are encrypted. |  |
| `initScriptsSafeMode` | `boolean` | Whether the cluster runs its init scripts in safe mode, i.e. from workspace-approved locations only. |  |
| `instanceProfileArn` | `string` | The ARN of the AWS instance profile the cluster nodes assume. |  |
| `nodeTypeId` | `string` | The instance type of the cluster worker nodes, e.g. m5d.large. |  |
| `state` | `string` | The current state of the cluster, e.g. PENDING, RUNNING, TERMINATED. |  |
| `terminatedOn` | `number` | The timestamp in milliseconds since epoch when the cluster was last terminated. |  |

---

### Databricks Workspace

`databricks_workspace` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowedVpcEndpointIds` | `array` **|** `null` | The Databricks VPC endpoint identifiers allowed to connect to the workspace over AWS PrivateLink. |  |
| `awsAccountId` | `string` **|** `null` | The AWS account hosting the workspace data plane, taken from the cross-account IAM role Databricks assumes. |  |
| `awsRegion` | `string` **|** `null` | The AWS region the workspace data plane is deployed in, e.g. us-east-1. |  |
| `cloud` | `string` | The cloud the workspace data plane runs on: aws, azure or gcp. |  |
| `computeMode` | `string` | The compute mode of the workspace: HYBRID or SERVERLESS. |  |
| `crossAccountRoleArn` | `string` **|** `null` | The ARN of the cross-account IAM role Databricks assumes to manage the workspace data plane. |  |
| `databricksAccountId` | `string` | The identifier of the Databricks account the workspace belongs to. |  |
| `deploymentName` | `string` | The subdomain component of the workspace URL, e.g. dbc-c50dbe80-ed72. |  |
| `encryptionKeyRef` | `string` **|** `null` | The ARN of the AWS KMS key encrypting the workspace root storage, falling back to the managed services key. |  |
| `isEncrypted` | `boolean` | Whether the workspace is configured with a customer-managed key for either its storage or its managed services. |  |
| `isManagedServicesEncrypted` | `boolean` | Whether the workspace managed services (notebooks, secrets) are encrypted with a customer-managed key. |  |
| `isPrivateEndpointEnabled` | `boolean` **|** `null` | Whether the workspace is only reachable over AWS PrivateLink, i.e. public access is explicitly disabled in its private access settings. |  |
| `isStorageEncrypted` | `boolean` | Whether the workspace root storage is encrypted with a customer-managed key. |  |
| `pricingTier` | `string` | The pricing tier (SKU) of the workspace: COMMUNITY\_EDITION, STANDARD, PREMIUM, ENTERPRISE or DEDICATED. |  |
| `privateAccessLevel` | `string` **|** `null` | Which VPC endpoints may connect to the workspace: ACCOUNT or ENDPOINT. |  |
| `s3BucketName` | `string` **|** `null` | The name of the S3 bucket backing the workspace root storage. |  |
| `securityGroupIds` | `array` **|** `null` | The identifiers of the AWS security groups attached to the workspace data plane. |  |
| `storageMode` | `string` | The storage mode of the workspace: CUSTOMER\_HOSTED or DEFAULT\_STORAGE. |  |
| `subnetIds` | `array` **|** `null` | The identifiers of the AWS subnets the workspace data plane runs in. |  |
| `vpcEndpointIds` | `array` **|** `null` | The Databricks VPC endpoint configuration identifiers registered for the workspace network, covering both the REST API and the data plane relay. |  |
| `vpcId` | `string` **|** `null` | The identifier of the AWS VPC hosting the workspace data plane. |  |
| `vpcStatus` | `string` **|** `null` | The status of the workspace network configuration: VALID, BROKEN, UNATTACHED or WARNED. |  |
| `workspaceId` | `string` **|** `null` | The Databricks-assigned identifier of the workspace, e.g. 6280049833385130. |  |

---

## Release Notes

-   **2022-02-09** — New Databricks integration: ingests workspaces, users, groups, and clusters, providing visibility into Databricks compute environments and access configurations.

---

Source: /integrations/directory/datadog

# Datadog

Visualize Datadog services and users, and monitor changes to Datadog users through queries and alerts.

## Installation

Before setting up the integration within JupiterOne, you will need to create an API key and Application key in Datadog.

1.  **To create your API key**: navigate to your [Datadog organization's API keys](https://app.datadoghq.com/organization-settings/api-keys) and select **New Key**.

> **NOTE**
> 
> Your account must have the Datadog Admin Role to generate an API key.

2.  **To create an application key**: navigate to your [Datadog organization's application keys](https://app.datadoghq.com/organization-settings/application-keys) and select **New Key**. Required scopes:

-   `user_access_read`
-   `hosts_read`
-   `org_management`

### Configuration in JupiterOne

To install the Datadog integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Datadog. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Datadog account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Datadog **API Key**, **Application Key**, and your **Datadog email** (the email associated with your Datadog account).
    
-   Optionally, enter the Datadog **Host** and **Datadog Organization ID** for your organization. You can find this by sending a GET request to the endpoint listed at [https://docs.datadoghq.com/api/latest/organizations/#list-your-managed-organizations](https://docs.datadoghq.com/api/latest/organizations/#list-your-managed-organizations).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `datadog_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Host | `datadog_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Role | `datadog_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| User | `datadog_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `datadog_account` | **HAS** | `datadog_user` |
| `datadog_account` | **HAS** | `datadog_role` |
| `datadog_account` | **HAS** | `datadog_host` |
| `datadog_user` | **ASSIGNED** | `datadog_role` |

### Datadog Account

`datadog_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Datadog Host

`datadog_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentVersion` | `string` |  |  |
| `aliases` | `array` of `string`s |  |  |
| `apps` | `array` of `string`s |  |  |
| `awsName` | `string` |  |  |
| `hostCpuCores` | `number` |  |  |
| 
`id` \*

 | `string` |  |  |
| `isMuted` | `boolean` |  |  |
| `machine` | `string` |  |  |
| `name` | `string` |  |  |
| `platform` | `string` |  |  |
| `processor` | `string` |  |  |
| `pythonVersion` | `string` |  |  |
| `reportedOn` | `number` |  |  |
| `socketFqdn` | `string` |  |  |
| `socketHostname` | `string` |  |  |
| `sources` | `array` of `string`s |  |  |
| `state` | `string` |  |  |

---

### Datadog Role

`datadog_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdAt` | `number` |  |  |
| `modifiedAt` | `number` |  |  |
| `userCount` | `number` |  |  |

---

### Datadog User

`datadog_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `disabled` | `boolean` |  |  |
| `icon` | `string` |  |  |
| `verified` | `boolean` |  |  |

---

## Release Notes

-   **2022-11-17** — Added host entity ingestion to the Datadog integration, enabling visibility into monitored infrastructure hosts and their properties.
-   **2021-11-17** — New Datadog integration: ingests account information, users, and roles, enabling identity and access visibility for Datadog organizations.

---

Source: /integrations/directory/datastax

# DataStax

Visualize DataStax Astra organizations, users, roles, databases, and access, map DataStax Astra users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to create a custom role in DataStax and a TOKEN key.

### Configuration DataStax

From within the DataStax dashboard, you will fist need to create a custom role. To do so:

1.  Navigate to **Current Organization > Organization Settings > Role Management** and select **Add Custom Role**.
2.  Provide a name for the custom role and check the following roles:

-   `View DB`
-   `Read IP Access List`
-   `Read User`
-   `Read Organization`
-   `Read Custom Role`

3.  Enable **Apply permissions to all databases in this organization**
4.  Click **Create Role** and navigate to **Token Management**.
5.  Under **Select Role**, choose the role you just created, and press **Save**.

> **INFO**
> 
> For additional information regarding DataStax user permissions, token generation, and custom roles, [see DataStax's documentation](https://docs.datastax.com/en/astra-serverless/docs/getting-started/gs-grant-user-access.html).

### Configuration in JupiterOne

To install the DataStax integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select DataStax. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the DataStax account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your DataStax **Organization name** and **Token**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Access List | `datastax_access_list` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Access List Address | `datastax_access_list_address` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Access Role | `datastax_access_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Database | `datastax_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Organization | `datastax_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| User | `datastax_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `datastax_access_list` | **HAS** | `datastax_access_list_address` |
| `datastax_database` | **ASSIGNED** | `datastax_access_list` |
| `datastax_organization` | **HAS** | `datastax_database` |
| `datastax_organization` | **HAS** | `datastax_access_list` |
| `datastax_organization` | **HAS** | `datastax_user` |
| `datastax_user` | **ASSIGNED** | `datastax_access_role` |

### Datastax User

`datastax_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |

---

---

Source: /integrations/directory/defender-endpoint

# Microsoft Defender for Endpoint

Visualize Microsoft Defender for Endpoint resources, map Defender users to employees, and monitor changes through queries and alerts.

## Installation

To use this integration, you must have:

-   An Azure account with an App Registration that provides credentials for JupiterOne to authenticate with Microsoft Graph and Microsoft Defender for Endpoint APIs.
-   An Active Directory tenant to target for data ingestion. The tenant can be the same one that hosts the App Registration or a separate one.
-   A Microsoft Defender for Endpoint subscription that includes the devices and vulnerability data you want to ingest.

### Configuration in Microsoft Defender for Endpoint

**In the Azure Portal — create the App Registration**

1.  Navigate to **App Registrations**.
2.  Click **New registration**.
3.  Enter a name for the app (for example, `JupiterOne`).
4.  Select the supported account type for your organization.
5.  Click **Register**.

#### Add API permissions

In your new app registration, go to **API permissions** under **Manage** in the left panel.

1.  If the app already has the `User.Read` permission, remove it — it is not needed for this integration.
2.  Click **Add a permission** > **Microsoft Graph**.
3.  Select **Application permissions** and add:
    -   `Organization.Read.All`
    -   `Directory.Read.All`
4.  Click **Add permissions**.
5.  Click **Add a permission** again.
6.  Under **APIs my organization uses**, search for `WindowsDefenderATP` and click the result.
7.  Select **Application permissions** and add:
    -   `Machine.Read.All`
    -   `User.Read.All`
    -   `Vulnerability.Read.All`
8.  Click **Add permissions**.
9.  Click **Grant admin consent** and confirm.

**Create a client secret**

1.  In your app registration, click **Certificates & secrets**.
2.  Under **Client secrets**, click **New client secret**.
3.  Add a description and choose an expiration that fits your secret-rotation policy.
4.  Click **Add**.
5.  Copy the **Value** immediately using the copy icon — the full value is not shown again after you navigate away.

##### API permissions reference

**Microsoft Graph**

| Permission | Purpose |
| --- | --- |
| `Organization.Read.All` | Read organization information; required to create the Account entity |
| `Directory.Read.All` | Read directory data; required to create User entities |

**WindowsDefenderATP**

| Permission | Purpose |
| --- | --- |
| `Machine.Read.All` | Read device information; required to create Device and Endpoint entities |
| `User.Read.All` | Read user profiles; required to create logon-user entities |
| `Vulnerability.Read.All` | Read Threat and Vulnerability Management data; required to create Vulnerability and Finding entities |

## Configuration in JupiterOne

Navigate to the **Integrations** tab, select **Microsoft Defender for Endpoint**, and click **New Instance**.

Creating an instance requires the following credentials from your Azure App Registration:

-   **Application (client) ID** — The application client ID created for JupiterOne, used to authenticate with Azure. Find this on your App Registration's **Overview** tab.
    
-   **Directory (tenant) ID** — The tenant ID of the Active Directory to target in Azure API requests. Also found on your App Registration's **Overview** tab.
    
-   **Application (client) Secret** — The client secret value you copied in the previous step. This field is masked after entry; paste the value before closing the Azure Portal tab.
    

Click **Create** to finish.

### Next steps

Once configured, the integration will run on the polling interval you set, populating data in JupiterOne. See the [Instance management guide](/integrations/instance-management.md) for more on managing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (5)

-   `AdvancedQuery.Read.All`
-   `Machine.Read.All`
-   `Organization.Read.All`
-   `User.Read.All`
-   `Vulnerability.Read.All`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (7)

-   `https://api.securitycenter.microsoft.com/api/advancedqueries/run`
-   `https://api.securitycenter.microsoft.com/api/machines`
-   `https://api.securitycenter.microsoft.com/api/machines/{machineId}/logonusers`
-   `https://api.securitycenter.microsoft.com/api/machines/{machineId}/vulnerabilities`
-   `https://api.securitycenter.microsoft.com/api/vulnerabilities`
-   `https://graph.microsoft.com/v1.0/organization`
-   `https://graph.microsoft.com/v1.0/users`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (9)

-   [https://learn.microsoft.com/en-us/defender-endpoint/api/api-permissions](https://learn.microsoft.com/en-us/defender-endpoint/api/api-permissions)
-   [https://learn.microsoft.com/en-us/defender-endpoint/api/get-discovered-vulnerabilities](https://learn.microsoft.com/en-us/defender-endpoint/api/get-discovered-vulnerabilities)
-   [https://learn.microsoft.com/en-us/defender-endpoint/api/get-machine-log-on-users](https://learn.microsoft.com/en-us/defender-endpoint/api/get-machine-log-on-users)
-   [https://learn.microsoft.com/en-us/defender-endpoint/api/get-machines](https://learn.microsoft.com/en-us/defender-endpoint/api/get-machines)
-   [https://learn.microsoft.com/en-us/defender-endpoint/api/run-advanced-query-api](https://learn.microsoft.com/en-us/defender-endpoint/api/run-advanced-query-api)
-   [https://learn.microsoft.com/en-us/graph/api/organization-get](https://learn.microsoft.com/en-us/graph/api/organization-get)
-   [https://learn.microsoft.com/en-us/graph/api/user-list](https://learn.microsoft.com/en-us/graph/api/user-list)
-   [https://learn.microsoft.com/en-us/graph/permissions-reference#organizationreadall](https://learn.microsoft.com/en-us/graph/permissions-reference#organizationreadall)
-   [https://learn.microsoft.com/en-us/graph/permissions-reference#userreadall](https://learn.microsoft.com/en-us/graph/permissions-reference#userreadall)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Build Endpoint Has Vulnerability Relationships | \- | \- |
| Fetch Endpoints | `AdvancedQuery.Read.All` | `https://api.securitycenter.microsoft.com/api/advancedqueries/run` |
| Fetch Logon Users | `Machine.Read.All`, `AdvancedQuery.Read.All` | `https://api.securitycenter.microsoft.com/api/machines/{machineId}/logonusers`, `https://api.securitycenter.microsoft.com/api/advancedqueries/run` |
| Fetch Vulnerabilities | `Vulnerability.Read.All`, `AdvancedQuery.Read.All` | `https://api.securitycenter.microsoft.com/api/machines/{machineId}/vulnerabilities`, `https://api.securitycenter.microsoft.com/api/vulnerabilities`, `https://api.securitycenter.microsoft.com/api/advancedqueries/run` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `microsoft_defender_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device/Machine/Host | `microsoft_defender_user_endpoint` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Logon User | `microsoft_defender_logon_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Machine | `microsoft_defender_machine` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| User | `microsoft_defender_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vulnerability | `microsoft_defender_vulnerability` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Vulnerability | `microsoft_defender_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `microsoft_defender_account` | **HAS** | `microsoft_defender_user` |
| `microsoft_defender_account` | **HAS** | `microsoft_defender_machine` |
| `microsoft_defender_machine` | **PROTECTS** | `microsoft_defender_user_endpoint` |
| `microsoft_defender_machine` | **IDENTIFIED** | `microsoft_defender_vulnerability` |
| `microsoft_defender_machine` | **HAS** | `microsoft_defender_logon_user` |
| `microsoft_defender_user_endpoint` | **HAS** | `microsoft_defender_vulnerability` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `microsoft_defender_user_endpoint` | **IS** | `aws_instance` | FORWARD |
| `microsoft_defender_vulnerability` | **IS** | `cve` | FORWARD |

### Microsoft Defender Account

`microsoft_defender_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `defaultDomain` | `string` |  |  |
| `organizationName` | `string` **|** `null` |  |  |
| `verifiedDomains` | `array` of `string`s |  |  |

---

### Microsoft Defender Logon User

`microsoft_defender_logon_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `domain` | `string` **|** `null` |  |  |
| `firstSeenOn` | `number` |  |  |
| `lastSeenOn` | `number` |  |  |
| 
`logonTypes` \*

 | `string` |  |  |

---

### Microsoft Defender Machine

`microsoft_defender_machine` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`aadDeviceId` \*

 | `string` **|** `null` |  |  |
| 

`agentVersion` \*

 | `string` |  |  |
| 

`computerDnsName` \*

 | `string` |  |  |
| 

`defenderAvStatus` \*

 | `string` |  |  |
| `firstSeenOn` | `number` |  |  |
| 

`ipAddress` \*

 | `array` of `string`s |  |  |
| 

`macAddress` \*

 | `array` of `string`s |  |  |
| 

`machineTags` \*

 | `array` of `string`s |  |  |
| 

`managedBy` \*

 | `string` |  |  |
| 

`managedByStatus` \*

 | `string` |  |  |
| 

`onboardingStatus` \*

 | `string` |  |  |
| 

`rbacGroupId` \*

 | `number` |  |  |
| 

`rbacGroupName` \*

 | `string` **|** `null` |  |  |
| 

`riskScore` \*

 | `string` |  |  |

---

### Microsoft Defender User

`microsoft_defender_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `businessPhones` | `array` of `string`s |  |  |
| `givenName` | `string` **|** `null` |  |  |
| `jobTitle` | `string` **|** `null` |  |  |
| `mail` | `string` **|** `null` |  |  |
| `mobilePhone` | `string` **|** `null` |  |  |
| `officeLocation` | `string` **|** `null` |  |  |
| `preferredLanguage` | `string` **|** `null` |  |  |
| `surname` | `string` **|** `null` |  |  |
| `userPrincipalName` | `string` **|** `null` |  |  |

---

### Microsoft Defender User Endpoint

`microsoft_defender_user_endpoint` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`aadDeviceId` \*

 | `string` **|** `null` |  |  |
| 

`agentVersion` \*

 | `string` |  |  |
| `cloudProvider` | `string` |  |  |
| 

`computerDnsName` \*

 | `string` |  |  |
| 

`defenderAvStatus` \*

 | `string` |  |  |
| 

`deviceValue` \*

 | `string` |  |  |
| 

`exposureLevel` \*

 | `string` |  |  |
| `firstSeenOn` | `number` |  |  |
| 

`healthStatus` \*

 | `string` |  |  |
| 

`ipAddress` \*

 | `array` of `string`s |  |  |
| 

`ipAddresses` \*

 | `array` of `string`s |  |  |
| 

`isAadJoined` \*

 | `boolean` **|** `null` |  |  |
| 

`lastExternalIpAddress` \*

 | `string` |  |  |
| 

`lastIpAddress` \*

 | `string` |  |  |
| 

`macAddress` \*

 | `array` of `string`s |  |  |
| 

`machineTags` \*

 | `array` of `string`s |  |  |
| 

`managedBy` \*

 | `string` |  |  |
| 

`managedByStatus` \*

 | `string` |  |  |
| 

`onboardingStatus` \*

 | `string` |  |  |
| 

`osArchitecture` \*

 | `string` |  |  |
| 

`osBuild` \*

 | `number` **|** `null` |  |  |
| 

`osPlatform` \*

 | `string` |  |  |
| `osProcessor` | `string` |  |  |
| 

`rbacGroupId` \*

 | `number` |  |  |
| 

`rbacGroupName` \*

 | `string` **|** `null` |  |  |
| `resourceId` | `string` |  |  |
| 

`riskScore` \*

 | `string` |  |  |
| `status` | `string` |  |  |
| `subscriptionId` | `string` |  |  |
| `vmId` | `string` |  |  |

---

### Microsoft Defender Vulnerability

`microsoft_defender_vulnerability` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`blocking` \*

 | `boolean` |  |  |
| `cveSupportability` | `string` |  |  |
| `cvssVector` | `string` |  |  |
| 

`exposedMachines` \*

 | `number` |  |  |
| 

`id` \*

 | `string` |  |  |
| `publishedOn` | `number` |  |  |

---

### Microsoft Defender Vulnerability

`microsoft_defender_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`blocking` \*

 | `boolean` |  |  |
| `cveSupportability` | `string` |  |  |
| `cvssVector` | `string` |  |  |
| 

`exposedMachines` \*

 | `number` |  |  |
| 

`id` \*

 | `string` |  |  |
| `publishedOn` | `number` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS data model accuracy for Microsoft Defender endpoint entities.
-   **2026-04-01** — Added mapped relationships from Microsoft Defender endpoints to AWS EC2 instances, enabling cross-cloud device correlation.
-   **2026-03-05** — Added optional Advanced Hunting API enrichment to link Microsoft Defender endpoints with cloud resource identifiers from AWS and GCP.
-   **2025-12-02** — Added CVSS vector string and CVE supportability properties to Microsoft Defender vulnerability and finding entities.
-   **2025-09-11** — Added relationships linking Azure virtual machines to their corresponding Microsoft Defender endpoint data.
-   **2025-06-04** — Microsoft Defender endpoint vulnerability entities now support both the Vulnerability and Finding entity classes for improved data model compatibility.

---

Source: /integrations/directory/defense-storm

# DefenseStorm

Visualize DefenseStorm GRID network assets and users, map devices to their owners, and monitor changes through queries and alerts.

## Installation

To set up this integration, you will need to generate an API token from your DefenseStorm GRID console and provide the resulting credentials to JupiterOne.

### Configuration in DefenseStorm

DefenseStorm GRID authenticates API requests using an **API Key** and an **API Secret** obtained from an _Input Token_. These credentials must belong to a user account with sufficient permissions to read assets and users.

**To generate an API token:**

1.  Log in to your [DefenseStorm GRID console](https://console.defensestorm.com).
2.  Navigate to **Settings** in the left-hand menu.
3.  Select **Input Tokens** at the top of the Settings page.
4.  Click **Get API Token** in the top-right corner of the Input Tokens page.
5.  Record the **Key** and **Secret** values that are displayed — you will need both to configure the JupiterOne integration.

> **WARNING**
> 
> The API Secret is only shown once. Store it securely before closing the dialog.

> **INFO**
> 
> The API token must be associated with a user account that has read access to the resources you intend to ingest (assets and/or users). Tokens tied to restricted accounts may result in empty or partial data ingestion.

### Configuration in JupiterOne

To install the DefenseStorm integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select DefenseStorm. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the DefenseStorm account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your DefenseStorm **API Key** and **API Secret** obtained from the Input Tokens page in GRID Settings.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `defense_storm_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device | `defense_storm_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| User | `defense_storm_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `defense_storm_account` | **HAS** | `defense_storm_device` |
| `defense_storm_account` | **HAS** | `defense_storm_user` |

### Defense Storm Account

`defense_storm_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Defense Storm Device

`defense_storm_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`dataLastSentOn` \*

 | `number` **|** `null` |  |  |
| `importance` | `string` |  |  |
| `labels` | `array` of `string`s |  |  |
| `observedHostnames` | `array` of `string`s |  |  |
| `owner` | `string` |  |  |
| `softwareNames` | `array` of `string`s |  |  |
| `tag` | `string` |  |  |
| 

`tracked` \*

 | `boolean` |  |  |

---

### Defense Storm User

`defense_storm_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authorizedOrgIds` | `array` of `string`s |  |  |
| `dataRestrictionId` | `string` |  |  |
| 
`google2faEnabled` \*

 | `boolean` |  |  |
| `orgId` | `string` |  |  |
| `phoneNumber` | `string` |  |  |
| `roleId` | `string` |  |  |
| `shortName` | `string` |  |  |
| 

`u2fEnabled` \*

 | `boolean` |  |  |

---

## Release Notes

-   **2026-02-25** — New DefenseStorm integration: ingests devices and users, linking them to the DefenseStorm account for security monitoring visibility.

---

Source: /integrations/directory/dell-asset-management

# Dell Asset Management

JupiterOne's integration with Dell Asset Management collects hardware inventory and warranty entitlement data from the Dell TechDirect API, providing visibility into your Dell device fleet and the support coverage attached to each asset.

## Installation

For this integration, you will need:

-   A set of Dell **TechDirect API** OAuth credentials — a **Client ID** and **Client Secret** for the TechDirect Asset/Entitlement API. Register at [tdm.dell.com](https://tdm.dell.com) to obtain them. See the [Dell developer portal](https://developer.dell.com/apis) for API documentation.
-   A **CSV file containing the Dell service tags** you want to enrich. The integration looks up warranty and entitlement data for each tag against the TechDirect `/PROD/sbil/eapi/v5/asset-entitlements` endpoint.

> **INFO**
> 
> The integration enriches a customer-supplied list of service tags — it does not auto-discover newly purchased hardware. Re-upload the CSV when new devices ship to bring them into JupiterOne.

### Service tags CSV format

The **Service Tags (CSV)** field accepts either of the following formats:

-   **One service tag per line**, with no header row:
    
    ```text
    ABC1234
    DEF5678
    GHI9012
    ```
    
-   **A CSV with a header row** containing a `serviceTag` column. The header match is case-insensitive, and `service_tag` and `Service Tag` are also accepted. Any extra columns are ignored:
    
    ```csv
    serviceTag,owner,location
    ABC1234,Alice,Boston
    DEF5678,Bob,New York
    ```
    

Tags are automatically trimmed, uppercased, and deduplicated. Blank rows are skipped. A multi-column file that does not contain a recognized service-tag header column is rejected with a configuration error, to avoid silently treating the header row as data.

### Configuration in JupiterOne

To install the Dell Asset Management integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Dell Asset Management. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Dell account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **TechDirect Client ID**: the OAuth client ID for the Dell TechDirect Asset/Entitlement API.
    
-   **TechDirect Client Secret**: the OAuth client secret for the Dell TechDirect API.
    
-   **Service Tags (CSV)**: upload the CSV file containing the Dell service tags to enrich.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (1)

-   `/PROD/sbil/eapi/v5/asset-entitlements`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (2)

-   [https://developer.dell.com/apis](https://developer.dell.com/apis)
-   [https://tdm.dell.com](https://tdm.dell.com)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `dell_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device | `dell_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Entitlement | `dell_entitlement` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `dell_account` | **HAS** | `dell_device` |
| `dell_device` | **HAS** | `dell_entitlement` |

### Dell Account

`dell_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`clientId` \*

 | `string` | The Dell TechDirect OAuth client ID used as the stable identifier for this customer account. |  |

---

### Dell Device

`dell_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`countryCode` \*

 | `string` **|** `null` | The ISO 3166-1 alpha-2 country code recorded for the device shipment. |  |
| 

`productCode` \*

 | `string` **|** `null` | The internal Dell product/SKU code describing the device configuration. |  |
| 

`productFamily` \*

 | `string` **|** `null` | The product family grouping reported by TechDirect (e.g. Latitude, PowerEdge). |  |
| 

`productLineDescription` \*

 | `string` **|** `null` | The human-readable product line description (e.g. Latitude 5440, OptiPlex 7010). |  |
| 

`serviceTag` \*

 | `string` | The Dell service tag — the unique hardware identifier printed on the device chassis. |  |
| 

`shippedOn` \*

 | `number` **|** `null` | The date the device shipped from Dell, as a Unix timestamp in milliseconds. |  |

---

### Dell Entitlement

`dell_entitlement` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`endsOn` \*

 | `number` **|** `null` | The date this entitlement expires, as a Unix timestamp in milliseconds. |  |
| 

`entitlementType` \*

 | `string` **|** `null` | The category of entitlement (e.g. INITIAL, EXTENDED, UPGRADE) as reported by TechDirect. |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether the entitlement is currently active (derived: endsOn is in the future). Null when end date is unknown. |  |
| 

`itemNumber` \*

 | `string` | The TechDirect-assigned item number identifying this entitlement record within the device. |  |
| 

`serviceLevelCode` \*

 | `string` **|** `null` | The Dell service level code identifying the support plan (e.g. ND, PR, KD). |  |
| 

`serviceLevelDescription` \*

 | `string` **|** `null` | The human-readable description of the service level (e.g. ProSupport Next Business Day). |  |
| 

`serviceLevelGroup` \*

 | `number` **|** `null` | The numeric grouping that Dell uses internally to bucket related service levels. |  |
| 

`serviceTag` \*

 | `string` | The service tag of the device this entitlement covers. |  |
| 

`startsOn` \*

 | `number` **|** `null` | The date this entitlement becomes effective, as a Unix timestamp in milliseconds. |  |

---

## Release Notes

-   **2026-05-18** — Added initial Dell Asset Management integration, ingesting device assets and their service entitlements.

---

Source: /integrations/directory/detectify

# Detectify

Visualize Detectify scan reports and monitor changes through queries and alerts.

## Installation

The integration connects directly to [Detectify REST API](https://developer.detectify.com/) to obtain application scan assets, reports, and findings. By default, it only ingests finding from the past 30 days. If you have an Enterprise Plan with Detectify, the configuration can be changed to ingest finding from the latest scan reports.

> **INFO**
> 
> For this integration, you will need to create an API Key key on Detectify. See [their documentation](https://support.detectify.com/support/solutions/articles/48001061878-how-to-set-up-the-detectify-api) for more information.

## Configuration in JupiterOne

To install the Detectify integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Detectify. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Detectify account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Detectify **API Key**, configured for read access.
    

Click **Create** once all values are provided to finalize the integration.

## Data Volume Configuration

The Detectify integration provides configuration options to control the volume of data ingested into JupiterOne:

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| Get findings from the latest scans | This option requires Enterprise Plan from Detectify. When enabled, the integration will pull findings only from the latest scan reports. When disabled, the integration will pull all findings within the last 30 days. | Disabled (pulls findings from last 30 days) | Enable to pull only latest scan findings (requires Enterprise Plan) |

### Configuration in JupiterOne

The JupiterOne vulnerability management and scanner integration is built on this high level data model:

```text

Vendor   - HOSTS    ->       Account
Account  - PROVIDES ->       Service (*)
Service  - SCANS or TESTS -> <Entity> (*)
<Entity> - HAS      ->       Finding
```

> (\*) Examples:
> 
> -   `Service` (E.g., SAST, DAST, IAST, MAST, PenTest, etc.)
> -   `<Entity>` (E.g., Application, Host, or Device)

Optionally, the following is added when each scan/assessment/report is also tracked by the integration:

```text

Service    - PERFORMS   -> Assessment
Assessment - IDENTIFIED -> Finding
```

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `detectify_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Asset (Domain) | `web_app_domain` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Asset (Subdomain) | `web_app_endpoint` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| Finding | `detectify_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Scan Profile | `detectify_scan_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Service | `detectify_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `detectify_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `detectify_account` | **PROVIDES** | `detectify_service` |
| `detectify_account` | **HAS** | `web_app_domain` |
| `detectify_account` | **HAS** | `detectify_user` |
| `detectify_service` | **SCANS** | `web_app_domain` |
| `web_app_domain` | **HAS** | `web_app_endpoint` |
| `web_app_domain` | **HAS** | `detectify_scan_profile` |
| `web_app_endpoint` | **HAS** | `detectify_finding` |

### Detectify Finding

`detectify_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `null` |  |  |
| 

`cvss2Score` \*

 | `number` **|** `null` |  |  |
| 

`cvss2Vector` \*

 | `string` **|** `null` |  |  |
| 

`cvss31Score` \*

 | `number` **|** `null` |  |  |
| 

`cvss31Vector` \*

 | `string` **|** `null` |  |  |
| 

`cvss3Score` \*

 | `number` **|** `null` |  |  |
| 

`cvss3Vector` \*

 | `string` **|** `null` |  |  |
| 

`details` \*

 | `array` **|** `null` |  |  |
| 

`endpoint` \*

 | `string` **|** `null` |  |  |
| 

`references` \*

 | `array` **|** `null` |  |  |
| 

`score` \*

 | `number` **|** `null` |  |  |
| 

`vector` \*

 | `string` **|** `null` |  |  |

---

### Detectify User

`detectify_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authentication` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `lastLoginOn` | `number` |  |  |
| `role` | `string` |  |  |
| `userToken` | `string` |  |  |

---

## Release Notes

-   **2025-06-06** — Added CVSS v2, v3, and v3.1 score and vector properties to Detectify finding entities for vulnerability severity assessment.

---

Source: /integrations/directory/device42

# Device42

Visualize Device42 users and devices and monitor changes through queries and alerts.

## Installation

For this integration, you will need to create a new user in Device42.

### Configuration in Device42

1.  In the Device42 Console, navigate to **Tools > Administrators**.
2.  Click **Add Local Admin** in the top right corner.
3.  Create a username and password for the new user. Save these for use in the integration configuration in JupiterOne.
4.  Click **Save** in the bottom right corner.
5.  On the next screen under **Permissions**, make sure the user is Active. We recommend disabling **Staff status** and **Superuser status** to ensure the user can only access the API.
6.  Under Groups add **System Generated Read Only**.
7.  Click the **Save** button in the bottom right corner.

### Required Permissions in Device42

The user must be assigned to the **System Generated Read Only** group to provide read-only access to the following API endpoints:

-   **End Users** (`/api/1.0/endusers/`) - to retrieve end user information
-   **Devices** (`/api/1.0/devices/all/`) - to retrieve device inventory and configurations

The integration uses HTTP Basic authentication or Bearer token authentication. No write or modification permissions are required.

> **INFO**
> 
> Refer to [Device42's documentation](https://docs.device42.com/tools/add-an-active-directory-user-as-a-device42-administrator/) for additional assistance creating a user.

### Configuration in JupiterOne

To install the Device42 integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Device42. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Device42 account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Enter the **username** and **password** for the Device42 account and the **hostname** for your Device42 instance.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `device42_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device | `device42_device` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| End User | `device42_enduser` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `device42_account` | **HAS** | `device42_enduser` |
| `device42_account` | **HAS** | `device42_device` |

### Device42 Account

`device42_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Device42 Device

`device42_device` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `customer` | `string` |  |  |
| `inService` | `boolean` |  |  |
| `ipAddress` | `array` of `string`s |  |  |
| `macAddress` | `array` of `string`s |  |  |
| `serviceLevel` | `string` |  |  |
| `switch` | `string` |  |  |
| `type` | `string` |  |  |
| `uuid` | `string` |  |  |

---

### Device42 Enduser

`device42_enduser` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activeDirectoryUsername` | `string` |  |  |
| `contact` | `string` |  |  |
| `domain` | `string` |  |  |
| `notes` | `string` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name, type, and version details for Device42 device entities.
-   **2026-02-27** — Added support for custom CA certificates in the Device42 integration configuration, enabling secure connections to instances with internal or self-signed certificates.

---

Source: /integrations/directory/digicert

# DigiCert

Visualize DigiCert users and certificates, map certificates to domains, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> For this integration, you will need to create an API key on DigiCert. See [their documentation](https://www.digicert.com/rest-api/) for more information.

### Configuration in JupiterOne

To install the DigiCert integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select DigiCert. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the DigiCert account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your DigiCert **API URL** (optional), with `/services/v2` at the end. This defaults to the US-based DigiCert instance if left blank. For regional instances (such as Europe), enter the appropriate regional API URL. You can identify the Europe instance if your CertCentral console displays "CertCentral Europe" in the top left corner.
    
-   Your DigiCert **API Key**, configured for read access.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `digicert_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| CertificateNote | `digicert_certificate_note` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| User | `digicert_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User | `digicert_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `digicert_account` | **HAS** | `digicert_user` |
| `digicert_account` | **HAS** | `digicert_certificate` |
| `digicert_certificate` | **HAS** | `digicert_certificate_note` |

### Digicert Certificate Note

`digicert_certificate_note` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`authorEmail` \*

 | `string` **|** `null` |  |  |
| 

`authorName` \*

 | `string` **|** `null` |  |  |
| 

`authorUserId` \*

 | `number` **|** `null` |  |  |
| 

`noteId` \*

 | `number` |  |  |
| 

`orderId` \*

 | `number` |  |  |

---

### Digicert User

`digicert_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| `active` | `boolean` |  |  |
| `admin` | `boolean` |  |  |
| `jobTitle` | `string` |  |  |
| `phone` | `string` |  |  |
| `roles` | `array` of `string`s |  |  |
| `status` | `string` |  |  |
| `type` | `string` |  |  |
| `userId` | `number` |  |  |

---

## Release Notes

-   **2026-04-08** — Added ingestion of DigiCert certificate order notes as new entity types, capturing note content, author, and creation timestamp.

---

Source: /integrations/directory/duo

# Duo

Visualize Duo users and access management, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create an API Key (`Integration Key` + `Secret Key`) key on Duo. See [their documentation](https://duo.com/docs/adminapi) for more information.

The Duo integration requires (at minimum) the following API permissions enabled:

-   `Grant administrators`
-   `Grant settings`
-   `Grant read resource`

### Configuration in JupiterOne

To install the Duo integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Duo. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Duo account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Duo **API Hostname**.
    
-   The Duo `Integration Key` and `Secret Key` (both configured for read access).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `duo_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Admin | `duo_admin` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Device | `duo_phone` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Group | `duo_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Integration | `duo_integration` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| MFA Token | `mfa_device` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| User | `duo_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `duo_account` | **HAS** | `duo_group` |
| `duo_account` | **HAS** | `duo_admin` |
| `duo_account` | **HAS** | `duo_user` |
| `duo_account` | **HAS** | `duo_integration` |
| `duo_group` | **HAS** | `duo_user` |
| `duo_user` | **ASSIGNED** | `mfa_device` |
| `duo_user` | **USES** | `duo_phone` |

### Duo Account

`duo_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `siteId` | `string` |  |  |
| `webLink` | `string` |  |  |

---

### Duo Phone

`duo_phone` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activated` | `boolean` |  |  |
| `email` | `string` |  |  |
| `encrypted` | `boolean` |  |  |
| `phoneNumber` | `string` |  |  |
| `platform` | `string` |  |  |
| `tampered` | `boolean` |  |  |
| `userId` | `string` |  |  |
| `username` | `string` |  |  |

---

### Duo User

`duo_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `createdOn` | `number` |  |  |
| `lastLogin` | `number` |  |  |
| `notes` | `array` of `string`s |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name, type, and version accuracy for Duo phone and device entities.

---

Source: /integrations/directory/dx

# DX

Visualize DX teams, users, and software catalog entities, map team ownership of services and domains, and monitor your developer experience platform through queries and alerts.

## Installation

> **INFO**
> 
> You will need a DX API key to configure this integration. API keys are generated in the DX admin area.
> 
> Required API scopes:
> 
> -   `snapshots:read` — Access to snapshots, teams, and users
> -   `catalog:read` — Access to software catalog entities
> 
> See [DX API documentation](https://docs.getdx.com/webapi/overview/) for more information.

To install the DX integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select DX. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the DX account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your DX **API Key** generated from the DX admin area.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (2)

-   `catalog:read`
-   `snapshots:read`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (5)

-   `https://api.getdx.com/catalog.entities.info`
-   `https://api.getdx.com/catalog.entities.list`
-   `https://api.getdx.com/snapshots.list`
-   `https://api.getdx.com/teams.info`
-   `https://api.getdx.com/teams.list`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (5)

-   [https://docs.getdx.com/webapi/methods/catalog.entities.info/](https://docs.getdx.com/webapi/methods/catalog.entities.info/)
-   [https://docs.getdx.com/webapi/methods/catalog.entities.list/](https://docs.getdx.com/webapi/methods/catalog.entities.list/)
-   [https://docs.getdx.com/webapi/methods/snapshots.list/](https://docs.getdx.com/webapi/methods/snapshots.list/)
-   [https://docs.getdx.com/webapi/methods/teams.info/](https://docs.getdx.com/webapi/methods/teams.info/)
-   [https://docs.getdx.com/webapi/methods/teams.list/](https://docs.getdx.com/webapi/methods/teams.list/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (1)

| Step | OAuth Scopes | Endpoints |
| --- | --- | --- |
| Fetch Catalog Entities | `catalog:read` | `https://api.getdx.com/catalog.entities.list`, `https://api.getdx.com/catalog.entities.info` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `dx_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| CatalogDomain | `dx_catalog_domain` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| CatalogEntity | `dx_catalog_entity` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| CatalogService | `dx_catalog_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Team | `dx_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team) |
| User | `dx_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `dx_account` | **HAS** | `dx_team` |
| `dx_account` | **HAS** | `dx_user` |
| `dx_team` | **HAS** | `dx_team` |
| `dx_team` | **HAS** | `dx_user` |
| `dx_team` | **OWNS** | `dx_catalog_entity` |
| `dx_team` | **OWNS** | `dx_catalog_service` |
| `dx_team` | **OWNS** | `dx_catalog_domain` |
| `dx_user` | **MANAGES** | `dx_team` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `dx_catalog_domain` | **HAS** | `github_repo` | FORWARD |
| `dx_catalog_entity` | **HAS** | `github_repo` | FORWARD |
| `dx_catalog_service` | **HAS** | `github_repo` | FORWARD |

### Dx Account

`dx_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Dx Catalog Domain

`dx_catalog_domain` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`catalogEntityType` \*

 | `string` **|** `null` | The type of catalog entity (e.g. service, domain) |  |
| 

`githubRepoIds` \*

 | `array` **|** `null` | Identifiers of the GitHub repositories linked to this catalog entity |  |
| 

`githubRepoNames` \*

 | `array` **|** `null` | Full names of the GitHub repositories linked to this catalog entity |  |
| 

`ownerTeamIds` \*

 | `array` **|** `null` | IDs of the teams that own this catalog entity |  |
| 

`ownerTeamNames` \*

 | `array` **|** `null` | Names of the teams that own this catalog entity |  |

---

### Dx Catalog Entity

`dx_catalog_entity` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`catalogEntityType` \*

 | `string` **|** `null` | The type of catalog entity (e.g. service, domain) |  |
| 

`githubRepoIds` \*

 | `array` **|** `null` | Identifiers of the GitHub repositories linked to this catalog entity |  |
| 

`githubRepoNames` \*

 | `array` **|** `null` | Full names of the GitHub repositories linked to this catalog entity |  |
| 

`ownerTeamIds` \*

 | `array` **|** `null` | IDs of the teams that own this catalog entity |  |
| 

`ownerTeamNames` \*

 | `array` **|** `null` | Names of the teams that own this catalog entity |  |

---

### Dx Catalog Service

`dx_catalog_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`catalogEntityType` \*

 | `string` **|** `null` | The type of catalog entity (e.g. service, domain) |  |
| 

`githubRepoIds` \*

 | `array` **|** `null` | Identifiers of the GitHub repositories linked to this catalog entity |  |
| 

`githubRepoNames` \*

 | `array` **|** `null` | Full names of the GitHub repositories linked to this catalog entity |  |
| 

`ownerTeamIds` \*

 | `array` **|** `null` | IDs of the teams that own this catalog entity |  |
| 

`ownerTeamNames` \*

 | `array` **|** `null` | Names of the teams that own this catalog entity |  |

---

### Dx Team

`dx_team` inherits from [Team](/data-model/schemas/Team.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`ancestors` \*

 | `array` **|** `null` |  |  |
| `contributorCount` | `number` |  |  |
| `isParent` | `boolean` |  |  |
| 

`managerId` \*

 | `string` **|** `null` |  |  |
| 

`parentId` \*

 | `string` **|** `null` |  |  |
| 

`referenceId` \*

 | `string` **|** `null` |  |  |

---

### Dx User

`dx_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`githubUsername` \*

 | `string` **|** `null` |  |  |
| 

`isDeveloper` \*

 | `boolean` **|** `null` |  |  |
| 

`timezone` \*

 | `string` **|** `null` |  |  |

---

## Release Notes

-   **2026-04-09** — New DX integration: ingests teams, users, and catalog entities including services and domains, with team ownership relationships.

---

Source: /integrations/directory/elastic-cloud

# Elastic Cloud

Visualize Elastic Cloud Search Account, Users, Clusters, Nodes, Backup, Roles and Service Accounts changes through queries and alerts.

## Installation

The Elastic Cloud integration collects data from Elasticsearch deployments hosted on Elastic Cloud using the Elasticsearch REST API. It ingests cluster statistics, nodes, users, roles, service accounts, and snapshots. Before configuring the integration in JupiterOne, create an Elasticsearch API key with the required cluster privileges.

### Prerequisites

One instance is required per Elasticsearch deployment. The integration connects directly to the Elasticsearch endpoint using an API key.

The API key must have the following cluster privileges:

| Privilege | Required for |
| --- | --- |
| `monitor` | Cluster statistics (`/_cluster/stats`) and node info (`/_nodes`) |
| `read_security` | Users (`/_security/user`) and roles (`/_security/role`) |
| `manage_service_account` | Service accounts (`/_security/service`) |
| `monitor_snapshot` | Snapshots (`/_snapshot/_all/_all`) |

See [Cluster privileges](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-privileges.html) in the Elasticsearch documentation for details.

### Finding your Elasticsearch endpoint

1.  Log in to the [Elastic Cloud console](https://cloud.elastic.co).
2.  On the **Hosted deployments** page, select your deployment.
3.  Under **Applications**, locate the **Elasticsearch** entry and note the endpoint URL. It has the form `https://<deployment-id>.<region>.<provider>.elastic-cloud.com:443`.

Keep this URL — you will need it as the **Elastic Search Endpoint** when configuring JupiterOne.

### Finding your Elastic Cloud Account ID

1.  In the [Elastic Cloud console](https://cloud.elastic.co), click your profile icon and select **Organization**.
2.  Copy the **Organization ID**.

### Creating an Elasticsearch API key

1.  From the Elastic Cloud console, open Kibana for your deployment (select **Kibana** under **Applications** on the deployment page).
2.  In Kibana, go to **Stack Management > Security > API Keys** (or search for "API Keys" in the global search bar).
3.  Click **Create API key**.
4.  Enter a descriptive name, such as `JupiterOne`.
5.  Optionally, set an expiration date.
6.  Under **Control security privileges**, set the following cluster privileges: `monitor`, `read_security`, `manage_service_account`, `monitor_snapshot`.
7.  Click **Create API key**.
8.  Copy the generated key — it is shown only once.

See [Elasticsearch API keys](https://www.elastic.co/docs/deploy-manage/api-keys/elasticsearch-api-keys) in the Elastic documentation for additional guidance.

### Configuration in JupiterOne

To install the Elastic Cloud integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Elastic Cloud. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Elastic Cloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Elastic Cloud Account ID**: Your Elastic Cloud organization ID, copied from the Organization page in the Elastic Cloud console.
    
-   **Elastic Search API Key**: The API key created in the previous step. This field is required.
    
-   **Elastic Search Endpoint**: The Elasticsearch endpoint URL for your deployment (for example, `https://<deployment-id>.asia-south1.gcp.elastic-cloud.com:443`). This field is required.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (4)

-   `manage_service_account`
-   `monitor`
-   `monitor_snapshot`
-   `read_security`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (6)

-   `{elasticSearchEndpoint}/_cluster/stats`
-   `{elasticSearchEndpoint}/_nodes`
-   `{elasticSearchEndpoint}/_security/role`
-   `{elasticSearchEndpoint}/_security/service`
-   `{elasticSearchEndpoint}/_security/user`
-   `{elasticSearchEndpoint}/_snapshot/_all/_all`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (7)

-   [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-stats](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-stats)
-   [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-nodes-info](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-nodes-info)
-   [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-get-role](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-get-role)
-   [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-get-service-accounts](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-get-service-accounts)
-   [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-get-user](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-get-user)
-   [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-snapshot-get](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-snapshot-get)
-   [https://www.elastic.co/guide/en/elasticsearch/reference/current/security-privileges.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-privileges.html)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Fetch Elastic Search Backups | `monitor_snapshot` | `{elasticSearchEndpoint}/_snapshot/_all/_all` |
| Fetch Elastic Search Cluster Nodes | `monitor` | `{elasticSearchEndpoint}/_nodes` |
| Fetch Roles | `read_security` | `{elasticSearchEndpoint}/_security/role` |
| Fetch Users | `read_security` | `{elasticSearchEndpoint}/_security/user` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `ec_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Backup | `ec_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Cluster | `ec_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Cluster Node | `ec_cluster_node` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Role | `ec_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Service Account | `ec_service_account` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User | `ec_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `ec_account` | **HAS** | `ec_cluster` |
| `ec_account` | **HAS** | `ec_user` |
| `ec_account` | **HAS** | `ec_role` |
| `ec_cluster` | **CONTAINS** | `ec_cluster_node` |
| `ec_cluster` | **HAS** | `ec_backup` |
| `ec_cluster` | **USES** | `ec_role` |
| `ec_user` | **ASSIGNED** | `ec_role` |

### Ec Account

`ec_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Ec Backup

`ec_backup` inherits from [Backup](/data-model/schemas/Backup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `completedOn` | `number` |  |  |
| `dataStreams` | `array` of `string`s |  |  |
| `duration` | `number` |  |  |
| `failedShards` | `number` |  |  |
| `featureStates` | `array` of `string`s |  |  |
| `includeGlobalState` | `boolean` |  |  |
| `indices` | `array` of `string`s |  |  |
| `repository` | `string` |  |  |
| `startedOn` | `number` |  |  |
| `status` | `string` |  |  |
| `successfulShards` | `number` |  |  |
| `totalShards` | `number` |  |  |
| `version` | `string` |  |  |
| `versionId` | `number` |  |  |

---

### Ec Cluster

`ec_cluster` inherits from [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `availableDiskSpace` | `string` |  |  |
| 
`docsCount` \*

 | `number` |  |  |
| 

`failedNodeCount` \*

 | `number` |  |  |
| 

`indicesCount` \*

 | `number` |  |  |
| 

`ingestPipelines` \*

 | `number` |  |  |
| 

`jvmThreads` \*

 | `number` |  |  |
| 

`nodeCount` \*

 | `number` |  |  |
| 

`primaryShards` \*

 | `number` |  |  |
| `storeSize` | `string` |  |  |
| 

`successfulNodeCount` \*

 | `number` |  |  |
| `totalDiskSpace` | `string` |  |  |
| 

`totalShards` \*

 | `number` |  |  |

---

### Ec Cluster Node

`ec_cluster_node` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `availabilityZone` | `string` |  |  |
| `clusterName` | `string` |  |  |
| `dataPath` | `string` |  |  |
| `dataTier` | `string` |  |  |
| `diskReadSpeed` | `string` |  |  |
| `diskWriteSpeed` | `string` |  |  |
| `homePath` | `string` |  |  |
| `httpPort` | `string` |  |  |
| `httpSslEnabled` | `boolean` |  |  |
| `initialMasterNodes` | `string` |  |  |
| `instanceConfiguration` | `string` |  |  |
| `isxPackInstalled` | `boolean` | X-Pack is an Elastic Stack plugin providing advanced features like security, monitoring, and machine learning. |  |
| `logsPath` | `string` |  |  |
| `machineLearningEnabled` | `boolean` |  |  |
| `managedPolicies` | `array` of `string`s |  |  |
| `monitoringEnabled` | `boolean` |  |  |
| `networkBandwidth` | `string` |  |  |
| `processors` | `string` |  |  |
| `region` | `string` |  |  |
| 
`roles` \*

 | `array` of `string`s |  |  |
| `serverName` | `string` |  |  |
| `transportSslEnabled` | `boolean` |  |  |

---

### Ec Role

`ec_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `clusterPrivilegeNames` | `array` of `string`s |  |  |

---

### Ec Service Account

`ec_service_account` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `clusterPrivilege` | `array` of `string`s |  |  |

---

### Ec User

`ec_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `fullName` | `string` |  |  |
| `roles` | `array` of `string`s |  |  |

---

---

Source: /integrations/directory/esper

# Esper

Visualize Esper enterprises, applications, devices, and device groups, map Esper users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create an API key on Esper for this integration. See [their documentation](https://help.esper.io/hc/en-us/articles/12656963209361-Generate-an-API-Key) for more information.

To install the Esper integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Esper. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Esper account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Esper API **Access Token**, **Esper Enterprise ID**, and **Esper Domain**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `esper_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `esper_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Device | `esper_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Device Group | `esper_device_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `esper_account` | **HAS** | `esper_application` |
| `esper_account` | **HAS** | `esper_device_group` |
| `esper_account` | **HAS** | `esper_device` |
| `esper_device_group` | **HAS** | `esper_device` |

## Release Notes

-   **2026-03-31** — Added OS kernel version property to Esper device entities.

---

Source: /integrations/directory/fastly

# Fastly

Visualize Fastly data, map Fastly users to employees, and monitor changes through queries and alerts.

## Installation

You will need to create an API Token key on Fastly for this integration. See [their documentation](https://docs.fastly.com/en/guides/using-api-tokens#creating-api-tokens) for more information.

> **NOTE**
> 
> The API token should be generated by a superuser so it is associated with the organization, not the user, with global read permissions.

### Configuration in Fastly

-   Obtain your Fastly Customer ID [here](https://manage.fastly.com/account/company).
-   Create the API Token on Fastly [here](https://manage.fastly.com/account/personal/tokens).

### Configuration in Jupiterone

To install the Fastly integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Fastly. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Fastly account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Fastly **Customer ID** and **API Token**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `fastly_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| API Token | `fastly_api_token` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Service | `fastly_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Service Backend | `fastly_service_backend` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| User | `fastly_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `fastly_account` | **HAS** | `fastly_user` |
| `fastly_account` | **HAS** | `fastly_api_token` |
| `fastly_account` | **HAS** | `fastly_service` |
| `fastly_service` | **HAS** | `fastly_service_backend` |
| `fastly_user` | **HAS** | `fastly_api_token` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `fastly_service` | **CONNECTS** | `DomainRecord` | FORWARD |
| `fastly_service_backend` | **CONNECTS** | `Host or Gateway` | FORWARD |

---

Source: /integrations/directory/feroot

# Feroot

Visualize Feroot users, groups, project folders, projects, alerts, and domains, map Feroot users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> This integration requires an API key with `Admin Read-only` permissions on Feroot.

### Configuration in Feroot

To create an API Key on Feroot:

1.  Navigate to **Settings > Account > Developer** and click **Create new API key**.
2.  Select the `Admin Read-only` role for the new key.
3.  Once the key is created, access it from the **List of API keys**, and copy the key.

## Data Volume Configuration

Control how much data is ingested from Feroot to manage storage and processing.

### Data Filtering Options

| Field | Type | Description | Default |
| --- | --- | --- | --- |
| **Ingest Resolved Alerts** | Boolean | Indicates whether to preserve entities for resolved alerts or to remove all resolved alerts from the graph. | `false` |

**How it affects data volume:** When disabled (default), resolved alerts are removed from the graph, keeping only active alerts. Enabling this setting preserves all alerts including resolved ones, increasing the total number of alert entities stored.

### In JupiterOne

To install the Feroot integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Feroot. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Feroot account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Lastly, your Feroot **API Key**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Alert | `feroot_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Inspector Project | `feroot_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| PageGuard Project | `feroot_pageguard_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Project Folder | `feroot_project_folder` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Target Domain | `web_app_domain` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| User | `feroot_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Group | `feroot_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `feroot_project` | **MONITORS** | `web_app_domain` |
| `feroot_project` | **CONTAINS** | `feroot_pageguard_project` |
| `feroot_project` | **GENERATED** | `feroot_alert` |
| `feroot_project_folder` | **HAS** | `feroot_project` |
| `feroot_user_group` | **HAS** | `feroot_user` |
| `feroot_user_group` | **HAS** | `feroot_project_folder` |

### Feroot User

`feroot_user` inherits from [User](/data-model/schemas/User.md)

---

---

Source: /integrations/directory/fleetdm

# FleetDM

Visualize your FleetDM policies, hosts, users, and installed software in the JupiterOne graph and detect policy violations with JupterOne Alerts.

## Installation

To use this integration, JupiterOne requires an API-only global admin user's credentials.

### Configuration in FleetDM

Using the `fleetctl` command line tool ([installation instructions here](https://fleetdm.com/docs/using-fleet/fleetctl-cli)), create an [API-only user](https://fleetdm.com/docs/using-fleet/fleetctl-cli#using-fleetctl-with-an-api-only-user) with global admin privileges:

```sh
fleetctl user create --name "API User" --email api@example.com --password temp#pass --api-only --global-role admin
```

NOTE: If you're using FleetDM to manage cloud hosts in addition to user endpoints, create a custom label that includes the user endpoints you want to ingest as `Device` entities. Each of those labeled hosts will be ingested as `Device` entities, and any hosts that are not labeled will be ingested as `Host` entities. If you're not using FleetDM to manage any cloud hosts, and the only hosts are user endpoints, you do not need to specify a custom label, and all hosts will be ingested as `Device` entities.

### Configuration in JupiterOne

To install the FleetDM integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select FleetDM. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the FleetDM account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **FleetDM User Email**, **FleetDM User Password**, and **FleetDM Hostname**.
    
-   Optionally, **User Endpoint Labels** (separate multiple labels with commas).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data about your FleetDM environment within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Host | `fleetdm_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Host | `user_endpoint` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Instance | `fleetdm_instance` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Policy | `fleetdm_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| User | `fleetdm_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `fleetdm_host` | **VIOLATES** | `fleetdm_policy` |
| `fleetdm_instance` | **HAS** | `fleetdm_user` |
| `fleetdm_instance` | **HAS** | `fleetdm_host` |
| `fleetdm_instance` | **HAS** | `user_endpoint` |
| `fleetdm_instance` | **HAS** | `fleetdm_policy` |
| `fleetdm_policy` | **ASSIGNED** | `fleetdm_host` |
| `fleetdm_policy` | **ASSIGNED** | `user_endpoint` |
| `user_endpoint` | **VIOLATES** | `fleetdm_policy` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `fleetdm_host` | **INSTALLED** | `fleetdm_software` | FORWARD |
| `user_endpoint` | **INSTALLED** | `fleetdm_software` | FORWARD |

### Fleetdm User

`fleetdm_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admin` | `boolean` |  |  |
| `createdOn` | `number` |  |  |
| `picture` | `string` |  |  |
| `ssoEnabled` | `boolean` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS type accuracy for FleetDM host entities.

---

Source: /integrations/directory/forescout-eyesight

# Forescout Eyesight

Visualize Forescout Eyesight hosts, policies, users and vulnerabilities, map Forescout hosts to its matching policies, assigned user and identified vulnerabilities, and monitor changes through queries and alerts.

## Installation

To initiate this integration in JupiterOne, you will first need to create a Web API token within Forescout to use in JupiterOne.

### Configuration in Forescout Eyesight

**Creating a Web API Token:**

1.  Log in to the Forescout Console and navigate to **Settings > Modules**. Search for "Web API".
2.  If the "Web API" module is not already started, start it, and click the "Configure" button.
3.  Under "User Settings", create a new user.
4.  Save the username and password you created. Enter these credentials in the "Web API Username" and "Web API Password" fields in JupiterOne.

**Optional: Creating an Admin API User for Ingesting Network Segment Entities**

1.  Log in to the Forescout Console and navigate to **Settings > Modules**. Search for "Core Extensions > Admin API".
2.  If the "Admin API" module is not already started, start it.
3.  Use the "Settings" search to find and select the "CounterACT User Profiles" option.
4.  Click the "Add" button and create a new user with the "User Type" set to "Single - Password".
5.  Enter the username and password you create in the "Admin API Username" and "Admin API Password" fields in JupiterOne.
6.  Assign the user "Group Management" and "Policy Management" permissions with the "View" scope.

:::

### Configuration in JupiterOne

To install the Forescout Eyesight integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select "Forescout Eyesight". Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Forescout Eyesight account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **Hostname**.
    
-   The **Web API Username** and **Web API Password**.
    
-   The **Admin API Username** and **Admin API Password** if you want to ingest the Ip Ranges.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `forescout_eyesight_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Host | `forescout_eyesight_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Ip Range | `forescout_eyesight_ip_range` | [IpRange](https://docs.jupiterone.io/data-model/schemas/IpRange) |
| Policy | `forescout_eyesight_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Policy Rule | `forescout_eyesight_policy_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Scanner | `forescout_eyesight_scanner` | [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| User | `forescout_eyesight_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vulnerability | `forescout_eyesight_vulnerability` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Vulnerability | `forescout_eyesight_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `forescout_eyesight_account` | **HAS** | `forescout_eyesight_scanner` |
| `forescout_eyesight_host` | **HAS** | `forescout_eyesight_vulnerability` |
| `forescout_eyesight_ip_range` | **CONTAINS** | `forescout_eyesight_host` |
| `forescout_eyesight_policy` | **HAS** | `forescout_eyesight_policy_rule` |
| `forescout_eyesight_scanner` | **ASSIGNED** | `forescout_eyesight_policy` |
| `forescout_eyesight_scanner` | **IDENTIFIED** | `forescout_eyesight_host` |
| `forescout_eyesight_user` | **USES** | `forescout_eyesight_host` |

### Forescout Eyesight Account

`forescout_eyesight_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`name` \*

 | `string` |  |  |
| 

`vendor` \*

 | `string` |  |  |

---

### Forescout Eyesight Host

`forescout_eyesight_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `function` | `string` | Indicates the most specific endpoint function that was determined in Forescout Eyesight. |  |
| `ipAddress` | `string` |  |  |
| `macAddress` | `string` |  |  |
| `manufacturer` | `string` |  |  |
| `networkSegment` | `string` | When Admin API credentials are not provided, this field is not populated. |  |
| `os` | `string` | Indicates the most specific endpoint operating system that was determined in Forescout Eyesight. |  |

---

### Forescout Eyesight Ip Range

`forescout_eyesight_ip_range` inherits from [IpRange](/data-model/schemas/IpRange.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`active` \*

 | `boolean` |  |  |
| 

`begin` \*

 | `string` |  |  |
| 

`cidr` \*

 | `array` of `string`s |  |  |
| 

`end` \*

 | `string` |  |  |
| 

`public` \*

 | `boolean` | This is evaluated by comparing the begin and end IP addresses to the three private IP ranges defined by the IETF in RFC 1918. |  |

---

### Forescout Eyesight Policy

`forescout_eyesight_policy` inherits from [Policy](/data-model/schemas/Policy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`content` \*

 | `string` | It'll be empty because API doesn't expose a similar data field |  |
| `description` | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Forescout Eyesight Policy Rule

`forescout_eyesight_policy_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `description` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Forescout Eyesight Scanner

`forescout_eyesight_scanner` inherits from [Scanner](/data-model/schemas/Scanner.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` of `string`s |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Forescout Eyesight User

`forescout_eyesight_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `department` | `string` |  |  |
| `loggedInStatus` | `string` | Indicates hosts at which users are currently logged in to the network via the HTTP Login action |  |

---

### Forescout Eyesight Vulnerability

`forescout_eyesight_vulnerability` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cvssAvailabilityImpact` | `string` |  |  |
| `cvssConfidentialityImpact` | `string` |  |  |
| `cvssIntegrityImpact` | `string` |  |  |
| `cvssRemediationLevel` | `string` |  |  |
| `cvssReportingConfidence` | `string` |  |  |
| `cvssScore` | `number` |  |  |
| `cvssTemporalScore` | `number` |  |  |
| `icsaId` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| `matchingConfidence` | `string` |  |  |
| 

`severity` \*

 | `string` |  | **descriptions**: Parsed from CVSS Score |
| `suppressed` | `boolean` |  |  |
| 

`title` \*

 | `string` |  |  |
| `vendorSpecificId` | `string` |  |  |

---

### Forescout Eyesight Vulnerability

`forescout_eyesight_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cveId` | `string` |  |  |
| `cvssAvailabilityImpact` | `string` |  |  |
| `cvssConfidentialityImpact` | `string` |  |  |
| `cvssIntegrityImpact` | `string` |  |  |
| `cvssRemediationLevel` | `string` |  |  |
| `cvssReportingConfidence` | `string` |  |  |
| `cvssScore` | `number` |  |  |
| `cvssTemporalScore` | `number` |  |  |
| `icsaId` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| `matchingConfidence` | `string` |  |  |
| 

`severity` \*

 | `string` |  | **descriptions**: Parsed from CVSS Score |
| `suppressed` | `boolean` |  |  |
| 

`title` \*

 | `string` |  |  |
| `vendorSpecificId` | `string` |  |  |

---

## Release Notes

-   **2025-06-04** — Promoted Forescout EyeSight vulnerability findings to carry both the Vulnerability and Finding entity classes, enabling cross-integration vulnerability queries.

---

Source: /integrations/directory/fortra-dlp

# Fortra DLP

Visualize Fortra Digital Guardian DLP watchlists, user groups, host groups, incidents, and monitor data loss prevention events through queries and alerts.

## Installation

### Prerequisites in Fortra Digital Guardian

> **INFO**
> 
> You will need the following parameters from your Digital Guardian Analytics & Reporting Cloud (ARC) account:
> 
> -   **Access Gateway URL**: The base URL for API requests
>     -   Example: `https://accessgw-usw.msp.digitalguardian.com`
> -   **Authorization Server URL**: The OAuth2 token endpoint URL
>     -   Example: `https://authsrv.msp.digitalguardian.com`
> -   **Client ID**: Your API Client ID (Tenant ID)
> -   **Client Secret**: Your API Secret (Authentication Token)

#### Obtaining API Credentials

1.  Log in to the **Digital Guardian Management Console (DGMC)**.
    
2.  Navigate to **ARC Tenant Settings**.
    
3.  Copy and save the following values:
    
    -   **Tenant ID** — This is your Client ID
    -   **Authentication Token** — This is your Client Secret
4.  From the DGMC, also copy:
    
    -   **Access Gateway Base URL**
    -   **Authorization Server URL**

#### Export Profiles (Optional)

To ingest DLP incidents or agent version data, configure Export Profiles in Digital Guardian before setting up the JupiterOne integration:

1.  In DGMC, navigate to **Admin > Reports > Export Profiles**.
    
2.  Create or identify the export profile(s) you want to use.
    
3.  Copy the **Export Profile ID** (UUID) for each profile.
    

For more information, see the [Fortra Digital Guardian product page](https://www.fortra.com/platform/data-loss-prevention/analytics-reporting-cloud).

### Configuration in JupiterOne

To install the Fortra DLP integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Fortra DLP. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Fortra DLP account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Digital Guardian **Access Gateway URL** — The base URL for API requests.
    
-   Your Digital Guardian **Authorization Server URL** — The OAuth2 token endpoint.
    
-   Your Digital Guardian **Client ID** and **Client Secret** for OAuth2 authentication.
    

Click **Create** once all values are provided to finalize the integration.

## Data Volume Configuration

### Data Filtering Options

The following optional fields control which data the integration ingests. Leave both blank to skip incident and agent-version enrichment ingestion.

| Field | Description | Default |
| --- | --- | --- |
| **Export Profile IDs** | Comma-separated UUIDs of Export Profiles to fetch DLP incidents from. Each profile must be pre-configured in DGMC. Leave blank to skip incident ingestion. | _(none)_ |
| **Agent Version Export Profile IDs** | Comma-separated UUIDs of Export Profiles used to enrich host agents with their Digital Guardian agent version. The profiles must include the `dg_machine_name`, `dg_agent_version`, and `dg_guid` fields and must be pre-configured in DGMC. Leave blank to skip agent-version enrichment. | _(none)_ |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (1)

-   `client`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (7)

-   `POST {accessGatewayUrl}/rest/2.0/export_profiles/{profileId}/acknowledge`
-   `{accessGatewayUrl}/rest/1.0/dynamic_group/{group_id}`
-   `{accessGatewayUrl}/rest/1.0/lists/dynamic_user_group`
-   `{accessGatewayUrl}/rest/1.0/lists/machine_group`
-   `{accessGatewayUrl}/rest/1.0/lists/user_group`
-   `{accessGatewayUrl}/rest/1.0/watchlists`
-   `{accessGatewayUrl}/rest/2.0/export_profiles/{profileId}/export`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://support.fortra.com/s/article/Digital-Guardian-External-API-Overview](https://support.fortra.com/s/article/Digital-Guardian-External-API-Overview)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (8)

| Step | OAuth Scopes | Endpoints |
| --- | --- | --- |
| Fetch Export Profiles | `client` | `{accessGatewayUrl}/rest/2.0/export_profiles/{profileId}/export` |
| Fetch Host Agents | `client` | `{accessGatewayUrl}/rest/1.0/dynamic_group/{group_id}`, `{accessGatewayUrl}/rest/2.0/export_profiles/{profileId}/export`, `POST {accessGatewayUrl}/rest/2.0/export_profiles/{profileId}/acknowledge` |
| Fetch Host Groups | `client` | `{accessGatewayUrl}/rest/1.0/lists/machine_group` |
| Fetch Incidents | `client` | `{accessGatewayUrl}/rest/2.0/export_profiles/{profileId}/export`, `POST {accessGatewayUrl}/rest/2.0/export_profiles/{profileId}/acknowledge` |
| Fetch Service | \- | \- |
| Fetch User Groups | `client` | `{accessGatewayUrl}/rest/1.0/lists/user_group`, `{accessGatewayUrl}/rest/1.0/lists/dynamic_user_group` |
| Fetch Users | `client` | `{accessGatewayUrl}/rest/1.0/dynamic_group/{group_id}` |
| Fetch Watchlists | `client` | `{accessGatewayUrl}/rest/1.0/watchlists` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `fortra_dlp_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Export Profile | `fortra_dlp_export_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Host | `fortra_dlp_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Host Agent | `fortra_dlp_agent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Host Group | `fortra_dlp_host_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Incident | `fortra_dlp_incident` | [Incident](https://docs.jupiterone.io/data-model/schemas/Incident) |
| Service | `fortra_dlp_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `fortra_dlp_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Group | `fortra_dlp_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Watchlist | `fortra_dlp_watchlist` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `fortra_dlp_account` | **HAS** | `fortra_dlp_service` |
| `fortra_dlp_account` | **HAS** | `fortra_dlp_watchlist` |
| `fortra_dlp_account` | **HAS** | `fortra_dlp_user_group` |
| `fortra_dlp_account` | **HAS** | `fortra_dlp_host_group` |
| `fortra_dlp_account` | **HAS** | `fortra_dlp_agent` |
| `fortra_dlp_account` | **HAS** | `fortra_dlp_export_profile` |
| `fortra_dlp_agent` | **PROTECTS** | `fortra_dlp_host` |
| `fortra_dlp_agent` | **IDENTIFIED** | `fortra_dlp_incident` |
| `fortra_dlp_export_profile` | **GENERATED** | `fortra_dlp_incident` |
| `fortra_dlp_host_group` | **HAS** | `fortra_dlp_agent` |
| `fortra_dlp_service` | **IDENTIFIED** | `fortra_dlp_incident` |
| `fortra_dlp_user` | **HAS** | `fortra_dlp_incident` |
| `fortra_dlp_user_group` | **HAS** | `fortra_dlp_user` |

### Fortra Dlp Account

`fortra_dlp_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessGatewayUrl` | `string` |  |  |
| `authorizationServerUrl` | `string` |  |  |

---

### Fortra Dlp Agent

`fortra_dlp_agent` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentVersion` | `string` |  |  |
| `domainName` | `string` |  |  |
| `machineId` | `string` |  |  |

---

### Fortra Dlp Export Profile

`fortra_dlp_export_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `fieldCount` | `number` |  |  |
| `totalHits` | `number` |  |  |

---

### Fortra Dlp Host

`fortra_dlp_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `domainName` | `string` |  |  |
| `machineId` | `string` |  |  |
| `machineType` | `number` |  |  |

---

### Fortra Dlp Host Group

`fortra_dlp_host_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isReadOnly` | `boolean` |  |  |
| `memberCount` | `number` |  |  |

---

### Fortra Dlp Incident

`fortra_dlp_incident` inherits from [Incident](/data-model/schemas/Incident.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentVersion` | `string` |  |  |
| `alarmName` | `string` |  |  |
| `assignee` | `string` |  |  |
| `eventTime` | `number` |  |  |
| `eventType` | `string` |  |  |
| `guid` | `string` |  |  |
| `machineId` | `string` |  |  |
| `machineName` | `string` |  |  |
| `machineType` | `number` |  |  |
| `machineTypeName` | `string` |  |  |
| `numericSeverity` | `number` |  |  |
| `processedTime` | `number` |  |  |
| `state` | `string` |  |  |
| `userName` | `string` |  |  |

---

### Fortra Dlp Service

`fortra_dlp_service` inherits from [Service](/data-model/schemas/Service.md)

---

### Fortra Dlp User

`fortra_dlp_user` inherits from [User](/data-model/schemas/User.md)

---

### Fortra Dlp User Group

`fortra_dlp_user_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isDynamic` | `boolean` |  |  |
| `isReadOnly` | `boolean` |  |  |
| `memberCount` | `number` |  |  |

---

### Fortra Dlp Watchlist

`fortra_dlp_watchlist` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authorId` | `string` |  |  |
| `grouping` | `string` |  |  |
| `isDeleted` | `boolean` |  |  |
| `permRead` | `string` |  |  |
| `permWrite` | `string` |  |  |
| `scope` | `string` |  |  |
| `tenantId` | `string` |  |  |
| `version` | `number` |  |  |
| `versionAuthor` | `string` |  |  |
| `watchlistType` | `string` |  |  |

---

## Release Notes

-   **2026-02-19** — Added agent version tracking to Fortra DLP host agents, with support for configuring export profiles to retrieve version data.
-   **2026-01-28** — Added hosts and host agents as new entity types to the Fortra DLP integration.
-   **2026-01-27** — New Fortra DLP integration: ingests watchlists, user groups, host groups, export profiles, and incidents.

---

Source: /integrations/directory/freshservice

# Freshservice

Visualize Freshservice information, map Freshservice agents to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need your Freshservice API key to set up this integration. See [Freshservice's documentation](https://support.freshservice.com/en/support/solutions/articles/50000000306-where-do-i-find-my-api-key-) for more information.

### Configuration in JupiterOne

To install the Freshservice integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Freshservice. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Freshservice account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Lastly, your Freshservice **API Key**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `freshservice_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Agent | `freshservice_agent` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Agent Group | `freshservice_agent_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Agent Role | `freshservice_agent_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Ticket | `freshservice_ticket` | [RecordEntity](https://docs.jupiterone.io/data-model/schemas/RecordEntity) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `freshservice_account` | **HAS** | `freshservice_agent` |
| `freshservice_account` | **HAS** | `freshservice_agent_group` |
| `freshservice_account` | **HAS** | `freshservice_agent_role` |
| `freshservice_account` | **HAS** | `freshservice_ticket` |
| `freshservice_agent` | **HAS** | `freshservice_ticket` |
| `freshservice_agent_group` | **HAS** | `freshservice_ticket` |
| `freshservice_agent_group` | **HAS** | `freshservice_agent` |
| `freshservice_agent_role` | **ASSIGNED** | `freshservice_agent` |

### Freshservice Agent

`freshservice_agent` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `address` | `string` |  |  |
| `autoAssignStatusChangeOn` | `number` |  |  |
| `autoAssignTickets` | `boolean` |  |  |
| `backgroundInformation` | `string` |  |  |
| `canSeeAllTicketsFromAssociatedDepartments` | `boolean` |  |  |
| `createdOn` | `number` |  |  |
| `department` | `string` |  |  |
| `externalId` | `string` |  |  |
| `hasLoggedIn` | `boolean` |  |  |
| `id` | `string` |  |  |
| `jobTitle` | `string` |  |  |
| `language` | `string` |  |  |
| `lastActiveOn` | `number` |  |  |
| `lastLoginOn` | `number` |  |  |
| `locationId` | `string` |  |  |
| `mobilePhoneNumber` | `string` |  |  |
| `reportingManagerId` | `string` |  |  |
| `scoreboardLevelId` | `string` |  |  |
| `scoreboardPoints` | `string` |  |  |
| `signature` | `string` |  |  |
| `timeFormat` | `string` |  |  |
| `timeZone` | `string` |  |  |
| `updatedOn` | `number` |  |  |
| `vipUser` | `boolean` |  |  |
| `workPhoneNumber` | `string` |  |  |

---

---

Source: /integrations/directory/gears-sure-mdm

# 42Gears SureMDM

Visualize your 42Gears SureMDM managed devices, device groups, and installed applications, and monitor changes through queries and alerts. This integration ingests the devices enrolled in SureMDM along with their hardware, network, and security details, the group hierarchy that organizes them, and the applications installed on each device to provide visibility into your mobile and endpoint fleet.

## Installation

> **INFO**
> 
> To configure this integration you will need the username and password used to sign in to your SureMDM console, along with your SureMDM API Key. The SureMDM API authenticates each request using Basic Auth (username and password) together with an `ApiKey` header.

### Configuration in SureMDM

**To find your SureMDM API Key:**

1.  Log in to your SureMDM Web Console.
2.  Navigate to **Settings > Account Settings > Account Management**.
3.  Locate the **API Key** shown on the screen and copy it for use in JupiterOne.

See [How to find out the API Key for your SureMDM account](https://knowledgebase.42gears.com/article/how-to-find-out-the-api-key-for-your-suremdm-account/) for more information.

### Configuration in JupiterOne

To install the 42Gears SureMDM integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select 42Gears SureMDM. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Username** - The SureMDM console login username (the same username used to sign in to the SureMDM UI), used for Basic Auth against the API.
    
-   **Password** - The password for your SureMDM console login, used for Basic Auth.
    
-   **API Key** - The API Key for your SureMDM account, sent in the `ApiKey` header. Found under **Settings > Account Settings > Account Management** in the SureMDM console.
    
-   **Base URL** - The base URL for the SureMDM API. Defaults to `https://suremdm.42gears.com` for cloud deployments. For on-premises deployments, use your tenant URL (for example, `https://{tenant}.{country}.suremdm.io`).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (1)

-   `API Access`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (4)

-   `api/v2/devicegrid`
-   `api/v2/group/gethomegroupdetails`
-   `api/v2/group/{customerid}/getAll`
-   `api/v2/installedapp/android/{DeviceId}/device/{Limit}/{Offset}/{Search}/{Sort}/{Order}/{Platform}`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://developer.42gears.com/suremdm/api/v2/specs/suremdmapi.yaml](https://developer.42gears.com/suremdm/api/v2/specs/suremdmapi.yaml)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (2)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Fetch Devices | `API Access` | `api/v2/devicegrid` |
| Fetch Installed Applications | `API Access` | `api/v2/installedapp/android/{DeviceId}/device/{Limit}/{Offset}/{Search}/{Sort}/{Order}/{Platform}` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `suremdm_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device | `suremdm_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Device Group | `suremdm_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Installed Application | `suremdm_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `suremdm_account` | **HAS** | `suremdm_group` |
| `suremdm_account` | **HAS** | `suremdm_device` |
| `suremdm_device` | **INSTALLED** | `suremdm_application` |
| `suremdm_group` | **HAS** | `suremdm_group` |
| `suremdm_group` | **HAS** | `suremdm_device` |

### Suremdm Account

`suremdm_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Suremdm Application

`suremdm_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appSize` | `string` **|** `null` | Reported on-device size of the application. |  |
| `appType` | `string` **|** `null` | Whether the application is a system app or an installed (user) app. |  |
| `packageId` | `string` **|** `null` | Package/application identifier assigned by SureMDM (e.g. the Android package name). |  |
| `version` | `string` **|** `null` | Version of the installed application. |  |

---

### Suremdm Device

`suremdm_device` inherits from [Device](/data-model/schemas/Device.md), [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `afwProfile` | `string` **|** `null` | Android for Work (AFW) profile applied to the device. |  |
| `afwStatus` | `number` **|** `null` | Android for Work (AFW) enrollment status code. |  |
| `agentVersion` | `string` **|** `null` | Version of the SureMDM agent installed on the device. |  |
| `androidId` | `string` **|** `null` | Android ID of the device. |  |
| `availablePhysicalMemory` | `number` **|** `null` | Available physical memory (RAM) on the device, in bytes. |  |
| `batteryHealth` | `string` **|** `null` | Reported battery health of the device. |  |
| `batteryLevel` | `number` **|** `null` | Battery charge remaining on the device, as a percentage. |  |
| `batteryState` | `string` **|** `null` | Current battery state of the device (e.g. charging, discharging). |  |
| `connectionStatus` | `string` **|** `null` | Connection status of the device with SureMDM (e.g. Online, Offline). |  |
| `cpuUsage` | `number` **|** `null` | Current CPU usage of the device, as a percentage. |  |
| `customerId` | `string` **|** `null` | Identifier of the SureMDM customer/account the device belongs to. |  |
| `dataUsage` | `number` **|** `null` | Cellular data usage reported by the device. |  |
| `deviceApprovedStatus` | `number` **|** `null` | Approval status code of the device in SureMDM. |  |
| `deviceUserId` | `string` **|** `null` | Identifier of the user assigned to the device. |  |
| `deviceUserName` | `string` **|** `null` | Name of the user assigned to the device. |  |
| `groupPath` | `string` **|** `null` | Full path of the group the device belongs to within the group hierarchy. |  |
| `imei` | `string` **|** `null` | Primary IMEI of the device. |  |
| `imei2` | `string` **|** `null` | Secondary IMEI of the device (dual-SIM devices). |  |
| `ipAddress` | `string` **|** `null` | Public/primary IP address reported by the device. |  |
| `isBluetoothEnabled` | `boolean` **|** `null` | Indicates whether Bluetooth is enabled on the device. |  |
| `isEnrolled` | `boolean` **|** `null` | Indicates whether the device is enrolled in SureMDM. |  |
| `isGpsEnabled` | `boolean` **|** `null` | Indicates whether GPS/location is enabled on the device. |  |
| `isTrackingEnabled` | `boolean` **|** `null` | Indicates whether location tracking is enabled for the device. |  |
| `knoxStatus` | `string` **|** `null` | Samsung Knox container status of the device. |  |
| `lastCheckedInOn` | `number` **|** `null` | Timestamp (ms since epoch) when the device last checked in with SureMDM. |  |
| `localIpAddress` | `string` **|** `null` | Local/private IP address reported by the device. |  |
| `macAddress` | `string` **|** `null` | MAC address of the device. |  |
| `memoryStorageAvailable` | `number` **|** `null` | Available internal storage on the device, in bytes. |  |
| `networkType` | `string` **|** `null` | Type of network the device is connected to (e.g. WiFi, Mobile). |  |
| `operator` | `string` **|** `null` | Mobile network operator/carrier for the device. |  |
| `osBuildNumber` | `string` **|** `null` | Operating system build number reported by the device. |  |
| `phoneRoaming` | `string` **|** `null` | Indicates whether the device is roaming. |  |
| `phoneSignal` | `number` **|** `null` | Cellular signal strength reported by the device. |  |
| `platformType` | `string` **|** `null` | The raw platform type reported by SureMDM (e.g. Android, iOS, Windows). |  |
| `realDeviceName` | `string` **|** `null` | Hardware/real device name as reported by the device. |  |
| `releaseVersion` | `string` **|** `null` | Operating system release version reported by the device. |  |
| `rootStatus` | `string` **|** `null` | Indicates whether the device is rooted/jailbroken. |  |
| `securityPatchedOn` | `number` **|** `null` | Timestamp (ms since epoch) of the latest security patch applied to the device. |  |
| `simSerialNumber` | `string` **|** `null` | SIM serial number (ICCID) of the device. |  |
| `storageMemoryTotal` | `number` **|** `null` | Total internal storage capacity of the device, in bytes. |  |
| `temperature` | `number` **|** `null` | Current device temperature reading. |  |
| `totalPhysicalMemory` | `number` **|** `null` | Total physical memory (RAM) of the device, in bytes. |  |
| `wifiSignal` | `number` **|** `null` | Wi-Fi signal strength reported by the device. |  |
| `wifiSSID` | `string` **|** `null` | SSID of the Wi-Fi network the device is connected to. |  |

---

### Suremdm Group

`suremdm_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `defaultJobsCount` | `number` **|** `null` | Number of default jobs associated with the group. |  |
| `deviceNameRule` | `string` **|** `null` | The device naming rule applied to devices in the group, null if none. |  |
| 
`groupId` \*

 | `string` | The unique group identifier assigned by SureMDM. |  |
| `groupPath` | `string` **|** `null` | Full path of the group within the group hierarchy (e.g. Home/Devices/Site1). |  |
| `groupType` | `number` **|** `null` | The type of the group (e.g. 0 for a normal group). |  |

---

---

Source: /integrations/directory/github

# GitHub

Visualize GitHub users, teams, repositories, pull requests, issues, code scanning alerts and more. Map GitHub users to employees and training, and monitor software development activities, installations of GitHub apps, and outside collaborators.

## Installation

In order for this integration to run as expected, you will need to have an organization within the GitHub account for which you are creating the integration. Be sure to create an organization in your GitHub account to ensure having the required permissions. [Learn more about GitHub organizations here](https://docs.github.com/en/organizations/collaborating-with-groups-in-organizations/about-organizations).

> **INFO**
> 
> GitHub Cloud & GitHub Enterprise Server Versions 3.3.3 and above have been verified as compatible with this integration. Other versions of GitHub Enterprise may work, but are not fully supported.

### Configuration in JupiterOne

To install the GitHub integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select GitHub. Click **New Instance** to begin configuring the integration.

> **NOTE**
> 
> This integration limits the ingestion of **pull requests** and **issues** to the 500 most recently created or modified since the last execution.

In the new instance configuration, provide:

-   **Account Name** used to identify the GitHub account in JupiterOne. Ingested entities have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **For GitHub Enterprise Servers only**: enable the toggle and provide the relevant **Hostname**, **App ID**, **App Installation ID**, and upload your **API Private Key**.
    

After creating a new GitHub integration configuration in JupiterOne, you will be re-directed to GitHub to install the JupiterOne GitHub app. The app requests read-only permissions to support ingestion of entities and relationships.

View GitHub permissions

##### Note

The Secrets API does not reveal the values of Secrets, only their names and creation dates.

##### Repository Permissions

-   Actions: Read-only
-   Administration: Read-only
-   Contents: Read-only (Only CODEOWNERS file is read when that step is enabled)
-   Dependabot alerts: Read-only
-   Discussions: Read-only
-   Environments: Read-only
-   Issues: Read-only (enables both Issues and private-repo PRs)
-   Metadata: Read-only
-   Pages: Read-only
-   Pull requests: Read-only
-   Secrets: Read-only
-   Secret scanning alerts: Read-only
-   Webhooks: Read-only

##### Organization Permissions

-   Administration: Read-only
-   Members: Read-only
-   Secrets: Read-only
-   Events: Read-only
-   Webhooks: Read-only

##### User Permissioms

-   None

> **INFO**
> 
> Refer to GitHub's documentation information on [setting GitHub app permissions](https://developer.github.com/apps/building-github-apps/setting-permissions-for-github-apps/) and [secret permissions](https://docs.github.com/en/rest/reference/permissions-required-for-github-apps#permission-on-secrets)

## Data Volume Configuration

Control how much data is ingested from GitHub to manage storage and processing.

### Ingestion Windows (Time Ranges)

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Pull Requests Ingestion Window** | Ingestion window for updated pull requests (days ago) | 90 | 90, 180, 275, 365 |
| **Issues Ingestion Window** | Ingestion window for updated issues (days ago) | 90 | 90, 180, 275, 365 |

**How it affects data volume:** Longer windows increase the number of pull requests and issues ingested. The integration limits ingestion to the 500 most recently created or modified items since the last execution.

### Data Filtering Options

| Field | Type | Description | Default |
| --- | --- | --- | --- |
| **States Filter** (Dependabot) | Multi-select | Limit ingestion to Dependabot alerts with specified states | Open |
| **Severities Filter** (Dependabot) | Multi-select | Limit ingestion to Dependabot alerts with specified severities | Critical, High, Moderate, Low |
| **Ingest Generic Secret Alerts** | Boolean | Ingest generic secret alerts including default and generic patterns | `false` |

**How it affects data volume:**

-   Dependabot state filtering reduces alerts by excluding dismissed and fixed alerts. By default, only open alerts are ingested.
-   Dependabot severity filtering limits alerts to selected severities. By default, all severity levels are included.
-   Generic secret alerts, when enabled, increases the volume of secret scanning alerts by including generic patterns.

### Hierarchy of data retrieval

This integration uses many steps to retrieve data. Some of the steps depend on others. If there is a crash or error, it might be helpful to understand the hierarchy of step dependency:

-   The root step is `fetch-account`. All other steps depend on it.
-   There are four steps that depend only on `fetch-account` that could be considered primary steps. These are:
    1.  `fetch-apps`
    2.  `fetch-repos`
    3.  `fetch-users`
    4.  `fetch-teams`.
-   Other steps logically require multiple primary steps to complete. Examples include:
    -   `fetch-collaborators`
    -   `fetch-team-members`
    -   `fetch-team-repos`
-   Finally, some sophisticated steps require both primary steps and secondary steps before they can execute. For example, `fetch-prs` needs both `fetch-repos` and `fetch-collaborators` in order to properly label reviewers and approvers.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `github_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Github App | `github_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Github Branch Protection Rule | `github_branch_protection_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| GitHub Code Scanning Alerts | `github_code_scanning_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| GitHub Container Image | `github_container_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| GitHub Env Secret | `github_env_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Github Environment | `github_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| GitHub IP Range | `github_ip_range` | [IpRange](https://docs.jupiterone.io/data-model/schemas/IpRange) |
| Github Issue | `github_issue` | [Issue](https://docs.jupiterone.io/data-model/schemas/Issue) |
| Github Org Secret | `github_org_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| GitHub Organization Webhook | `github_org_webhook` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| GitHub Package | `github_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Github Pull Request | `github_pullrequest` | [PR](https://docs.jupiterone.io/data-model/schemas/PR) |
| Github Repo | `github_repo` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Github Repo Secret | `github_repo_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| GitHub Repository Webhook | `github_repo_webhook` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| GitHub Secret Scanning Alert | `github_secret_scanning_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Github Team | `github_team` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Github User | `github_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| GitHub Vulnerability Alert | `github_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| GitHub Vulnerability Alert | `github_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| GitHub Vulnerability Alert | `github_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Weakness](https://docs.jupiterone.io/data-model/schemas/Weakness) |
| Organization Role | `github_org_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Ruleset | `github_ruleset` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| Ruleset Rule | `github_ruleset_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `github_account` | **HAS** | `github_user` |
| `github_account` | **OWNS** | `github_repo` |
| `github_account` | **HAS** | `github_team` |
| `github_account` | **INSTALLED** | `github_app` |
| `github_account` | **HAS** | `github_org_secret` |
| `github_account` | **MANAGES** | `github_ruleset` |
| `github_account` | **MANAGES** | `github_org_role` |
| `github_account` | **ALLOWS** | `github_ip_range` |
| `github_account` | **HAS** | `github_package` |
| `github_account` | **HAS** | `github_container_image` |
| `github_account` | **HAS** | `github_org_webhook` |
| `github_app` | **OVERRIDES** | `github_branch_protection_rule` |
| `github_env_secret` | **OVERRIDES** | `github_org_secret` |
| `github_env_secret` | **OVERRIDES** | `github_repo_secret` |
| `github_environment` | **HAS** | `github_env_secret` |
| `github_finding` | **HAS** | `github_pullrequest` |
| `github_pullrequest` | **CONTAINS** | `github_pullrequest` |
| `github_repo` | **HAS** | `github_code_scanning_finding` |
| `github_repo` | **ALLOWS** | `github_user` |
| `github_repo` | **HAS** | `github_pullrequest` |
| `github_repo` | **HAS** | `github_issue` |
| `github_repo` | **HAS** | `github_environment` |
| `github_repo` | **USES** | `github_org_secret` |
| `github_repo` | **HAS** | `github_repo_secret` |
| `github_repo` | **USES** | `github_repo_secret` |
| `github_repo` | **USES** | `github_env_secret` |
| `github_repo` | **ALLOWS** | `github_team` |
| `github_repo` | **HAS** | `github_finding` |
| `github_repo` | **HAS** | `github_branch_protection_rule` |
| `github_repo` | **HAS** | `github_secret_scanning_finding` |
| `github_repo` | **HAS** | `github_package` |
| `github_repo` | **HAS** | `github_container_image` |
| `github_repo` | **HAS** | `github_repo_webhook` |
| `github_repo_secret` | **OVERRIDES** | `github_org_secret` |
| `github_ruleset` | **ENFORCES** | `github_repo` |
| `github_ruleset` | **HAS** | `github_ruleset_rule` |
| `github_team` | **HAS** | `github_user` |
| `github_team` | **OVERRIDES** | `github_branch_protection_rule` |
| `github_team` | **ASSIGNED** | `github_org_role` |
| `github_team` | **MANAGES** | `github_repo` |
| `github_user` | **MANAGES** | `github_account` |
| `github_user` | **APPROVED** | `github_pullrequest` |
| `github_user` | **OPENED** | `github_pullrequest` |
| `github_user` | **REVIEWED** | `github_pullrequest` |
| `github_user` | **UPDATED** | `github_pullrequest` |
| `github_user` | **CREATED** | `github_issue` |
| `github_user` | **ASSIGNED** | `github_issue` |
| `github_user` | **MANAGES** | `github_team` |
| `github_user` | **OVERRIDES** | `github_branch_protection_rule` |
| `github_user` | **ASSIGNED** | `github_org_role` |
| `github_user` | **MANAGES** | `github_repo` |
| `github_user` | **UPDATED** | `github_repo` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `github_finding` | **IS** | `cve` | FORWARD |
| `github_finding` | **EXPLOITS** | `cwe` | FORWARD |
| `github_issue` | **CREATED** | `github_user` | REVERSE |
| `github_issue` | **ASSIGNED** | `github_user` | REVERSE |
| `github_pullrequest` | **OPENED** | `github_user` | REVERSE |
| `github_pullrequest` | **REVIEWED** | `github_user` | REVERSE |
| `github_pullrequest` | **APPROVED** | `github_user` | REVERSE |

### Github Account

`github_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountType` \*

 | `string` |  |  |
| 

`databaseId` \*

 | `number` |  |  |
| 

`email` \*

 | `string` |  |  |
| 

`location` \*

 | `string` |  |  |
| 

`login` \*

 | `string` |  |  |
| 

`node` \*

 | `string` |  |  |
| 

`verified` \*

 | `boolean` |  |  |
| 

`websiteUrl` \*

 | `string` |  |  |

---

### Github App

`github_app` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`appId` \*

 | `number` |  |  |
| 

`appSlug` \*

 | `string` |  |  |
| 

`events` \*

 | `array` of `string`s |  |  |
| 

`hasMultipleSingleFiles` \*

 | `boolean` |  |  |
| 

`installationId` \*

 | `number` |  |  |
| `ownerLogin` | `string` | GitHub login of the user or organization that owns (publishes) the GitHub App |  |
| `ownerType` | `string` | Owner type returned by the API: User or Organization |  |
| `publisherUrl` | `string` | URL of the publisher's GitHub profile (e.g. [https://github.com/dependabot](https://github.com/dependabot)) |  |
| 

`repositorySelection` \*

 | `string` |  | **Any of**:

-   `all`

-   `selected`

 |
| 

`singleFileName` \*

 | `string` |  |  |
| 

`singleFilePaths` \*

 | `array` of `string`s |  |  |
| `suspendedBy` | `string` | GitHub login of the user who suspended the installation, if suspended |  |
| `suspendedOn` | `number` |  |  |
| 

`targetId` \*

 | `number` |  |  |
| 

`targetType` \*

 | `string` |  |  |

---

### Github Branch Protection Rule

`github_branch_protection_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`allowDeletions` \*

 | `boolean` |  |  |
| 

`allowForcePushes` \*

 | `boolean` |  |  |
| 

`blockCreations` \*

 | `boolean` |  |  |
| 

`enforceAdmins` \*

 | `boolean` |  |  |
| 

`requireCodeOwnerReviews` \*

 | `boolean` |  |  |
| 

`requiredApprovingReviewCount` \*

 | `number` **|** `null` |  |  |
| 

`requiredConversationResolution` \*

 | `boolean` |  |  |
| 

`requiredLinearHistory` \*

 | `boolean` |  |  |
| 

`requiredSignatures` \*

 | `boolean` |  |  |
| 

`requiredStatusChecks` \*

 | `array` of `string`s |  |  |

---

### Github Code Scanning Finding

`github_code_scanning_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `alertSeverity` | `string` |  |  |
| `cwe` | `array` **|** `null` |  |  |
| `dismissedComment` | `string` **|** `null` |  |  |
| `dismissedOn` | `number` |  |  |
| 
`dismissedReason` \*

 | `string` **|** `null` |  | **Any of**:

-   `false positive`

-   `won't fix`

-   `used in tests`

-   `undefined`

 |
| `fixedOn` | `number` |  |  |
| 

`number` \*

 | `number` |  |  |
| `path` | `string` |  |  |
| `ruleTags` | `array` **|** `null` |  |  |
| 

`state` \*

 | `string` |  |  |
| `toolName` | `string` |  |  |
| `toolVersion` | `string` **|** `null` |  |  |
| 

`weblink` \*

 | `string` |  |  |

---

### Github Container Image

`github_container_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`digest` \*

 | `string` **|** `null` |  |  |
| 

`fullName` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`packageId` \*

 | `number` |  |  |
| 

`packageName` \*

 | `string` |  |  |
| 

`packageType` \*

 | `string` |  | **const**: container |
| 

`repositoryId` \*

 | `number` **|** `null` |  |  |
| 

`repositoryName` \*

 | `string` **|** `null` |  |  |
| 

`repositoryNodeId` \*

 | `string` **|** `null` |  |  |
| 

`tags` \*

 | `array` **|** `null` |  |  |
| 

`versionId` \*

 | `number` |  |  |
| 

`visibility` \*

 | `string` |  | **Any of**:

-   `public`

-   `private`

-   `internal`

 |

---

### Github Env Secret

`github_env_secret` inherits from [Secret](/data-model/schemas/Secret.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`visibility` \*

 | `string` |  | **const**: selected |

---

### Github Environment

`github_environment` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`htmlUrl` \*

 | `string` |  |  |
| 

`nodeId` \*

 | `string` |  |  |
| 

`parentRepoDatabaseId` \*

 | `string` |  |  |
| 

`parentRepoKey` \*

 | `string` |  |  |
| 

`parentRepoName` \*

 | `string` |  |  |
| 

`protectionRulesExist` \*

 | `boolean` |  |  |
| 

`url` \*

 | `string` |  |  |

---

### Github Finding

`github_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `databaseId` | `number` |  |  |
| `dependencyScope` | `string` |  | **Any of**:
-   `RUNTIME`

-   `DEVELOPMENT`

 |
| `dismissedOn` | `number` |  |  |
| `dismisserLogin` | `string` |  |  |
| `dismissReason` | `string` **|** `null` |  |  |
| `fixedOn` | `number` |  |  |
| `ghsaId` | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| `number` | `number` |  |  |
| `origin` | `string` |  |  |
| `securityAdvisoryPublishedOn` | `number` |  |  |
| `securityAdvisoryUpdatedOn` | `number` |  |  |
| `securityAdvisoryWithdrawnOn` | `number` |  |  |
| 

`vulnerableManifestFilename` \*

 | `string` |  |  |
| 

`vulnerableManifestPath` \*

 | `string` |  |  |
| `vulnerablePackageEcosystem` | `string` |  |  |
| `vulnerablePackageName` | `string` |  |  |
| 

`vulnerableRequirements` \*

 | `string` |  |  |
| `vulnerableVersionRange` | `string` |  |  |
| 

`weblink` \*

 | `string` |  |  |

---

### Github Finding

`github_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `databaseId` | `number` |  |  |
| `dependencyScope` | `string` |  | **Any of**:
-   `RUNTIME`

-   `DEVELOPMENT`

 |
| `dismissedOn` | `number` |  |  |
| `dismisserLogin` | `string` |  |  |
| `dismissReason` | `string` **|** `null` |  |  |
| `fixedOn` | `number` |  |  |
| `ghsaId` | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| `number` | `number` |  |  |
| `origin` | `string` |  |  |
| `securityAdvisoryPublishedOn` | `number` |  |  |
| `securityAdvisoryUpdatedOn` | `number` |  |  |
| `securityAdvisoryWithdrawnOn` | `number` |  |  |
| 

`vulnerableManifestFilename` \*

 | `string` |  |  |
| 

`vulnerableManifestPath` \*

 | `string` |  |  |
| `vulnerablePackageEcosystem` | `string` |  |  |
| `vulnerablePackageName` | `string` |  |  |
| 

`vulnerableRequirements` \*

 | `string` |  |  |
| `vulnerableVersionRange` | `string` |  |  |
| 

`weblink` \*

 | `string` |  |  |

---

### Github Finding

`github_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Weakness](/data-model/schemas/Weakness.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `databaseId` | `number` |  |  |
| `dependencyScope` | `string` |  | **Any of**:
-   `RUNTIME`

-   `DEVELOPMENT`

 |
| `dismissedOn` | `number` |  |  |
| `dismisserLogin` | `string` |  |  |
| `dismissReason` | `string` **|** `null` |  |  |
| `fixedOn` | `number` |  |  |
| `ghsaId` | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| `number` | `number` |  |  |
| `origin` | `string` |  |  |
| `securityAdvisoryPublishedOn` | `number` |  |  |
| `securityAdvisoryUpdatedOn` | `number` |  |  |
| `securityAdvisoryWithdrawnOn` | `number` |  |  |
| 

`vulnerableManifestFilename` \*

 | `string` |  |  |
| 

`vulnerableManifestPath` \*

 | `string` |  |  |
| `vulnerablePackageEcosystem` | `string` |  |  |
| `vulnerablePackageName` | `string` |  |  |
| 

`vulnerableRequirements` \*

 | `string` |  |  |
| `vulnerableVersionRange` | `string` |  |  |
| 

`weblink` \*

 | `string` |  |  |

---

### Github Ip Range

`github_ip_range` inherits from [IpRange](/data-model/schemas/IpRange.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Github Issue

`github_issue` inherits from [Issue](/data-model/schemas/Issue.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activeLockReason` | `string` **|** `null` |  | **Any of**:
-   `OFF_TOPIC`

-   `TOO_HEATED`

-   `RESOLVED`

-   `SPAM`

-   `undefined`

 |
| 

`authorAssociation` \*

 | `string` |  |  |
| `body` | `string` |  |  |
| 

`closed` \*

 | `boolean` |  |  |
| `closedOn` | `number` |  |  |
| 

`createdViaEmail` \*

 | `boolean` |  |  |
| 

`databaseId` \*

 | `number` |  |  |
| 

`labels` \*

 | `array` of `string`s |  |  |
| `lastEditedOn` | `number` |  |  |
| 

`locked` \*

 | `boolean` |  |  |
| 

`number` \*

 | `number` |  |  |
| 

`pinned` \*

 | `boolean` |  |  |
| `publishedOn` | `number` |  |  |
| 

`resourcePath` \*

 | `string` |  |  |
| 

`state` \*

 | `string` |  |  |
| 

`title` \*

 | `string` |  |  |
| 

`url` \*

 | `string` |  |  |

---

### Github Org Role

`github_org_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `baseRole` | `string` **|** `null` |  |  |
| 
`permissions` \*

 | `array` of `string`s |  |  |
| `source` | `string` **|** `null` |  | **Any of**:

-   `Organization`

-   `Enterprise`

-   `Predefined`

-   `undefined`

 |

---

### Github Org Secret

`github_org_secret` inherits from [Secret](/data-model/schemas/Secret.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `selectedRepositoriesLink` | `string` |  |  |
| `visibility` | `string` |  |  |

---

### Github Org Webhook

`github_org_webhook` inherits from [ApplicationEndpoint](/data-model/schemas/ApplicationEndpoint.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`active` \*

 | `boolean` |  |  |
| `contentType` | `string` |  |  |
| 

`events` \*

 | `array` of `string`s |  |  |
| 

`hasSecret` \*

 | `boolean` |  |  |
| 

`insecureSsl` \*

 | `boolean` |  |  |
| `url` | `string` |  |  |
| 

`webhookId` \*

 | `number` |  |  |

---

### Github Package

`github_package` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`packageId` \*

 | `number` |  |  |
| 

`packageType` \*

 | `string` | Examples: npm, maven, rubygems, nuget. |  |
| 

`repositoryId` \*

 | `number` **|** `null` |  |  |
| 

`repositoryName` \*

 | `string` **|** `null` |  |  |
| 

`repositoryNodeId` \*

 | `string` **|** `null` |  |  |
| 

`versionCount` \*

 | `number` **|** `null` |  |  |
| 

`visibility` \*

 | `string` |  | **Any of**:

-   `public`

-   `private`

-   `internal`

 |

---

### Github Pullrequest

`github_pullrequest` inherits from [PR](/data-model/schemas/PR.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountLogin` \*

 | `string` |  |  |
| `allCommitsApproved` | `boolean` | Indicates whether all commits in the pull request are approved. Not available for private repositories. |  |
| `approvalLastAt` | `number` |  |  |
| 

`approvalsCount` \*

 | `number` |  |  |
| 

`approverLogins` \*

 | `array` of `string`s |  |  |
| `approvers` | `array` of `string`s |  |  |
| 

`author` \*

 | `string` |  |  |
| 

`authorLogin` \*

 | `string` |  |  |
| `closedOn` | `number` |  |  |
| `commitMessages` | `array` of `string`s | Commit messages corresponding to each commit in the pull request. Not available for private repositories. |  |
| 

`commits` \*

 | `array` of `string`s | List of commit hashes included in the pull request. Not available for private repositories. |  |
| `commitsApproved` | `array` of `string`s | List of commit hashes that have been approved. Not available for private repositories. |  |
| `commitsByUnknownAuthor` | `array` of `string`s | List of commit hashes authored by users not found in the graph. Not available for private repositories. |  |
| 

`commitsCount` \*

 | `number` | Total number of commits in the pull request. Not available for private repositories. |  |
| 

`commitsNotApproved` \*

 | `array` of `string`s | List of commit hashes that have not been approved. Not available for private repositories. |  |
| `databaseId` | `number` |  |  |
| 

`declined` \*

 | `boolean` |  |  |
| 

`filesChangedCount` \*

 | `number` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`labels` \*

 | `array` of `string`s |  |  |
| `mergeCommitHash` | `string` |  |  |
| 

`merged` \*

 | `boolean` |  |  |
| `mergedBy` | `string` |  |  |
| `mergedByLogin` | `string` |  |  |
| `mergedOn` | `number` |  |  |
| 

`node` \*

 | `string` |  |  |
| 

`number` \*

 | `number` |  |  |
| 

`pullRequestId` \*

 | `string` |  |  |
| `reviewDecision` | `string` **|** `null` |  | **Any of**:

-   `APPROVED`

-   `CHANGES_REQUESTED`

-   `REVIEW_REQUIRED`

-   `undefined`

 |
| 

`reviewerLogins` \*

 | `array` of `string`s |  |  |
| 

`reviewers` \*

 | `array` of `string`s |  |  |
| 

`sourceRefOid` \*

 | `string` |  |  |
| 

`targetRefOid` \*

 | `string` |  |  |

---

### Github Repo

`github_repo` inherits from [CodeRepo](/data-model/schemas/CodeRepo.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `archived` | `boolean` |  |  |
| `autoMergeAllowed` | `boolean` |  |  |
| `databaseId` | `number` |  |  |
| `deleteBranchOnMerge` | `boolean` |  |  |
| `disabled` | `boolean` |  |  |
| `empty` | `boolean` |  |  |
| `fork` | `boolean` |  |  |
| `forkCount` | `number` |  |  |
| `forkingAllowed` | `boolean` |  |  |
| 
`fullName` \*

 | `string` |  |  |
| 

`homepageUrl` \*

 | `string` |  |  |
| `inOrganization` | `boolean` |  |  |
| `locked` | `boolean` |  |  |
| 

`lockReason` \*

 | `string` |  |  |
| `mergeCommitAllowed` | `boolean` |  |  |
| `mirror` | `boolean` |  |  |
| 

`node` \*

 | `string` |  |  |
| `pushedOn` | `number` |  |  |
| `rebaseMergeAllowed` | `boolean` |  |  |
| `securityPolicyEnabled` | `boolean` |  |  |
| `template` | `boolean` |  |  |
| `userConfigurationRepository` | `boolean` |  |  |
| 

`visibility` \*

 | `string` |  | **Any of**:

-   `INTERNAL`

-   `PRIVATE`

-   `PUBLIC`

 |

---

### Github Repo Secret

`github_repo_secret` inherits from [Secret](/data-model/schemas/Secret.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`visibility` \*

 | `string` |  | **const**: selected |

---

### Github Repo Webhook

`github_repo_webhook` inherits from [ApplicationEndpoint](/data-model/schemas/ApplicationEndpoint.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`active` \*

 | `boolean` |  |  |
| `contentType` | `string` |  |  |
| 

`events` \*

 | `array` of `string`s |  |  |
| 

`hasSecret` \*

 | `boolean` |  |  |
| 

`insecureSsl` \*

 | `boolean` |  |  |
| `url` | `string` |  |  |
| 

`webhookId` \*

 | `number` |  |  |

---

### Github Ruleset

`github_ruleset` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`enforcement` \*

 | `string` |  | **Any of**:

-   `DISABLED`

-   `ACTIVE`

-   `EVALUATE`

 |
| 

`source` \*

 | `string` |  | **Any of**:

-   `Enterprise`

-   `Repository`

-   `Organization`

 |
| `target` | `string` |  | **Any of**:

-   `BRANCH`

-   `TAG`

-   `PUSH`

-   `REPOSITORY`

 |

---

### Github Ruleset Rule

`github_ruleset_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowedMergeMethods` | `array` of `string`s |  |  |
| `checkResponseTimeoutMinutes` | `number` |  |  |
| `codeScanningTools` | `array` of `string`s |  |  |
| `dismissStaleReviewsOnPush` | `boolean` |  |  |
| `doNotEnforceOnCreate` | `boolean` |  |  |
| `groupingStrategy` | `string` |  | **Any of**:
-   `ALLGREEN`

-   `HEADGREEN`

 |
| `maxEntriesToBuild` | `number` |  |  |
| `maxEntriesToMerge` | `number` |  |  |
| `maxFilePathLength` | `number` |  |  |
| `maxFileSize` | `number` |  |  |
| `mergeMethod` | `string` |  | **Any of**:

-   `MERGE`

-   `SQUASH`

-   `REBASE`

 |
| `minEntriesToMerge` | `number` |  |  |
| `minEntriesToMergeWaitMinutes` | `number` |  |  |
| `negate` | `boolean` |  |  |
| `operator` | `string` |  |  |
| `pattern` | `string` |  |  |
| `requireCodeOwnerReview` | `boolean` |  |  |
| `requiredApprovingReviewCount` | `number` |  |  |
| `requiredDeploymentEnvironments` | `array` of `string`s |  |  |
| `requiredReviewThreadResolution` | `boolean` |  |  |
| `requireLastPushApproval` | `boolean` |  |  |
| `restrictedFileExtensions` | `array` of `string`s |  |  |
| `restrictedFilePaths` | `array` of `string`s |  |  |
| `statusChecks` | `array` of `string`s |  |  |
| `strictRequiredStatusChecksPolicy` | `boolean` |  |  |
| 

`type` \*

 | `string` |  | **Any of**:

-   `AUTHORIZATION`

-   `BRANCH_NAME_PATTERN`

-   `CODE_SCANNING`

-   `COMMITTER_EMAIL_PATTERN`

-   `COMMIT_AUTHOR_EMAIL_PATTERN`

-   `COMMIT_MESSAGE_PATTERN`

-   `CREATION`

-   `DELETION`

-   `FILE_EXTENSION_RESTRICTION`

-   `FILE_PATH_RESTRICTION`

-   `LOCK_BRANCH`

-   `MAX_FILE_PATH_LENGTH`

-   `MAX_FILE_SIZE`

-   `MAX_REF_UPDATES`

-   `MERGE_QUEUE`

-   `MERGE_QUEUE_LOCKED_REF`

-   `NON_FAST_FORWARD`

-   `PULL_REQUEST`

-   `REQUIRED_DEPLOYMENTS`

-   `REQUIRED_LINEAR_HISTORY`

-   `REQUIRED_REVIEW_THREAD_RESOLUTION`

-   `REQUIRED_SIGNATURES`

-   `REQUIRED_STATUS_CHECKS`

-   `REQUIRED_WORKFLOW_STATUS_CHECKS`

-   `SECRET_SCANNING`

-   `TAG_NAME_PATTERN`

-   `UPDATE`

-   `WORKFLOWS`

-   `WORKFLOW_UPDATES`

 |
| `updateAllowsFetchAndMerge` | `boolean` |  |  |
| `workflows` | `array` of `string`s |  |  |

---

### Github Secret Scanning Finding

`github_secret_scanning_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`number` \*

 | `number` |  |  |
| `pushProtectionBypassed` | `boolean` **|** `null` |  |  |
| `pushProtectionBypassedBy` | `string` |  |  |
| `pushProtectionBypassedOn` | `number` |  |  |
| `resolution` | `string` **|** `null` |  | **Any of**:

-   `false_positive`

-   `wont_fix`

-   `revoked`

-   `used_in_tests`

-   `undefined`

 |
| `resolutionComment` | `string` **|** `null` |  |  |
| `resolvedBy` | `string` |  |  |
| `resolvedOn` | `number` |  |  |
| `secretType` | `string` |  |  |
| `secretTypeDisplayName` | `string` |  |  |
| `state` | `string` |  | **Any of**:

-   `open`

-   `resolved`

 |

---

### Github Team

`github_team` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`databaseId` \*

 | `number` |  |  |
| 

`fullName` \*

 | `string` |  |  |
| 

`node` \*

 | `string` |  |  |
| 

`privacy` \*

 | `string` |  |  |

---

### Github User

`github_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`company` \*

 | `string` |  |  |
| 

`databaseId` \*

 | `number` |  |  |
| 

`employee` \*

 | `boolean` |  |  |
| 

`location` \*

 | `string` |  |  |
| 

`login` \*

 | `string` |  |  |
| 

`node` \*

 | `string` |  |  |
| 

`organizationId` \*

 | `string` |  |  |
| 

`role` \*

 | `string` |  |  |
| 

`siteAdmin` \*

 | `boolean` |  |  |
| 

`websiteUrl` \*

 | `string` |  |  |

---

## Release Notes

-   **2026-05-29** — GitHub integration now supports fine-grained personal access tokens as an authentication option, in addition to classic tokens and GitHub Apps.
-   **2026-04-28** — GitHub users who have recently committed to a repository are now linked to that repository, enabling commit activity analysis.
-   **2026-03-10** — Added webhook entity ingestion for both repositories and organizations, exposing webhook configurations as repository webhook and organization webhook entities.
-   **2026-02-27** — Disambiguated GitHub repository to user access relationships by access source (direct, team, or outside collaborator), enabling more precise permission queries.
-   **2026-01-14** — Added ingestion of repository CODEOWNERS file content and relationships to the owning users and teams.
-   **2025-12-16** — Added ingestion of GitHub Packages and container images as package entities with repository relationships.
-   **2025-10-29** — Added configuration option to limit the maximum number of repositories fetched during GitHub ingestion, useful for large organizations.
-   **2025-09-03** — Added ability to ingest and query GitHub repository Custom Properties as entity properties.
-   **2025-08-28** — Added finding to pull request relationships linking secret scanning and Dependabot findings to their associated pull requests.
-   **2025-07-08** — Added ingestion of GitHub secret scanning generic alerts as secret alert entities.
-   **2025-06-09** — Added configuration option to fetch collaborators via REST API as an alternative to GraphQL.
-   **2025-05-19** — Added allowed IP addresses of the GitHub organization as a queryable property on GitHub organization entities.
-   **2025-05-16** — Added user to pull request update relationship tracking PR update activity.
-   **2025-04-09** — Added Jira user to issue assignment relationship (backport from Jira integration for cross-integration linking).

---

Source: /integrations/directory/gitlab

# GitLab

Visualize GitLab users, groups, code repositories, and merge requests, map GitLab users to employees and development/security trainings, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> To use this integration, JupiterOne requires a [GitLab personal access token](https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html.) configured with read access (`read_api` scope) and the API base URL, such as [https://gitlab.com](https://gitlab.com)).

### Configuration in JupiterOne

To install the GitLab integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select GitLab. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **Account Name** by which you'd like to identify this GitLab account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is selected.
    
-   **Description** that will further assist your team when identifying the integration instance.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Personal Access Token** configured for read access in GitLab.
    

> **NOTE**
> 
> Once your token has expired, the integration will no longer run successfully, and the token will be revoked from your GitLab account. You will need to create another token to replace the expired one.

-   Your GitLab **API Base URL** (e.g., `https://gitlab.com`, or your self-managed instance URL).

## Data Volume Configuration

Control how much data is ingested from GitLab to manage storage and processing.

### Ingestion Windows (Time Ranges)

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Merge Requests Ingestion Window** | Ingestion window for updated merge requests (days ago) | 90 | 90, 180, 275, 365 |

**How it affects data volume:** Longer windows increase the number of merge requests ingested from GitLab.

### Data Filtering Options

| Field | Type | Description | Default |
| --- | --- | --- | --- |
| **Included Vulnerability Severities** | Multi-select | Select vulnerability severities to ingest | Medium, High, Critical |
| **Included Vulnerability States** | Multi-select | Select vulnerability states to ingest | Confirmed, Detected |
| **Included Vulnerability Report Types** | Multi-select | Select vulnerability report types to ingest | None (all disabled by default) |
| **Ingest Regular Users Only** | Boolean | Skip all bot accounts including project and group bots | `false` |

**How it affects data volume:**

-   Severity filtering reduces vulnerabilities by excluding lower-severity findings. By default, only Medium, High, and Critical severabilities are ingested.
-   State filtering limits vulnerabilities to selected states. By default, only Confirmed and Detected vulnerabilities are ingested (Dismissed and Resolved are excluded).
-   Report type filtering allows selecting specific vulnerability scan types (SAST, DAST, Container Scanning, etc.). By default, all types are disabled and must be explicitly enabled.
-   User filtering, when enabled, excludes bot accounts from ingestion, reducing the number of user entities.

Click **Create** after all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (4)

-   `Developer`
-   `Guest`
-   `Maintainer`
-   `Reporter`

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (2)

-   `read_api`
-   `read_user`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (7)

-   `/api/graphql`
-   `/api/v4/projects/:id/pipelines`
-   `/api/v4/projects/:id/pipelines/:pipeline_id`
-   `/api/v4/projects/:id/pipelines/:pipeline_id/jobs`
-   `/api/v4/projects/:id/vulnerability_findings`
-   `/api/v4/users`
-   `/api/v4/users/:id`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (12)

-   [https://docs.gitlab.com/ee/api/graphql/reference/#groups](https://docs.gitlab.com/ee/api/graphql/reference/#groups)
-   [https://docs.gitlab.com/ee/api/graphql/reference/#mergerequestcommits](https://docs.gitlab.com/ee/api/graphql/reference/#mergerequestcommits)
-   [https://docs.gitlab.com/ee/api/graphql/reference/#projectbranchrules](https://docs.gitlab.com/ee/api/graphql/reference/#projectbranchrules)
-   [https://docs.gitlab.com/ee/api/graphql/reference/#querycurrentuser](https://docs.gitlab.com/ee/api/graphql/reference/#querycurrentuser)
-   [https://docs.gitlab.com/ee/api/graphql/reference/#querymetadata](https://docs.gitlab.com/ee/api/graphql/reference/#querymetadata)
-   [https://docs.gitlab.com/ee/api/jobs.html](https://docs.gitlab.com/ee/api/jobs.html)
-   [https://docs.gitlab.com/ee/api/labels.html](https://docs.gitlab.com/ee/api/labels.html)
-   [https://docs.gitlab.com/ee/api/merge\_requests.html](https://docs.gitlab.com/ee/api/merge_requests.html)
-   [https://docs.gitlab.com/ee/api/pipelines.html](https://docs.gitlab.com/ee/api/pipelines.html)
-   [https://docs.gitlab.com/ee/api/projects.html](https://docs.gitlab.com/ee/api/projects.html)
-   [https://docs.gitlab.com/ee/api/users.html](https://docs.gitlab.com/ee/api/users.html)
-   [https://docs.gitlab.com/ee/api/vulnerability\_findings.html](https://docs.gitlab.com/ee/api/vulnerability_findings.html)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (9)

| Step | Roles | OAuth Scopes | Endpoints |
| --- | --- | --- | --- |
| Fetch Branch Rules | `Maintainer` | `read_api` | `/api/graphql` |
| Fetch CI jobs | `Reporter` | `read_api` | `/api/v4/projects/:id/pipelines/:pipeline_id/jobs` |
| Fetch merge requests | `Reporter` | `read_api` | `/api/graphql` |
| Fetch MR commits | `Reporter` | `read_api` | `/api/graphql` |
| Fetch pipelines | `Reporter` | `read_api` | `/api/v4/projects/:id/pipelines`, `/api/v4/projects/:id/pipelines/:pipeline_id` |
| Fetch Project Labels | `Guest` | `read_api` | `/api/graphql` |
| Fetch projects | `Guest` | `read_api` | `/api/graphql` |
| Fetch users | `Reporter` | `read_user`, `read_api` | `/api/graphql`, `/api/v4/users`, `/api/v4/users/:id` |
| Fetch Vulnerability Findings | `Developer` | `read_api` | `/api/graphql`, `/api/v4/projects/:id/vulnerability_findings` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `gitlab_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Branch Rule | `gitlab_branch_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| CI Job | `gitlab_ci_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Commit | `gitlab_commit` | [CodeCommit](https://docs.jupiterone.io/data-model/schemas/CodeCommit) |
| Finding | `gitlab_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Group | `gitlab_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Label | `gitlab_label` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Merge Request | `gitlab_merge_request` | [CodeReview](https://docs.jupiterone.io/data-model/schemas/CodeReview), [PR](https://docs.jupiterone.io/data-model/schemas/PR) |
| Pipeline | `gitlab_pipeline` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| Project | `gitlab_project` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo), [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| User | `gitlab_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `gitlab_account` | **HAS** | `gitlab_group` |
| `gitlab_account` | **HAS** | `gitlab_project` |
| `gitlab_group` | **HAS** | `gitlab_group` |
| `gitlab_group` | **HAS** | `gitlab_project` |
| `gitlab_group` | **HAS** | `gitlab_user` |
| `gitlab_merge_request` | **HAS** | `gitlab_commit` |
| `gitlab_merge_request` | **HAS** | `gitlab_pipeline` |
| `gitlab_pipeline` | **HAS** | `gitlab_ci_job` |
| `gitlab_project` | **HAS** | `gitlab_user` |
| `gitlab_project` | **HAS** | `gitlab_finding` |
| `gitlab_project` | **HAS** | `gitlab_merge_request` |
| `gitlab_project` | **HAS** | `gitlab_label` |
| `gitlab_project` | **HAS** | `gitlab_branch_rule` |
| `gitlab_project` | **HAS** | `gitlab_pipeline` |
| `gitlab_user` | **APPROVED** | `gitlab_merge_request` |
| `gitlab_user` | **OPENED** | `gitlab_merge_request` |

### Gitlab Account

`gitlab_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`enterprise` \*

 | `boolean` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`revision` \*

 | `string` |  |  |
| 

`vendor` \*

 | `string` |  |  |
| 

`version` \*

 | `string` |  |  |

---

### Gitlab Branch Rule

`gitlab_branch_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowForcePush` | `boolean` |  |  |
| `codeOwnerApprovalRequired` | `boolean` |  |  |
| `createdOn` | `number` |  |  |
| 
`id` \*

 | `string` |  |  |
| 

`isDefault` \*

 | `boolean` |  |  |
| 

`isProtected` \*

 | `boolean` |  |  |
| 

`matchingBranchesCount` \*

 | `number` |  |  |
| 

`name` \*

 | `string` |  |  |
| `updatedOn` | `number` |  |  |

---

### Gitlab Ci Job

`gitlab_ci_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `artifactFileTypes` | `array` of `string`s | List of artifact file types produced by the job (e.g. archive, metadata, trace). |  |
| `artifactsExpireOn` | `number` | Timestamp when this job's artifacts expire. |  |
| `coverage` | `number` | Reported test coverage percentage for the job, if configured. |  |
| `duration` | `number` | Job execution duration in seconds. |  |
| `erasedOn` | `number` | Timestamp the job log was erased, if it was (audit signal). |  |
| `failureReason` | `string` | GitLab-provided enum describing why the job failed (e.g. script\_failure, runner\_system\_failure). |  |
| `finishedOn` | `number` | Timestamp the job finished (epoch millis). |  |
| `hasArtifacts` | `boolean` | True when the job produced one or more artifacts. |  |
| `isAllowedToFail` | `boolean` | True if the job is permitted to fail without failing the pipeline. |  |
| `isArchived` | `boolean` | True when the job has been archived. |  |
| `isRunnerActive` | `boolean` | True when the runner is active. |  |
| `isRunnerShared` | `boolean` | True when the runner is shared (cross-project pool). |  |
| `isTag` | `boolean` | True when the job ran for a Git tag. |  |
| 
`pipelineId` \*

 | `number` | Numeric ID of the pipeline this job belongs to. |  |
| 

`projectId` \*

 | `number` | Numeric ID of the project this job belongs to. Used in \_key for global uniqueness. |  |
| `queuedDuration` | `number` | Time the job spent queued before starting, in seconds. |  |
| `ref` | `string` | Branch or tag this job ran against. |  |
| `runnerDescription` | `string` | Human-readable description of the runner that executed the job. |  |
| `runnerId` | `number` | Numeric ID of the runner that executed the job (if any). |  |
| `runnerType` | `string` | Runner scope: instance\_type, group\_type, or project\_type. |  |
| `sha` | `string` | Commit SHA the job ran against. |  |
| `source` | `string` | Trigger source for the parent pipeline (push, schedule, merge\_request\_event, ...). |  |
| `stage` | `string` | CI stage the job belongs to (e.g. build, test, deploy). |  |
| `startedOn` | `number` | Timestamp the job started executing (epoch millis). |  |
| `tagList` | `array` of `string`s | Runner tags requested by the job (.gitlab-ci.yml `tags`). |  |
| `userId` | `number` | Numeric ID of the user who triggered the job. |  |
| `userUsername` | `string` | Username of the user who triggered the job. |  |

---

### Gitlab Commit

`gitlab_commit` inherits from [CodeCommit](/data-model/schemas/CodeCommit.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authoredOn` | `number` |  |  |
| `authorEmail` | `string` |  |  |
| `authorName` | `string` |  |  |
| 
`branch` \*

 | `string` |  |  |
| `committedOn` | `number` |  |  |
| `committerEmail` | `string` |  |  |
| `committerName` | `string` |  |  |
| 

`commitWebLink` \*

 | `string` |  |  |
| `createdOn` | `number` |  | **deprecated**: true |
| 

`id` \*

 | `string` |  |  |
| 

`merge` \*

 | `boolean` |  |  |
| 

`message` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`shortId` \*

 | `string` |  |  |
| `title` | `string` |  |  |
| 

`versionBump` \*

 | `boolean` |  |  |
| 

`webLink` \*

 | `string` |  |  |

---

### Gitlab Finding

`gitlab_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`createVulnerabilityFeedbackDismissalPath` \*

 | `string` |  | **deprecated**: true |
| 

`createVulnerabilityFeedbackIssuePath` \*

 | `string` |  | **deprecated**: true |
| 

`createVulnerabilityFeedbackMergeRequestPath` \*

 | `string` |  | **deprecated**: true |
| `description` | `string` |  |  |
| `dismissalFeedback` | `string` |  | **deprecated**: true |
| `dismissalReason` | `string` |  |  |
| `falsePositive` | `boolean` |  |  |
| `identifiers` | `array` of `string`s |  |  |
| `links` | `array` of `string`s |  |  |
| `projectFingerprint` | `string` |  | **deprecated**: true |
| `reportType` | `string` |  |  |
| `scanner.externalId` | `string` |  |  |
| `scanner.name` | `string` |  |  |
| `scanner.vendor` | `string` |  |  |
| `solution` | `string` |  |  |
| `state` | `string` |  |  |
| `uuid` | `string` |  |  |
| `vulnerabilityPath` | `string` |  |  |

---

### Gitlab Group

`gitlab_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `autoDevopsEnabled` | `boolean` |  |  |
| `createdOn` | `number` |  |  |
| `description` | `string` |  |  |
| `emailsDisabled` | `boolean` |  |  |
| 
`fullName` \*

 | `string` |  |  |
| 

`fullPath` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| `lfsEnabled` | `boolean` |  |  |
| `mentionsDisabled` | `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| `parentGroupId` | `string` |  |  |
| 

`path` \*

 | `string` |  |  |
| `projectCreationLevel` | `string` |  |  |
| `requestAccessEnabled` | `boolean` |  |  |
| `requireTwoFactorAuthentication` | `boolean` |  |  |
| `shareWithGroupLock` | `boolean` |  |  |
| `subgroupCreationLevel` | `string` |  |  |
| `twoFactorGracePeriod` | `number` |  |  |
| `visibility` | `string` |  |  |
| 

`webUrl` \*

 | `string` |  |  |

---

### Gitlab Label

`gitlab_label` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`color` \*

 | `string` |  |  |
| `description` | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lockOnMerge` \*

 | `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`textColor` \*

 | `string` |  |  |

---

### Gitlab Merge Request

`gitlab_merge_request` inherits from [CodeReview](/data-model/schemas/CodeReview.md), [PR](/data-model/schemas/PR.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowCollaboration` | `boolean` |  |  |
| 
`approved` \*

 | `boolean` |  |  |
| 

`approverIds` \*

 | `array` of `string`s |  |  |
| 

`approverLogins` \*

 | `array` of `string`s |  |  |
| 

`approvers` \*

 | `array` of `string`s |  |  |
| `authorId` | `string` |  |  |
| `authorLogin` | `string` |  |  |
| `authorName` | `string` |  |  |
| `closedOn` | `number` |  |  |
| `commitWebLink` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `forceRemoveSourceBranch` | `boolean` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`iid` \*

 | `string` |  |  |
| `mergeCommitSha` | `string` |  |  |
| `mergedOn` | `number` |  |  |
| `mergeWhenPipelineSucceeds` | `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`projectId` \*

 | `number` |  |  |
| 

`repository` \*

 | `string` |  |  |
| `sha` | `string` |  |  |
| `shouldRemoveSourceBranch` | `boolean` |  |  |
| 

`source` \*

 | `string` |  |  |
| 

`squash` \*

 | `boolean` |  |  |
| 

`state` \*

 | `string` |  |  |
| 

`target` \*

 | `string` |  |  |
| 

`title` \*

 | `string` |  |  |
| `updatedOn` | `number` |  |  |
| `webLink` | `string` |  |  |

---

### Gitlab Pipeline

`gitlab_pipeline` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `beforeSha` | `string` | Previous commit SHA prior to the pipeline run. |  |
| `committedOn` | `number` | Timestamp of the commit that triggered the pipeline (epoch millis). |  |
| `coverage` | `number` | Reported test coverage percentage (0-100), if a coverage parser is configured. |  |
| `duration` | `number` | Pipeline execution duration in seconds. |  |
| `finishedOn` | `number` | Timestamp the pipeline finished (epoch millis). |  |
| `iid` | `string` | Project-internal pipeline number (visible in GitLab UI). |  |
| `isArchived` | `boolean` | True when the pipeline has been archived. |  |
| `isTag` | `boolean` | True when the pipeline ran for a Git tag rather than a branch. |  |
| 
`projectId` \*

 | `number` | Numeric ID of the project this pipeline belongs to. Used in \_key for global uniqueness. |  |
| `queuedDuration` | `number` | Time the pipeline spent queued before starting, in seconds. |  |
| `ref` | `string` | Branch or tag name this pipeline ran against. |  |
| `sha` | `string` | Head commit SHA the pipeline ran against. |  |
| `source` | `string` | Trigger source (push, web, schedule, api, merge\_request\_event, etc.). |  |
| `startedOn` | `number` | Timestamp the pipeline started running (epoch millis). |  |
| `triggeredByUserId` | `number` | Numeric ID of the user who triggered the pipeline. |  |
| `triggeredByUsername` | `string` | Username of the user who triggered the pipeline. |  |
| `yamlErrors` | `string` | YAML parse/validation errors that prevented the pipeline from running, if any. |  |

---

### Gitlab Project

`gitlab_project` inherits from [CodeRepo](/data-model/schemas/CodeRepo.md), [Project](/data-model/schemas/Project.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`allowMergeOnSkippedPipeline` \*

 | `boolean` |  |  |
| `archived` | `boolean` |  |  |
| `autocloseReferencedIssues` | `boolean` |  |  |
| `containerRegistryEnabled` | `boolean` |  |  |
| `createdOn` | `number` |  |  |
| `description` | `string` |  |  |
| 

`fullName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| `issuesEnabled` | `boolean` |  |  |
| `jobsEnabled` | `boolean` |  |  |
| `mergeRequestsEnabled` | `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| `onlyAllowMergeIfAllDiscussionsAreResolved` | `boolean` |  |  |
| `onlyAllowMergeIfPipelineSucceeds` | `boolean` |  |  |
| 

`public` \*

 | `boolean` |  |  |
| `publicJobs` | `boolean` |  |  |
| `removeSourceBranchAfterMerge` | `boolean` |  |  |
| `requestAccessEnabled` | `boolean` |  |  |
| `sharedRunnersEnabled` | `boolean` |  |  |
| `snippetsEnabled` | `boolean` |  |  |
| 

`topics` \*

 | `array` of `string`s |  |  |
| `visibility` | `string` |  |  |
| `webLink` | `string` |  |  |
| `wikiEnabled` | `boolean` |  |  |

---

### Gitlab User

`gitlab_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `canCreateGroup` | `boolean` |  |  |
| `canCreateProject` | `boolean` |  |  |
| `external` | `boolean` |  |  |
| `privateProfile` | `boolean` |  |  |
| `publicEmail` | `string` |  |  |
| 
`state` \*

 | `string` |  |  |
| `trial` | `boolean` |  |  |
| `twoFactorEnabled` | `boolean` |  |  |

---

## Release Notes

-   **2026-05-15** — GitLab pipelines and CI jobs are now ingested, linked to their parent projects and merge requests.
-   **2025-08-22** — Added configuration option to skip disabled GitLab projects during ingestion.
-   **2025-08-21** — Added configuration option to fetch all visible GitLab projects regardless of user membership, enabling ingestion of all projects accessible to the authenticated user.
-   **2025-08-19** — Added optional separate token configuration for GitLab vulnerability findings ingestion, enabling auditor users to ingest findings when the main API token lacks sufficient permissions.
-   **2025-08-04** — Added configuration option to ingest only human GitLab users, excluding bot and service accounts.

---

Source: /integrations/directory/godaddy

# GoDaddy

Visualize GoDaddy domains and domain records and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> To use this integration, JupiterOne requires a GoDaddy customer number (shopper ID), [API key and secret](https://developer.godaddy.com/keys) to interact with the API. In addition, you must have permission in JupiterOne to install new integrations.

### Configuration in JupiterOne

To install the GoDaddy integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select GoDaddy. Click **Add Configuration** to begin configuring your integration.

Creating an instance requires the following:

-   **Account Name** by which you want to identify this GoDaddy account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
    
-   **Description** that will further assist your team when identifying the integration instance.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Customer Number / Shopper ID** for your GoDaddy account.
    
-   **API Key** configured in GoDaddy for API access.
    
-   **API Key Secret** configured in GoDaddy for API access.
    

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `godaddy_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Domain | `godaddy_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| DomainRecord | `godaddy_domain_record` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `godaddy_account` | **HAS** | `godaddy_domain` |
| `godaddy_domain` | **HAS** | `godaddy_domain_record` |

### Godaddy Account

`godaddy_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`email` \*

 | `string` |  |  |
| `externalId` | `number` |  |  |
| 

`firstName` \*

 | `string` |  |  |
| 

`lastName` \*

 | `string` |  |  |
| 

`marketId` \*

 | `string` |  |  |
| 

`shopperId` \*

 | `string` |  |  |

---

### Godaddy Domain

`godaddy_domain` inherits from [Domain](/data-model/schemas/Domain.md)

---

### Godaddy Domain Record

`godaddy_domain_record` inherits from [DomainRecord](/data-model/schemas/DomainRecord.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`data` \*

 | `string` |  |  |
| `priority` | `number` |  |  |
| `ttl` | `number` |  |  |

---

---

Source: /integrations/directory/google

# Google Workspace

Visualize Google Workspace domain user groups, users, and their authorized tokens, map Google Workspace users to employees and managers, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to add necessary API scopes to your Google Workspace as well as create a dedicated user and role with scopes and privileges for JupiterOne within the Admin console. Every step below is required whether or not your organization signs in through SSO; if it does, read the note under **Create a JupiterOne user in Google Workspace** for how to complete the dedicated user's one-time sign-in.

#### Add the JupiterOne API scopes

Log in to the Google Workspace Admin Console as a super administrator to perform the following actions:

1.  Click **Account > Account Settings > Profile** and retrieve your Customer ID. It will have a format similar to `C1111abcd`. Alternatively, click **Security** and expand Setup single sign-on (SSO) for SAML applications and copy the `idpid` property value from the SSO URL. For example, `https://accounts.google.com/o/saml2/idp?idpid=C1111abcd` provides the ID `C1111abcd`. Retain this value for the **Account ID** field in the JupiterOne integration configuration.
    
2.  Return to the Admin Console home page. Click **Security > Access and data control > API controls**.
    
3.  In the Domain wide delegation pane, select **Manage Domain Wide Delegation**.
    
4.  Click **Add new** and enter the JupiterOne Service Account client ID `102174985137827290632` (US region) or `114158755753045408365` (EU region) into the **Client ID** field. If the JupiterOne integration configuration UI shows you a different client ID, use the one it shows — that value is authoritative for your account.
    
5.  Add the following API scopes (comma separated):
    
    ```text
    https://www.googleapis.com/auth/admin.directory.domain.readonly, https://www.googleapis.com/auth/admin.directory.user.readonly, https://www.googleapis.com/auth/admin.directory.group.readonly, https://www.googleapis.com/auth/admin.directory.user.security, https://www.googleapis.com/auth/apps.groups.settings, https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,https://www.googleapis.com/auth/admin.directory.device.mobile.readonly, https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly, https://www.googleapis.com/auth/cloud-identity.devices.readonly, https://www.googleapis.com/auth/chrome.management.reports.readonly
    ```
    
6.  Click **Authorize**.
    
7.  Point to the client ID in the list and click **View details** to confirm all of the scopes above were saved. Google's console occasionally does not persist every scope on the first save; if any are missing, click **Edit**, re-add them, and **Authorize** again.
    

> **NOTE**
> 
> If your organization has enabled multi-party approval for sensitive admin actions, authorizing domain-wide delegation requires a second super administrator to approve the change before it takes effect. Scope changes can also take up to 24 hours to propagate.

#### Create a JupiterOne user in Google Workspace

Continuing in the Admin console, create a user the JupiterOne Service Account will impersonate.

1.  Click **Users > Add new user**.
    
2.  Enter First name "JupiterOne", Last name "SystemUser", Primary email "jupiterone-admin". Retain the email address for the Admin Email field in the JupiterOne integration configuration.
    
3.  Click **Add new user**, and retain the temporary generated password for the next step.
    
4.  In another browser (or using Chrome's Incognito feature), log in as the new user to set a complex password and accept the Google Workspaces Terms of Service. You may dispose of the password as it will not be used and may be reset by a super administrator in the future as needed.
    

> **CAUTION**
> 
> **Do not skip step 4, including when your organization signs in through SSO.** Domain-wide delegation cannot impersonate a user who has never signed in: Google only sets the account's `agreedToTerms` flag after that first interactive login, it is an output-only field that no administrator or API call can set on the user's behalf, and until it is set the integration's authorization attempt fails. If your domain routes sign-in to an external identity provider, complete this one-time login through your IdP (provisioning `jupiterone-admin` there), or grant the account a temporary SSO exemption so it can sign in with the Google password, then remove the exemption afterward.
> 
> After that one-time login, the password is no longer used. JupiterOne authenticates as the Service Account and impersonates the address through domain-wide delegation, so the account needs no ongoing password, no IdP app assignment, and no interactive access.

#### Create a JupiterOne role in Google Workspace

Continuing in the Admin console, create a new role that will have only the permissions required by JupiterOne, and which will include only the jupiterone-admin system user.

1.  Click **Users**, then click on the "JupiterOne SystemUser".
    
2.  Click **Admin roles and privileges**, then click the icon to edit the user's roles
    
3.  Click **Create custom role > Create a new role**.
    
4.  Enter Name "JupiterOne System", a Description "Role for JupiterOne user to enable read-only access to Google Workspaces Admin APIs." If you have email controls that filter for employee impersonation attacks, you may want to change the name to something such as "j1-system”.
    
5.  In the **Admin privileges** section, select these permissions:
    
    -   Users -> Read
    -   Groups -> Read
    -   Domains -> Domain Management
    -   Security -> User Security Management
    -   Services -> Mobile Device Management -> Manage Devices and Settings
    -   Services -> Chrome Management -> Manage ChromeOS Devices (read only)
    -   Services -> Chrome Management -> View Extensions List Report

> **NOTE**
> 
> Google has consolidated the privilege tree: the permissions above were previously split across separate **Admin console privileges** and **Admin API privileges** sections, and are now all found under **Admin privileges**. The fastest way to select them is the privileges search box in the role editor rather than expanding each branch.
> 
> Grant **Manage ChromeOS Devices (read only)**, not **Manage ChromeOS Devices**. The integration only reads ChromeOS device data, so the read-only privilege is sufficient and avoids granting write access to your devices.

To ingest role and role assignment data you must grant this account Super Admin permissions in addition to the custom role listed above. Permissions will still be restricted by the readonly API scopes if Super Admin permissions are granted, however access to group setting updates and token deletions will be an incidental side effect due to the limitations in the Google domain wide API settings.

These permissions will not be used by the JupiterOne integration, but if granting those permissions is unacceptable, please do not provide Super Admin permissions. The only ingestion items that will not be ingested due to missing Super Admin permissions are roles, role assignments, and token information.

#### Adding Scopes and Privileges

Changes to the integration may include additional data ingestion requiring authorization of new scopes and additional privileges granted to the custom Admin Role.

To authorize additional scopes, log in to the Google Workspace Admin Console as a super administrator to perform the following actions.

1.  Click **Security > Access and data control > API controls**.
    
2.  In the Domain wide delegation pane, select **Manage Domain Wide Delegation**.
    
3.  Identify the JupiterOne Service Account client ID shown in the JupiterOne integration configuration UI.
    
4.  Click **Edit** to add scopes.
    
5.  Click **Authorize**, then point to the client ID and click **View details** to confirm the new scopes were saved.
    

**To grant additional privileges, return to the Admin console:**

1.  Click **Admin roles**, then click the "JupiterOne System" role.
    
2.  Click **Privileges** to add additional privileges under **Admin privileges** to enable JupiterOne to fetch new data.
    
3.  Click **Save**.
    

### Configuration in JupiterOne

To add the Google Workspace integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Google Workspace. Click New Instance to begin configuring your integration. Enter the following:

-   **Account Name** by which you want to identify this Google Workspace account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **AccountName toggle** is enabled.
-   **Description** that assist your team when identifying the integration instance.
-   Select a **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
-   Enter the **Customer ID** collected during the setup of Google Workspace.
-   Enter the **Email Address** of the user created during setup of Google Workspace.

Click **Create** once all values are provided to finalize the integration.

#### Integration Jobs Events

A common log when running the integration job is Permission denied reading tokens for N users. This happens when the credentials provided to JupiterOne are insufficient for reading tokens of users with greater permissions, such as those with the Super Admin role assignment. This is not an error, but is only listed as informational.

As noted, this is due to the "JupiterOne SystemUser" that is configured for integration purposes not having sufficient permissions to list the tokens for users with higher privileges, such as the "Super Admin" Role. These tokens are not necessary for the job to complete and all other data will still be retrieved.

The "Tokens" step involves extensive API usage, often resulting in a long-running integration job. If you find this data less valuable, you may want to consider disabling this step using ingest sources.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (6)

-   `Chrome Management -> Manage Chrome OS Devices`
-   `Chrome Management -> View Extensions List Report`
-   `Domain Management`
-   `Groups -> Read`
-   `Manage Devices and Settings`
-   `Users -> Read`

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `Super Admin`

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (10)

-   `https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly`
-   `https://www.googleapis.com/auth/admin.directory.device.mobile.readonly`
-   `https://www.googleapis.com/auth/admin.directory.domain.readonly`
-   `https://www.googleapis.com/auth/admin.directory.group.readonly`
-   `https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly`
-   `https://www.googleapis.com/auth/admin.directory.user.readonly`
-   `https://www.googleapis.com/auth/admin.directory.user.security`
-   `https://www.googleapis.com/auth/apps.groups.settings`
-   `https://www.googleapis.com/auth/chrome.management.reports.readonly`
-   `https://www.googleapis.com/auth/cloud-identity.devices.readonly`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (11)

-   [https://cloud.google.com/identity/docs/reference/rest/v1/devices](https://cloud.google.com/identity/docs/reference/rest/v1/devices)
-   [https://developers.google.com/chrome/management/reference/rest/v1/customers.reports](https://developers.google.com/chrome/management/reference/rest/v1/customers.reports)
-   [https://developers.google.com/workspace/admin/directory/reference/rest/v1/chromeosdevices](https://developers.google.com/workspace/admin/directory/reference/rest/v1/chromeosdevices)
-   [https://developers.google.com/workspace/admin/directory/reference/rest/v1/domains](https://developers.google.com/workspace/admin/directory/reference/rest/v1/domains)
-   [https://developers.google.com/workspace/admin/directory/reference/rest/v1/groups](https://developers.google.com/workspace/admin/directory/reference/rest/v1/groups)
-   [https://developers.google.com/workspace/admin/directory/reference/rest/v1/mobiledevices](https://developers.google.com/workspace/admin/directory/reference/rest/v1/mobiledevices)
-   [https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments](https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments)
-   [https://developers.google.com/workspace/admin/directory/reference/rest/v1/roles](https://developers.google.com/workspace/admin/directory/reference/rest/v1/roles)
-   [https://developers.google.com/workspace/admin/directory/reference/rest/v1/tokens](https://developers.google.com/workspace/admin/directory/reference/rest/v1/tokens)
-   [https://developers.google.com/workspace/admin/directory/reference/rest/v1/users](https://developers.google.com/workspace/admin/directory/reference/rest/v1/users)
-   [https://developers.google.com/workspace/admin/groups-settings/v1/reference/groups](https://developers.google.com/workspace/admin/groups-settings/v1/reference/groups)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (5)

| Step | Permissions | Roles | OAuth Scopes |
| --- | --- | --- | --- |
| Chrome Extension Devices | `Chrome Management -> View Extensions List Report` | \- | `https://www.googleapis.com/auth/chrome.management.reports.readonly` |
| Group Settings | \- | \- | `https://www.googleapis.com/auth/apps.groups.settings` |
| Groups | `Groups -> Read` | \- | `https://www.googleapis.com/auth/admin.directory.group.readonly` |
| Role Assignments | \- | `Super Admin` | `https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly` |
| Tokens | \- | `Super Admin` | `https://www.googleapis.com/auth/admin.directory.user.security` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `google_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Chrome Extension | `google_chrome_extension` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Chrome OS Device | `google_chrome_os_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Device | `google_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Domain | `google_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| Group | `google_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Group Settings | `google_group_settings` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Mobile Device | `google_mobile_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Role | `google_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Site | `google_site` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| Token | `google_token` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| User | `google_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `google_account` | **HAS** | `google_role` |
| `google_account` | **HAS** | `google_user` |
| `google_account` | **HAS** | `google_group` |
| `google_account` | **MANAGES** | `google_chrome_os_device` |
| `google_account` | **MANAGES** | `google_mobile_device` |
| `google_account` | **MANAGES** | `google_device` |
| `google_group` | **HAS** | `google_user` |
| `google_group` | **HAS** | `google_group` |
| `google_group` | **HAS** | `google_group_settings` |
| `google_site` | **HAS** | `google_user` |
| `google_token` | **ALLOWS** | `mapped_entity (class Vendor)` |
| `google_user` | **ASSIGNED** | `google_role` |
| `google_user` | **ASSIGNED** | `google_token` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `google_device` | **INSTALLED** | `google_chrome_extension` | FORWARD |

### Google Account

`google_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`domains` \*

 | `array` of `string`s |  |  |
| `primaryDomain` | `string` |  |  |
| 

`vendor` \*

 | `string` |  | **default**: Google |

---

### Google Chrome Extension

`google_chrome_extension` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`deviceCount` \*

 | `number` **|** `null` |  |  |
| `disabled` | `boolean` **|** `null` |  |  |
| `installType` | `string` **|** `null` |  |  |
| 

`permissions` \*

 | `string` |  |  |
| `source` | `string` **|** `null` |  |  |
| `type` | `string` **|** `null` |  |  |
| `uri` | `string` **|** `null` |  |  |

---

### Google Chrome Os Device

`google_chrome_os_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `annotatedUser` | `string` **|** `null` |  |  |
| `bootMode` | `string` **|** `null` |  | **Any of**:
-   `Verified`

-   `Dev`

 |
| `firmwareVersion` | `string` **|** `null` |  |  |
| `googleStatus` | `string` **|** `null` |  | **Any of**:

-   `ACTIVE`

-   `DELINQUENT`

-   `PRE_PROVISIONED`

-   `DEPROVISIONED`

-   `DISABLED`

-   `INACTIVE`

-   `RETURN_ARRIVED`

-   `RETURN_REQUESTED`

-   `SHIPPED`

-   `UNKNOWN`

 |
| `lastEnrollementTime` | `number` | This property is deprecated. Use lastEnrollmentTime instead. | **deprecated**: true |
| `lastEnrollmentTime` | `number` |  |  |
| `lastSync` | `number` |  |  |
| `macAddress` | `string` **|** `null` |  |  |
| `platformVersion` | `string` **|** `null` |  |  |
| `recentUsersEmail` | `array` of `string`s |  |  |
| `recentUsersType` | `array` of `string`s |  |  |
| `serialNumber` | `string` **|** `null` |  |  |
| `supportEndDate` | `number` **|** `null` | The final date the device will be supported. This is applicable only for those devices purchased directly from Google. |  |
| `tpmFamily` | `string` | TPM 2.0 style encoding  
  
**Examples**: TPM 1.2: "1.2" -> 312e3200 |  |
| `tpmFirmwareVersion` | `string` |  |  |
| `tpmManufacturer` | `string` |  |  |
| `tpmModel` | `string` |  |  |
| `tpmSpecLevel` | `string` |  |  |
| `tpmVendorId` | `string` |  |  |

---

### Google Device

`google_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `androidEnabledUnknownSources` | `boolean` **|** `null` |  |  |
| `androidOwnerProfileAccount` | `boolean` **|** `null` |  |  |
| `androidOwnershipPrivilege` | `string` **|** `null` |  |  |
| `androidSupportsWorkProfile` | `boolean` **|** `null` |  |  |
| `basebandVersion` | `string` **|** `null` |  |  |
| `bootloaderVersion` | `string` **|** `null` |  |  |
| `brand` | `string` **|** `null` | **Examples**: Samsung |  |
| `buildNumber` | `string` **|** `null` |  |  |
| 
`byod` \*

 | `boolean` | Please use BYOD instead. | **deprecated**: true |
| `compromisedState` | `string` **|** `null` |  |  |
| `deviceType` | `string` **|** `null` |  |  |
| `enabledDeveloperOptions` | `boolean` **|** `null` |  |  |
| `enabledUsbDebugging` | `boolean` **|** `null` |  |  |
| `encryptionState` | `string` **|** `null` |  |  |
| `imei` | `string` **|** `null` |  |  |
| `kernelVersion` | `string` **|** `null` |  |  |
| `lastSyncedOn` | `number` |  |  |
| `macAddress` | `array` **|** `null` |  |  |
| `managementState` | `string` **|** `null` |  |  |
| `meid` | `string` **|** `null` |  |  |
| `networkOperator` | `string` **|** `null` |  |  |
| `osKernel` | `string` **|** `null` |  |  |
| `otherAccounts` | `array` **|** `null` |  |  |
| `ownerType` | `string` **|** `null` |  |  |
| `releaseVersion` | `string` **|** `null` | **Examples**: 6.0 |  |
| `securityPatchedOn` | `number` |  |  |
| `serialNumber` | `string` **|** `null` |  |  |
| `wifiMacAddresses` | `array` **|** `null` |  |  |

---

### Google Domain

`google_domain` inherits from [Domain](/data-model/schemas/Domain.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`primary` \*

 | `boolean` |  |  |
| 

`verified` \*

 | `boolean` |  |  |

---

### Google Group

`google_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `adminCreated` | `boolean` **|** `null` |  |  |
| `aliases` | `array` **|** `null` |  |  |
| `directMembersCount` | `string` **|** `null` |  |  |
| `email` | `string` **|** `null` |  |  |
| `kind` | `string` **|** `null` | The type of the resource. Always admin#directory#group for groups. |  |
| `nonEditableAliases` | `array` **|** `null` | The list of the group's non-editable alias email addresses that are outside of the account's primary domain or subdomains. |  |

---

### Google Group Settings

`google_group_settings` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowExternalMembers` | `boolean` **|** `null` |  |  |
| `allowWebPosting` | `boolean` **|** `null` |  |  |
| `archiveOnly` | `boolean` **|** `null` |  |  |
| `customFooterText` | `string` **|** `null` | The maximum number of characters is 1,000. |  |
| `customReplyTo` | `string` **|** `null` |  |  |
| `customRolesEnabledForSettingsToBeMerged` | `boolean` **|** `null` |  |  |
| `defaultMessageDenyNotificationText` | `string` **|** `null` |  |  |
| `email` | `string` |  |  |
| `enableCollaborativeInbox` | `boolean` **|** `null` |  |  |
| `favoriteRepliesOnTop` | `boolean` **|** `null` |  |  |
| `includeCustomFooter` | `boolean` **|** `null` |  |  |
| `includeInGlobalAddressList` | `boolean` **|** `null` |  |  |
| `isArchived` | `boolean` **|** `null` |  |  |
| `membersCanPostAsTheGroup` | `boolean` **|** `null` |  |  |
| `messageModerationLevel` | `string` **|** `null` |  | **Any of**:
-   `MODERATE_ALL_MESSAGES`

-   `MODERATE_NON_MEMBERS`

-   `MODERATE_NEW_MEMBERS`

-   `MODERATE_NONE`

 |
| `primaryLanguage` | `string` **|** `null` |  |  |
| `replyTo` | `string` **|** `null` |  | **Any of**:

-   `REPLY_TO_CUSTOM`

-   `REPLY_TO_SENDER`

-   `REPLY_TO_LIST`

-   `REPLY_TO_OWNER`

-   `REPLY_TO_IGNORE`

-   `REPLY_TO_MANAGERS`

 |
| `sendMessageDenyNotification` | `boolean` **|** `null` |  |  |
| `spamModerationLevel` | `string` **|** `null` |  | **Any of**:

-   `ALLOW`

-   `MODERATE`

-   `SILENTLY_MODERATE`

-   `REJECT`

 |
| `whoCanApproveMembers` | `string` **|** `null` |  | **Any of**:

-   `ALL_MEMBERS_CAN_APPROVE`

-   `ALL_MANAGERS_CAN_APPROVE`

-   `ALL_OWNERS_CAN_APPROVE`

-   `NONE_CAN_APPROVE`

 |
| `whoCanAssistContent` | `string` **|** `null` |  | **Any of**:

-   `ALL_MEMBERS`

-   `OWNERS_AND_MANAGERS`

-   `MANAGERS_ONLY`

-   `OWNERS_ONLY`

-   `NONE`

 |
| `whoCanBanUsers` | `string` **|** `null` |  | **Any of**:

-   `ALL_MEMBERS`

-   `OWNERS_AND_MANAGERS`

-   `OWNERS_ONLY`

-   `NONE`

 |
| `whoCanContactOwner` | `string` **|** `null` |  | **Any of**:

-   `ALL_IN_DOMAIN_CAN_CONTACT`

-   `ALL_MANAGERS_CAN_CONTACT`

-   `ALL_MEMBERS_CAN_CONTACT`

-   `ANYONE_CAN_CONTACT`

-   `ALL_OWNERS_CAN_CONTACT`

 |
| `whoCanDiscoverGroup` | `string` **|** `null` |  | **Any of**:

-   `ALL_MEMBERS_CAN_DISCOVER`

-   `ALL_IN_DOMAIN_CAN_DISCOVER`

-   `ANYONE_CAN_DISCOVER`

 |
| `whoCanJoin` | `string` **|** `null` |  | **Any of**:

-   `ANYONE_CAN_JOIN`

-   `ALL_IN_DOMAIN_CAN_JOIN`

-   `INVITED_CAN_JOIN`

-   `CAN_REQUEST_TO_JOIN`

 |
| `whoCanLeaveGroup` | `string` **|** `null` |  | **Any of**:

-   `ALL_MANAGERS_CAN_LEAVE`

-   `ALL_MEMBERS_CAN_LEAVE`

-   `NONE_CAN_LEAVE`

 |
| `whoCanModerateContent` | `string` **|** `null` |  | **Any of**:

-   `ALL_MEMBERS`

-   `OWNERS_AND_MANAGERS`

-   `OWNERS_ONLY`

-   `NONE`

 |
| `whoCanModerateMembers` | `string` **|** `null` |  | **Any of**:

-   `ALL_MEMBERS`

-   `OWNERS_AND_MANAGERS`

-   `OWNERS_ONLY`

-   `NONE`

 |
| `whoCanPostMessage` | `string` **|** `null` |  | **Any of**:

-   `NONE_CAN_POST`

-   `ALL_MANAGERS_CAN_POST`

-   `ALL_MEMBERS_CAN_POST`

-   `ALL_OWNERS_CAN_POST`

-   `ALL_IN_DOMAIN_CAN_POST`

-   `ANYONE_CAN_POST`

 |
| `whoCanViewGroup` | `string` **|** `null` |  | **Any of**:

-   `ANYONE_CAN_VIEW`

-   `ALL_IN_DOMAIN_CAN_VIEW`

-   `ALL_MEMBERS_CAN_VIEW`

-   `ALL_MANAGERS_CAN_VIEW`

 |
| `whoCanViewMembership` | `string` **|** `null` |  | **Any of**:

-   `ALL_IN_DOMAIN_CAN_VIEW`

-   `ALL_MEMBERS_CAN_VIEW`

-   `ALL_MANAGERS_CAN_VIEW`

 |

---

### Google Mobile Device

`google_mobile_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `adbStatus` | `boolean` **|** `null` | Adb (USB debugging) enabled or disabled on device |  |
| `brand` | `string` **|** `null` |  |  |
| `deviceCompromisedStatus` | `string` **|** `null` |  |  |
| `email` | `string` |  |  |
| `encryptionStatus` | `string` **|** `null` |  |  |
| `firstSyncOn` | `number` |  |  |
| `googleStatus` | `string` **|** `null` |  | **Any of**:
-   `ACTIVE`

-   `DELINQUENT`

-   `PRE_PROVISIONED`

-   `DEPROVISIONED`

-   `DISABLED`

-   `INACTIVE`

-   `RETURN_ARRIVED`

-   `RETURN_REQUESTED`

-   `SHIPPED`

-   `UNKNOWN`

 |
| `hardware` | `string` **|** `null` |  |  |
| `hardwareId` | `string` **|** `null` | The IMEI/MEID unique identifier for Android hardware |  |
| `imei` | `string` **|** `null` |  |  |
| `lastSyncOn` | `number` |  |  |
| `macAddress` | `string` **|** `null` |  |  |
| `manufacturer` | `string` **|** `null` |  |  |
| `os` | `string` **|** `null` | **Examples**: IOS 4.3, Android 2.3.5 |  |
| `ownerName` | `string` |  |  |
| `serialNumber` | `string` **|** `null` |  |  |
| `type` | `string` **|** `null` |  |  |
| `userAgent` | `string` **|** `null` |  |  |
| `wifiMacAddress` | `string` **|** `null` |  |  |

---

### Google Role

`google_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `kind` | `string` **|** `null` | The type of the resource. Always admin#directory#role. |  |
| 
`vendor` \*

 | `string` |  | **default**: Google |

---

### Google Site

`google_site` inherits from [Site](/data-model/schemas/Site.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `area` | `string` **|** `null` |  |  |
| `buildingId` | `string` **|** `null` |  |  |
| `floorName` | `string` **|** `null` |  |  |
| `floorSection` | `string` **|** `null` | More specific location within the floor. For example if a floor is divided into sections "A", "B" and "C" this field would identify one of those values. |  |
| 
`name` \*

 | `string` |  |  |
| `type` | `string` **|** `null` |  |  |

---

### Google Token

`google_token` inherits from [AccessKey](/data-model/schemas/AccessKey.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `anonymous` | `boolean` **|** `null` |  |  |
| `clientId` | `string` **|** `null` |  |  |
| `nativeApp` | `boolean` **|** `null` |  |  |
| `scopes` | `array` **|** `null` |  |  |
| `userKey` | `string` **|** `null` |  |  |

---

### Google User

`google_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`admin` \*

 | `boolean` |  |  |
| `agreedToTerms` | `boolean` **|** `null` |  |  |
| `aliases` | `array` **|** `null` |  |  |
| 

`archived` \*

 | `boolean` |  |  |
| `changePasswordAtNextLogin` | `boolean` **|** `null` |  |  |
| `creationTime` | `number` |  |  |
| `customerId` | `string` **|** `null` |  |  |
| `deletionTime` | `number` |  |  |
| `hashFunction` | `string` **|** `null` | **Examples**: MD5, SHA-1, crypt |  |
| 

`includeInGlobalAddressList` \*

 | `boolean` |  |  |
| 

`ipWhitelisted` \*

 | `boolean` |  |  |
| 

`isAdmin` \*

 | `boolean` |  |  |
| 

`isDelegatedAdmin` \*

 | `boolean` |  |  |
| 

`isEnforcedIn2Sv` \*

 | `boolean` |  |  |
| 

`isEnrolledIn2Sv` \*

 | `boolean` |  |  |
| 

`isMailboxSetup` \*

 | `boolean` |  |  |
| `kind` | `string` **|** `null` | The type of the resource. Always admin#directory#user for users. |  |
| `lastLoginOn` | `number` |  |  |
| `lastLoginTime` | `number` |  |  |
| `orgUnitPath` | `string` **|** `null` |  |  |
| `primaryEmail` | `string` **|** `null` |  |  |
| `recoveryEmail` | `string` **|** `null` |  |  |
| `recoveryPhone` | `string` **|** `null` |  |  |
| 

`suspended` \*

 | `boolean` |  |  |
| `suspensionReason` | `string` **|** `null` |  |  |
| `thumbnailPhotoUrl` | `string` **|** `null` |  |  |

---

## Release Notes

-   **2026-03-31** — Added OS kernel version property to Google Workspace endpoint device entities.
-   **2025-07-24** — Added relationships linking Google Workspace Chrome extensions to the devices on which they are installed.

---

Source: /integrations/directory/google-cloud

# Google Cloud

Visualize Google Cloud resources, map Google Cloud users to employees, and monitor visibility and governance of the environment through queries and alerts.

## Installation

> **INFO**
> 
> To use this integration, JupiterOne requires the contents of a [Google Cloud service account](https://cloud.google.com/iam/docs/service-accounts-create) key file with the correct API services enabled. In addition, you must have permission in JupiterOne to install new integrations.

### Overview

The Google Cloud integration requires three main configuration steps:

1.  **Enable Google Cloud service APIs** for the services you want to ingest
2.  **Create a service account** with appropriate permissions
3.  **Configure the integration** in JupiterOne with the service account key

### Google Cloud Configuration

Google Cloud has most API services disabled by default. When a Google Cloud service API is disabled, the JupiterOne integration will not ingest the data from that API.

> **TIP**
> 
> You only need to enable the APIs for the services you want JupiterOne to ingest. If a service is not used in your Google Cloud environment, you can skip enabling its API.

See the **Authorization** tab for the full list of required APIs and permissions per ingestion step.

> **INFO**
> 
> **Required APIs**: The following APIs must always be enabled for the integration to function: `cloudasset.googleapis.com`, `cloudresourcemanager.googleapis.com`, `iam.googleapis.com`, and `serviceusage.googleapis.com`. All other APIs are optional and should only be enabled if you want to ingest data from those specific services.

### Enabling Google Cloud Service APIs

Google Cloud service APIs can be enabled from the [Google Cloud Console API Library](https://console.cloud.google.com/apis/library) or using the [`gcloud` CLI](https://cloud.google.com/sdk/gcloud). See the **Authorization** tab for the complete list of APIs used by this integration.

#### Creating Google Cloud project service account

-   See the [Google Cloud service account documentation](https://cloud.google.com/iam/docs/service-accounts-create) for more information on how to create a service account in the project that you would like to ingest data from.

We must assign the correct permissions to the newly created service account for the integration to be run. We recommend using the following roles managed by Google Cloud:

-   [`Security Reviewer`](https://cloud.google.com/iam/docs/understanding-roles#iam.securityReviewer)
-   [`Organization Role Viewer`](https://cloud.google.com/iam/docs/understanding-roles#iam.organizationRoleViewer)
-   [`BigQuery Metadata Viewer`](https://cloud.google.com/bigquery/docs/access-control#bigquery.metadataViewer)
-   [`Secret Manager Secret Accessor`](https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets#access)

Instead of using the Google Cloud managed roles listed above, you can create a custom IAM role with only the specific permissions required by the JupiterOne integration. See the **Authorization** tab for the complete list of permissions per ingestion step. See the [Google Cloud custom role documentation](https://cloud.google.com/iam/docs/creating-custom-roles#creating_a_custom_role) for information on how custom roles can be configured and assigned.

You may also create a service account using the [`gcloud` CLI](https://cloud.google.com/sdk/gcloud).

#### Generate a service account key

See the [Google Cloud service account key documentation](https://cloud.google.com/iam/docs/keys-create-delete) for more information on how to create a service account key for the service account that you would like to ingest data using.

You may also create a service account key using the [`gcloud` CLI](https://cloud.google.com/sdk/gcloud).

#### JupiterOne + Google Cloud Organization

Given the correct permissions, JupiterOne has the ability to automatically discover each project under a Google Cloud organization and configure integration instances for each of the projects.

##### Setup

1.  Select one Google Cloud project to configure a service account for JupiterOne.
    
2.  Create the service account without a role. Copy the email address of the new service account (e.g. `my-sa@my-j1-project.iam.gserviceaccount.com`).
    
3.  Generate and copy a new service account key.
    
4.  Enable service APIs in both the "main" project and each "child" project that you'd like JupiterOne to access.
    
    **Important**: The following APIs **must be enabled in the "main" project**:
    
    -   `cloudasset.googleapis.com` (Cloud Asset)
    -   `cloudresourcemanager.googleapis.com` (Cloud Resource Manager)
    -   `iam.googleapis.com` (Identity and Access Management)
    -   `serviceusage.googleapis.com` (Service Usage)
    
    **For child projects**: Enable the service APIs for the specific services you want to ingest from each project. Refer to the API table in the earlier section for the complete list of supported services.
    
5.  Switch to the organization that you'd like to create individual integration instances for each project
    
6.  [Create a new custom role](https://cloud.google.com/iam/docs/creating-custom-roles) with the following permissions:
    

resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list serviceusage.services.list resourcemanager.organizations.getIamPolicy cloudasset.assets.searchAllIamPolicies

The integration will also try to ingest organization policy for "storage.publicAccessPrevention" to precisely calculate storage buckets public access, and Access Approval settings for enforcing manual approval of privileged operations (CIS 2.15), it is therefore recommended that the following permissions are also included in the custom role above:

orgpolicy.policy.get accessapproval.settings.get accessapproval.requests.get

The integration will calculate if a storage bucket is public or not based on the following conditions:

-   `Public to internet` means one or more bucket-level permissions grant access to `allUsers` or `allAuthenticatedUsers`.
-   `Not public` means the bucket's policy controls all objects uniformly, and no permissions have been granted to allUsers or allAuthenticatedUsers.
-   `Subject to object ACLs` means fine-grained, object-level access control lists (ACLs) are enabled. Objects may be public if they grant access to allUsers or allAuthenticatedUsers.

1.  Navigate to the Cloud Resource Manager for that organization and [add a new member to the organization](https://cloud.google.com/resource-manager/docs/access-control-org#grant-access). The new member email address is the email address of the service account that was created earlier. Select the new organization role that was created above, as well as the Google Cloud managed role "Security Reviewer" (`roles/iam.securityReviewer`) or an alternative JupiterOne custom role that you've created.
    
2.  Navigate to the JupiterOne Google Cloud integration configuration page to begin configuring the "main" integration instance.
    

Use the generated service account key as the value for the "Service Account Key File" field.

> **NOTE**
> 
> The "Polling Interval" that is selected for the "main" integration instances will be the same polling interval that is used for each of the child integration instances.

1.  Select the "Configure Organization Projects" checkbox.
2.  Enter the numerical value of the Google Cloud organization into the "Organization ID" text field (e.g. "1234567890").
3.  Click `CREATE CONFIGURATION`.

Depending on how many projects exist under a Google Cloud organization, the auto-configuration process may take a few minutes to complete. When the process has been completed, you will see your new integration instances on the JupiterOne Google Cloud integration list page.

### Configuration in JupiterOne

To install the Google Cloud integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Google Cloud. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **Account Name** by which you want to identify this Google Cloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Add AccountName Tag** is enabled.
-   **Description** that will assist your team to identify the integration instance.
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You can leave this as `DISABLED` and manually execute the integration.
-   **Service Account Key File** contents of the Google Cloud service account.
-   Add any tags you want to use to simplify data management and queries.

**Project ID of the Google Cloud project (e.g. abc-123)** (optional): The project ID to target for data ingestion. Defaults to the project ID specified in the service account key file.

Select **Configure Organization Projects** if you want J1 to auto-configure all projects in your organization. J1 applies the configuration to all other projects that do not have optional `j1-integration: SKIP` tag applied to the project in your infrastructure-as-code. Do not use the optional project ID if you want to use this feature.

When **Configure Organization Projects** is enabled, two additional options become available:

-   **Auto-delete Removed Projects**: When enabled, automatically deletes integration instances for projects that are deleted or removed from your organization. Disabled by default.
-   **Auto-delete Child Integrations**: When enabled, automatically deletes child project instances when this parent organization instance is deleted. Enabled by default.

**Folder Filter** (optional): A numerical folder ID. When set, J1 ingests only projects in the specified folder and its subfolders. When **Configure Organization Projects** is also enabled, J1 auto-configures only projects within this folder.

Click **Create** after all values are provided to finalize the integration.

## Data Volume Configuration

### Data Filtering Options

| Field | Description | Default |
| --- | --- | --- |
| Compute Instance Metadata Fields | Comma-separated metadata field keys to ingest from Compute Engine instances. For example: `key1,key2`. Leave blank to ingest no custom metadata fields. | Empty |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (154)

-   `accessapproval.settings.get`
-   `accesscontextmanager.accessLevels.list`
-   `accesscontextmanager.accessPolicies.list`
-   `accesscontextmanager.servicePerimeters.list`
-   `aiplatform.batchPredictionJobs.list`
-   `aiplatform.datasets.list`
-   `aiplatform.endpoints.list`
-   `aiplatform.models.list`
-   `aiplatform.trainingPipelines.list`
-   `alloydb.backups.get`
-   `alloydb.clusters.list`
-   `alloydb.instances.connect`
-   `alloydb.instances.list`
-   `alloydb.users.list`
-   `apigateway.apiconfigs.getIamPolicy`
-   `apigateway.apiconfigs.list`
-   `apigateway.apis.getIamPolicy`
-   `apigateway.apis.list`
-   `apigateway.gateways.getIamPolicy`
-   `apigateway.gateways.list`
-   `appengine.applications.get`
-   `appengine.instances.list`
-   `appengine.services.list`
-   `appengine.versions.list`
-   `artifactregistry.packages.list`
-   `artifactregistry.repositories.list`
-   `artifactregistry.vpcscconfigs.get`
-   `bigquery.datasets.get`
-   `bigquery.models.getData`
-   `bigquery.models.getMetadata`
-   `bigquery.models.list`
-   `bigquery.tables.get`
-   `bigquery.tables.getIamPolicy`
-   `bigquery.tables.list`
-   `bigtable.appProfiles.list`
-   `bigtable.backups.list`
-   `bigtable.clusters.list`
-   `bigtable.instances.list`
-   `bigtable.tables.list`
-   `billing.budgets.list`
-   `binaryauthorization.policy.get`
-   `cloudasset.assets.listCloudbillingBillingAccounts`
-   `cloudasset.assets.listCloudbillingProjectBillingInfos`
-   `cloudasset.assets.searchAllIamPolicies`
-   `cloudbuild.builds.get`
-   `cloudbuild.builds.list`
-   `cloudbuild.integrations.get`
-   `cloudbuild.integrations.list`
-   `cloudbuild.repositories.get`
-   `cloudbuild.repositories.list`
-   `cloudbuild.workerpools.list`
-   `clouddeploy.automations.list`
-   `clouddeploy.deliveryPipelines.list`
-   `cloudfunctions.functions.list`
-   `cloudkms.cryptoKeys.getIamPolicy`
-   `cloudkms.cryptoKeys.list`
-   `cloudkms.keyRings.list`
-   `cloudsecurityscanner.scanruns.list`
-   `cloudsecurityscanner.scans.list`
-   `cloudsql.backupRuns.list`
-   `cloudsql.databases.list`
-   `cloudsql.instances.list`
-   `cloudsql.sslCerts.list`
-   `cloudsql.users.list`
-   `compute.addresses.list`
-   `compute.backendBuckets.list`
-   `compute.backendServices.list`
-   `compute.disks.list`
-   `compute.externalVpnGateways.list`
-   `compute.firewalls.list`
-   `compute.forwardingRules.list`
-   `compute.globalAddresses.list`
-   `compute.globalForwardingRules.list`
-   `compute.healthChecks.list`
-   `compute.images.get`
-   `compute.images.getIamPolicy`
-   `compute.images.list`
-   `compute.instanceGroups.list`
-   `compute.instances.list`
-   `compute.networks.list`
-   `compute.projects.get`
-   `compute.regionBackendServices.list`
-   `compute.regionHealthChecks.list`
-   `compute.regionSecurityPolicies.list`
-   `compute.regionTargetHttpProxies.list`
-   `compute.regionTargetHttpsProxies.list`
-   `compute.regionUrlMaps.list`
-   `compute.routers.list`
-   `compute.securityPolicies.list`
-   `compute.snapshots.list`
-   `compute.sslPolicies.list`
-   `compute.subnetworks.list`
-   `compute.targetHttpProxies.list`
-   `compute.targetHttpsProxies.list`
-   `compute.targetPools.list`
-   `compute.targetSslProxies.list`
-   `compute.targetVpnGateways.list`
-   `compute.urlMaps.list`
-   `compute.vpnGateways.list`
-   `compute.vpnTunnels.list`
-   `container.clusters.list`
-   `dataproc.clusters.list`
-   `datastore.databases.list`
-   `dlp.jobTriggers.list`
-   `dlp.tableDataProfiles.list`
-   `dns.managedZones.list`
-   `dns.policies.list`
-   `dns.resourceRecordSets.list`
-   `essentialcontacts.contacts.list`
-   `file.instances.list`
-   `iam.roles.list`
-   `iam.serviceAccountKeys.list`
-   `iam.serviceAccounts.list`
-   `iap.webServices.getIamPolicy`
-   `logging.logMetrics.list`
-   `logging.sinks.list`
-   `memcache.instances.list`
-   `monitoring.alertPolicies.list`
-   `orgpolicy.policies.list`
-   `orgpolicy.policy.get`
-   `osconfig.inventories.get`
-   `privateca.caPools.list`
-   `privateca.certificateAuthorities.getIamPolicy`
-   `privateca.certificateAuthorities.list`
-   `privateca.certificates.list`
-   `pubsub.subscriptions.list`
-   `pubsub.topics.getIamPolicy`
-   `pubsub.topics.list`
-   `redis.instances.list`
-   `resourcemanager.folders.list`
-   `resourcemanager.organizations.get`
-   `resourcemanager.projects.get`
-   `resourcemanager.projects.getIamPolicy`
-   `resourcemanager.projects.list`
-   `run.configurations.list`
-   `run.routes.list`
-   `run.services.list`
-   `secretmanager.secrets.list`
-   `secretmanager.versions.list`
-   `securitycenter.findings.list`
-   `serviceusage.services.list`
-   `source.repos.list`
-   `spanner.backups.get`
-   `spanner.databases.getIamPolicy`
-   `spanner.databases.list`
-   `spanner.databasesRoles.list`
-   `spanner.instanceConfigs.list`
-   `spanner.instances.list`
-   `storage.buckets.getIamPolicy`
-   `storage.buckets.list`
-   `workflows.workflows.list`
-   `workstations.clusters.list`
-   `workstations.configs.list`
-   `workstations.workstations.list`

### APIs

APIs or services that must be enabled in the target environment.

Show APIs (49)

-   `accessapproval.googleapis.com`
-   `accesscontextmanager.googleapis.com`
-   `aiplatform.googleapis.com`
-   `alloydb.googleapis.com`
-   `apigateway.googleapis.com`
-   `apikeys.googleapis.com`
-   `appengine.googleapis.com`
-   `artifactregistry.googleapis.com`
-   `bigquery.googleapis.com`
-   `bigtable.googleapis.com`
-   `binaryauthorization.googleapis.com`
-   `cloudasset.googleapis.com`
-   `cloudbilling.googleapis.com`
-   `cloudbuild.googleapis.com`
-   `clouddeploy.googleapis.com`
-   `cloudfunctions.googleapis.com`
-   `cloudidentity.googleapis.com`
-   `cloudkms.googleapis.com`
-   `cloudsql.googleapis.com`
-   `compute.googleapis.com`
-   `container.googleapis.com`
-   `dataproc.googleapis.com`
-   `dlp.googleapis.com`
-   `dns.googleapis.com`
-   `essentialcontacts.googleapis.com`
-   `file.googleapis.com`
-   `firestore.googleapis.com`
-   `iam.googleapis.com`
-   `iap.googleapis.com`
-   `logging.googleapis.com`
-   `memcache.googleapis.com`
-   `monitoring.googleapis.com`
-   `orgpolicy.googleapis.com`
-   `osconfig.googleapis.com`
-   `privateca.googleapis.com`
-   `pubsub.googleapis.com`
-   `redis.googleapis.com`
-   `resourcemanager.googleapis.com`
-   `run.googleapis.com`
-   `secretmanager.googleapis.com`
-   `securitycenter.googleapis.com`
-   `serviceusage.googleapis.com`
-   `source.googleapis.com`
-   `spanner.googleapis.com`
-   `sqladmin.googleapis.com`
-   `storage.googleapis.com`
-   `websecurityscanner.googleapis.com`
-   `workflows.googleapis.com`
-   `workstations.googleapis.com`

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (96)

| Step | Permissions | APIs |
| --- | --- | --- |
| Access Approval Settings | `accessapproval.settings.get` | `accessapproval.googleapis.com` |
| Access Context Manager Access Levels | `accesscontextmanager.accessLevels.list` | `accesscontextmanager.googleapis.com` |
| Access Context Manager Ingress Policies Sources Relationships | \- | \- |
| Access Context Manager Service Perimeters | `accesscontextmanager.servicePerimeters.list` | `accesscontextmanager.googleapis.com` |
| Api Gateway Api Configs | `apigateway.apiconfigs.list`, `apigateway.apiconfigs.getIamPolicy` | `apigateway.googleapis.com` |
| Api Gateway Gateways | `apigateway.gateways.list`, `apigateway.gateways.getIamPolicy` | `apigateway.googleapis.com` |
| API Keys | \- | `apikeys.googleapis.com` |
| API Services | `serviceusage.services.list` | `serviceusage.googleapis.com` |
| AppEngine Instances | `appengine.instances.list` | `appengine.googleapis.com` |
| AppEngine Services | `appengine.services.list` | `appengine.googleapis.com` |
| AppEngine Versions | `appengine.versions.list` | \- |
| Artifact Registry VPC SC configuration and Policy | `artifactregistry.vpcscconfigs.get` | `artifactregistry.googleapis.com` |
| Artifact Repository Package | `artifactregistry.packages.list` | `artifactregistry.googleapis.com` |
| Audit Config IAM Policy | `resourcemanager.projects.getIamPolicy` | `resourcemanager.googleapis.com` |
| Big Query Models | `bigquery.models.list`, `bigquery.models.getData`, `bigquery.models.getMetadata` | `bigquery.googleapis.com` |
| Big Query Tables | `bigquery.tables.list`, `bigquery.tables.getIamPolicy`, `bigquery.tables.get` | `bigquery.googleapis.com` |
| Bigtable AppProfiles | `bigtable.appProfiles.list` | `bigtable.googleapis.com` |
| Bigtable Backups | `bigtable.backups.list` | `bigtable.googleapis.com` |
| Bigtable Clusters | `bigtable.clusters.list` | `bigtable.googleapis.com` |
| Bigtable Tables | `bigtable.tables.list` | `bigtable.googleapis.com` |
| Billing Budgets | `billing.budgets.list` | `cloudbilling.googleapis.com` |
| Binary Authorization Policy | `binaryauthorization.policy.get` | `binaryauthorization.googleapis.com` |
| Build Additional Project Budget Relationships | `cloudasset.assets.listCloudbillingProjectBillingInfos` | `cloudbilling.googleapis.com` |
| Build Device User Is Google User Relationship | \- | \- |
| Build User Assigned AlloyDb Cluster Relationship | `alloydb.users.list` | \- |
| Cloud Deploy Automation | `clouddeploy.automations.list` | `clouddeploy.googleapis.com` |
| Cloud Identity Device Users | \- | `cloudidentity.googleapis.com` |
| Cloud Identity Groups | \- | `cloudidentity.googleapis.com` |
| Cloud Identity Membership Roles | \- | `cloudidentity.googleapis.com` |
| Cloud Identity SAML Provider Uses Group Relationship | \- | `cloudidentity.googleapis.com` |
| Cloud Run Configurations | `run.configurations.list` | `run.googleapis.com` |
| Cloud Run Routes | `run.routes.list` | \- |
| Cloud Spanner Backups | `spanner.backups.get` | `spanner.googleapis.com` |
| Cloud VPN Gateways | `compute.vpnGateways.list` | `compute.googleapis.com` |
| Compute Addresses | `compute.addresses.list` | `compute.googleapis.com` |
| Compute Backend Services | `compute.backendServices.list` | `compute.googleapis.com` |
| Compute Disk Image Relationships | `compute.images.get` | `compute.googleapis.com` |
| Compute Firewalls | `compute.firewalls.list` | `compute.googleapis.com` |
| Compute Forwarding Rules | `compute.forwardingRules.list` | `compute.googleapis.com` |
| Compute Global Addresses | `compute.globalAddresses.list` | `compute.googleapis.com` |
| Compute Global Forwarding Rules | `compute.globalForwardingRules.list` | `compute.googleapis.com` |
| Compute Images | `compute.images.list`, `compute.images.getIamPolicy` | `compute.googleapis.com` |
| Compute Instances | `compute.instances.list`, `osconfig.inventories.get` | `compute.googleapis.com`, `osconfig.googleapis.com` |
| Compute Load Balancers | `compute.urlMaps.list` | `compute.googleapis.com` |
| Compute Project | `compute.projects.get` | `compute.googleapis.com` |
| Compute Region Backend Services | `compute.regionBackendServices.list` | `compute.googleapis.com` |
| Compute Region Load Balancers | `compute.regionUrlMaps.list` | `compute.googleapis.com` |
| Compute Region Target HTTP Proxies | `compute.regionTargetHttpProxies.list` | `compute.googleapis.com` |
| Compute Region Target HTTPS Proxies | `compute.regionTargetHttpsProxies.list` | `compute.googleapis.com` |
| Compute SSL Policies | `compute.sslPolicies.list` | `compute.googleapis.com` |
| Compute Subnetworks | `compute.subnetworks.list` | `compute.googleapis.com` |
| Compute Target HTTP Proxies | `compute.targetHttpProxies.list` | `compute.googleapis.com` |
| Compute Target HTTPS Proxies | `compute.targetHttpsProxies.list` | `compute.googleapis.com` |
| Compute Target Pools | `compute.targetPools.list` | `compute.googleapis.com` |
| Compute Target SSL Proxies | `compute.targetSslProxies.list` | `compute.googleapis.com` |
| Container Clusters | `container.clusters.list` | `container.googleapis.com` |
| DLP Table Data Profiles | `dlp.tableDataProfiles.list` | `dlp.googleapis.com` |
| DNS Managed Zone Records | `dns.resourceRecordSets.list` | `dns.googleapis.com` |
| DNS Policies | `dns.policies.list` | `dns.googleapis.com` |
| Essential Contacts | `essentialcontacts.contacts.list` | `essentialcontacts.googleapis.com` |
| External VPN Gateways | `compute.externalVpnGateways.list` | `compute.googleapis.com` |
| Fetch Cloud Build BitBucket Server Repos | `cloudbuild.repositories.list`, `cloudbuild.repositories.get` | `cloudbuild.googleapis.com` |
| Fetch Scan Runs | `cloudsecurityscanner.scanruns.list` | `websecurityscanner.googleapis.com` |
| Fetch Secret Manager secret versions | `secretmanager.versions.list` | `secretmanager.googleapis.com` |
| Fetch Security Command Center Findings | `securitycenter.findings.list` | `securitycenter.googleapis.com` |
| Fetch SQL Admin Backups | `cloudsql.backupRuns.list` | `cloudsql.googleapis.com` |
| Fetch SQL Admin Instance Databases | `cloudsql.databases.list` | `sqladmin.googleapis.com` |
| Fetch SQL Admin Instance Users | `cloudsql.users.list` | `sqladmin.googleapis.com` |
| Fetch SQL Admin SSL Certs | `cloudsql.sslCerts.list` | `cloudsql.googleapis.com` |
| fetch-alloydb-postgre-sql-connection | `alloydb.instances.connect` | `alloydb.googleapis.com` |
| fetch-alloydb-postgre-sql-instance | `alloydb.instances.list` | `alloydb.googleapis.com` |
| Firestore Service Database Relationships | \- | \- |
| google\_cloud\_workflow\_uses\_iam\_service\_account | \- | \- |
| IAP Backend Service Bindings | `iap.webServices.getIamPolicy` | `iap.googleapis.com` |
| KMS Crypto Keys | `cloudkms.cryptoKeys.list`, `cloudkms.cryptoKeys.getIamPolicy` | `cloudkms.googleapis.com` |
| Logging Metrics | `logging.logMetrics.list` | `logging.googleapis.com` |
| Network Has VPN Gateway Relationships | \- | \- |
| Private CA Certificate Authorities | `privateca.certificateAuthorities.getIamPolicy`, `privateca.certificateAuthorities.list` | `privateca.googleapis.com` |
| Private CA Certificates | `privateca.certificates.list` | `privateca.googleapis.com` |
| PubSub Subscriptions | `pubsub.subscriptions.list` | `pubsub.googleapis.com` |
| Resource Manager Folders | `resourcemanager.folders.list` | `resourcemanager.googleapis.com` |
| Resource Manager Projects | `resourcemanager.projects.list` | `resourcemanager.googleapis.com` |
| Resource Manager Skipped and Deleted Projects | `resourcemanager.projects.get` | `resourcemanager.googleapis.com` |
| Spanner Instance Databases | `spanner.databases.list` | `spanner.googleapis.com` |
| Spanner Instance Databases Role | `spanner.databasesRoles.list` | `spanner.googleapis.com` |
| Spanner Instances | `spanner.instances.list`, `spanner.databases.getIamPolicy` | `spanner.googleapis.com` |
| SQL Admin Instances | `cloudsql.instances.list` | `cloudsql.googleapis.com` |
| Target VPN Gateways | `compute.targetVpnGateways.list` | `compute.googleapis.com` |
| Vertex AI Endpoint Model Relationships | \- | \- |
| VPN Gateway Has Tunnel Relationships | \- | \- |
| VPN Tunnel Uses Router Relationships | \- | \- |
| VPN Tunnels | `compute.vpnTunnels.list` | `compute.googleapis.com` |
| Workflows Service Workflow Relationships | \- | \- |
| Workstations | `workstations.workstations.list` | `workstations.googleapis.com` |
| Workstations Clusters | `workstations.clusters.list` | `workstations.googleapis.com` |
| Workstations Configurations | `workstations.configs.list` | `workstations.googleapis.com` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Access Approval Settings | `google_cloud_access_approval_settings` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Access Context Manager Access Level | `google_access_context_manager_access_level` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| Access Context Manager Access Level Condition | `google_access_context_manager_access_level_condition` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Access Context Manager Access Policy | `google_access_context_manager_access_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Access Context Manager Service Perimeter | `google_access_context_manager_service_perimeter` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Access Context Manager Service Perimeter Api Operation | `google_access_context_manager_service_perimeter_api_operation` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Access Context Manager Service Perimeter Egress Policy | `google_access_context_manager_service_perimeter_egress_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Access Context Manager Service Perimeter Ingress Policy | `google_access_context_manager_service_perimeter_ingress_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Access Context Manager Service Perimeter Method Selector | `google_access_context_manager_service_perimeter_method_selector` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AlloyDB for PostgreSQL | `google_cloud_alloydb` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AlloyDB for PostgreSQL Backup | `google_cloud_alloydb_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AlloyDB for PostgreSQL Cluster | `google_cloud_alloydb_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AlloyDB for PostgreSQL Connection | `google_cloud_alloydb_connection` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AlloyDB for PostgreSQL Instances | `google_cloud_alloydb_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Api Gateway Api | `google_api_gateway_api` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Api Gateway Api Config | `google_api_gateway_api_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Api Gateway Gateway | `google_api_gateway_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| API Key | `google_api_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| AppEngine Application | `google_app_engine_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AppEngine Instance | `google_app_engine_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AppEngine Service | `google_app_engine_service` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| AppEngine Version | `google_app_engine_version` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AppEngine Version Handler | `google_app_engine_version_handler` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Artifact Registry | `google_cloud_artifact_registry` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Artifact Registry Repository | `google_cloud_artifact_registry_repository` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo), [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| Artifact Registry VPCSC configuration | `google_cloud_artifact_registry_vpcsc_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Artifact Registry VPCSC Policy | `google_cloud_artifact_registry_vpcsc_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Artifact Repository Package | `google_cloud_artifact_registry_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Audit Config | `google_cloud_audit_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Big Query Dataset | `google_bigquery_dataset` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Big Query Model | `google_bigquery_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| Big Query Table | `google_bigquery_table` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| Bigtable AppProfile | `google_bigtable_app_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Bigtable Backup | `google_bigtable_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Bigtable Cluster | `google_bigtable_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Bigtable Instance | `google_bigtable_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Bigtable Table | `google_bigtable_table` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| Billing Account | `google_billing_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Billing Budget | `google_billing_budget` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| Binary Authorization Policy | `google_binary_authorization_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Cloud API Service | `google_cloud_api_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Build | `google_cloud_build` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| Cloud Build BitBucket Server Config | `google_cloud_bitbucket_server_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Build BitBucket Server Repo | `google_cloud_bitbucket_server_repo` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Cloud Build GitHub Enterprise Config | `google_cloud_github_enterprise_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Build Trigger | `google_cloud_build_trigger` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Cloud Build Worker Pool | `google_cloud_build_worker_pool` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Cloud Compute Router | `google_cloud_compute_router` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Cloud Deploy Automation | `google_cloud_deploy_automation` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Cloud Deploy Delivery Pipeline | `google_cloud_deploy_delivery_pipeline` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| Cloud Deploy Service | `google_cloud_deploy_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Function | `google_cloud_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| Cloud Identity Device Users | `google_cloud_identity_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Cloud Identity Devices | `google_cloud_identity_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Cloud Identity Groups | `google_cloud_identity_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Cloud Identity Membership Roles | `google_cloud_identity_member_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Cloud Identity SSO Profile | `google_cloud_sso` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Identity SSO Saml Provider | `google_cloud_identity_saml_provider` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Run Configuration | `google_cloud_run_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Run Route | `google_cloud_run_route` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Run Service | `google_cloud_run_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Source Repository | `google_cloud_source_repository` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Cloud Spanner | `google_cloud_spanner` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Spanner Backups | `google_cloud_spanner_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Cloud Storage Bucket | `google_storage_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Compute Address | `google_compute_address` | [IpAddress](https://docs.jupiterone.io/data-model/schemas/IpAddress) |
| Compute Backend Bucket | `google_compute_backend_bucket` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Compute Backend Service | `google_compute_backend_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Compute Disk | `google_compute_disk` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| Compute Firewalls | `google_compute_firewall` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Compute Forwarding Rule | `google_compute_forwarding_rule` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Compute Global Address | `google_compute_global_address` | [IpAddress](https://docs.jupiterone.io/data-model/schemas/IpAddress) |
| Compute Global Forwarding Rule | `google_compute_global_forwarding_rule` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Compute Health Check | `google_compute_health_check` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Compute Image | `google_compute_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Compute Instance | `google_compute_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Compute Instance Group | `google_compute_instance_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Compute Instance Group Named Port | `google_compute_instance_group_named_port` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Compute Networks | `google_compute_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Compute Project | `google_compute_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Compute Region Load Balancer | `google_compute_url_map` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Compute Region Target HTTP Proxy | `google_compute_target_http_proxy` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Compute Security Policy | `google_compute_security_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Compute Snapshot | `google_compute_snapshot` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Compute SSL Policy | `google_compute_ssl_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Compute Subnetwork | `google_compute_subnetwork` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Compute Target HTTPS Proxy | `google_compute_target_https_proxy` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Compute Target Pool | `google_compute_target_pool` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Compute Target SSL Proxy | `google_compute_target_ssl_proxy` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Container Cluster | `google_container_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Container Node Pool | `google_container_node_pool` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Dataproc Cluster | `google_dataproc_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| DLP Discovery Config | `google_dlp_discovery_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| DLP Table Data Profile | `google_dlp_table_data_profile` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| DNS Managed Zone | `google_dns_managed_zone` | [DomainZone](https://docs.jupiterone.io/data-model/schemas/DomainZone) |
| DNS Managed Zone Record | `google_dns_managed_zone_record` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |
| DNS Policy | `google_dns_policy` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| Essential Contact | `google_essential_contact` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Folder | `google_cloud_folder` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Google Cloud Filestore Instance | `google_cloud_filestore_instance` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Google Cloud Filestore Service | `google_cloud_filestore_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Google Cloud Firestore Database | `google_cloud_firestore_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Google Cloud Firestore Service | `google_cloud_firestore_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Google Cloud Vertex AI Batch Prediction Job | `google_cloud_vertex_ai_batch_prediction_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Google Cloud Vertex AI Dataset | `google_cloud_vertex_ai_dataset` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| Google Cloud Vertex AI Endpoint | `google_cloud_vertex_ai_endpoint` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Google Cloud Vertex AI Model | `google_cloud_vertex_ai_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| Google Cloud Vertex AI Service | `google_cloud_vertex_ai_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Google Cloud Vertex AI Training Pipeline | `google_cloud_vertex_ai_training_pipeline` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| Google Cloud VPN Service | `google_cloud_vpn_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Google Cloud Workflow | `google_cloud_workflow` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| Google Cloud Workflows Service | `google_cloud_workflows_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Google Cloud Workstation | `google_cloud_workstation` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Google Cloud Workstations Cluster | `google_cloud_workstations_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Google Cloud Workstations Configuration | `google_cloud_workstations_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Google Cloud Workstations Service | `google_cloud_workstations_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Google Compute External VPN Gateway | `google_compute_external_vpn_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Google Compute HA VPN Gateway | `google_compute_vpn_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Google Compute Target VPN Gateway | `google_compute_target_vpn_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Google Compute VPN Tunnel | `google_compute_vpn_tunnel` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| IAM Binding | `google_iam_binding` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| IAM Custom Role | `google_iam_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| IAM Service Account | `google_iam_service_account` | [User](https://docs.jupiterone.io/data-model/schemas/User), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAM Service Account Key | `google_iam_service_account_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAP Binding | `google_iap_binding` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| KMS Crypto Key | `google_kms_crypto_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key), [CryptoKey](https://docs.jupiterone.io/data-model/schemas/CryptoKey) |
| KMS Key Ring | `google_kms_key_ring` | [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |
| Logging Metric | `google_logging_metric` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Logging Project Sink | `google_logging_project_sink` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| Memcache Instance | `google_memcache_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Memcache Instance Node | `google_memcache_instance_node` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Monitoring Alert Policy | `google_monitoring_alert_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Organization | `google_cloud_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Private CA Certificate | `google_privateca_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| Private CA Certificate Authority | `google_privateca_certificate_authority` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Private CA Pool | `google_privateca_pool` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Project | `google_cloud_project` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| PubSub Subscription | `google_pubsub_subscription` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| PubSub Topic | `google_pubsub_topic` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| Redis Instance | `google_redis_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Scan Config | `google_cloud_scan_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Scan Run | `google_cloud_scan_run` | [Process](https://docs.jupiterone.io/data-model/schemas/Process), [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Secret | `google_secret_manager_secret` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Secret Version | `google_secret_manager_secret_version` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Security Command Center Finding | `google_cloud_security_command_center_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Spanner Instance | `google_spanner_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Spanner Instance Config | `google_spanner_instance_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Spanner Instance Database | `google_spanner_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Spanner Instance Database Role | `google_cloud_spanner_database_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| SQL Admin MySQL Instance | `google_sql_mysql_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| SQL Admin MySQL Instance Backup | `google_sql_mysql_instance_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| SQL Admin MySQL Instance Cert | `google_sql_mysql_instance_cert` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| SQL Admin MySQL Instance Database | `google_sql_mysql_instance_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| SQL Admin MySQL Instance User | `google_sql_mysql_instance_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| SQL Admin Postgres Instance | `google_sql_postgres_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| SQL Admin Postgres Instance Backup | `google_sql_postgres_instance_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| SQL Admin Postgres Instance Cert | `google_sql_postgres_instance_cert` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| SQL Admin Postgres Instance Database | `google_sql_postgres_instance_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| SQL Admin Postgres Instance User | `google_sql_postgres_instance_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| SQL Admin SQL Server Instance | `google_sql_sql_server_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| SQL Admin SQL Server Instance Backup | `google_sql_sql_server_instance_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| SQL Admin SQL Server Instance Database | `google_sql_sql_server_instance_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| SQL Admin SQL Server Instance User | `google_sql_sql_server_instance_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `google_access_context_manager_access_level` | **DEFINES** | `google_access_context_manager_access_level_condition` |
| `google_access_context_manager_access_policy` | **HAS** | `google_access_context_manager_access_level` |
| `google_access_context_manager_access_policy` | **HAS** | `google_access_context_manager_service_perimeter` |
| `google_access_context_manager_service_perimeter` | **HAS** | `google_access_context_manager_service_perimeter_egress_policy` |
| `google_access_context_manager_service_perimeter` | **HAS** | `google_access_context_manager_service_perimeter_ingress_policy` |
| `google_access_context_manager_service_perimeter_api_operation` | **HAS** | `google_access_context_manager_service_perimeter_method_selector` |
| `google_access_context_manager_service_perimeter_egress_policy` | **HAS** | `google_access_context_manager_service_perimeter_api_operation` |
| `google_access_context_manager_service_perimeter_ingress_policy` | **HAS** | `google_access_context_manager_service_perimeter_api_operation` |
| `google_access_context_manager_service_perimeter_ingress_policy` | **ALLOWS** | `google_access_context_manager_access_level` |
| `google_api_gateway_api` | **USES** | `google_api_gateway_api_config` |
| `google_api_gateway_api` | **HAS** | `google_api_gateway_gateway` |
| `google_api_gateway_api_config` | **USES** | `google_iam_service_account` |
| `google_app_engine_application` | **USES** | `google_storage_bucket` |
| `google_app_engine_application` | **HAS** | `google_app_engine_service` |
| `google_app_engine_service` | **HAS** | `google_app_engine_version` |
| `google_app_engine_version` | **HAS** | `google_app_engine_version_handler` |
| `google_app_engine_version` | **HAS** | `google_app_engine_instance` |
| `google_bigquery_dataset` | **USES** | `google_kms_crypto_key` |
| `google_bigquery_dataset` | **HAS** | `google_bigquery_model` |
| `google_bigquery_dataset` | **HAS** | `google_bigquery_table` |
| `google_bigtable_cluster` | **USES** | `google_kms_crypto_key` |
| `google_bigtable_cluster` | **HAS** | `google_bigtable_backup` |
| `google_bigtable_instance` | **HAS** | `google_bigtable_app_profile` |
| `google_bigtable_instance` | **HAS** | `google_bigtable_cluster` |
| `google_bigtable_instance` | **HAS** | `google_bigtable_table` |
| `google_bigtable_table` | **HAS** | `google_bigtable_backup` |
| `google_billing_account` | **HAS** | `google_billing_budget` |
| `google_cloud_alloydb_cluster` | **HAS** | `google_cloud_alloydb_backup` |
| `google_cloud_alloydb_cluster` | **USES** | `google_kms_crypto_key` |
| `google_cloud_alloydb_instance` | **USES** | `google_cloud_alloydb_cluster` |
| `google_cloud_alloydb_instance` | **HAS** | `google_cloud_alloydb_connection` |
| `google_cloud_api_service` | **HAS** | `google_iam_role` |
| `google_cloud_api_service` | **HAS** | `resource` |
| `google_cloud_api_service` | **USES** | `google_cloud_audit_config` |
| `google_cloud_artifact_registry_repository` | **USES** | `google_kms_crypto_key` |
| `google_cloud_artifact_registry_repository` | **USES** | `google_cloud_artifact_registry_package` |
| `google_cloud_artifact_registry_vpcsc_configuration` | **ASSIGNED** | `google_cloud_artifact_registry_vpcsc_policy` |
| `google_cloud_audit_config` | **ALLOWS** | `google_iam_service_account` |
| `google_cloud_audit_config` | **ALLOWS** | `google_user` |
| `google_cloud_audit_config` | **ALLOWS** | `google_group` |
| `google_cloud_audit_config` | **ALLOWS** | `google_domain` |
| `google_cloud_bitbucket_server_config` | **HAS** | `google_cloud_bitbucket_server_repo` |
| `google_cloud_build` | **USES** | `google_storage_bucket` |
| `google_cloud_build` | **USES** | `google_cloud_source_repository` |
| `google_cloud_build_trigger` | **TRIGGERS** | `google_cloud_build` |
| `google_cloud_compute_router` | **USES** | `google_compute_address` |
| `google_cloud_deploy_automation` | **TRIGGERS** | `google_cloud_deploy_delivery_pipeline` |
| `google_cloud_deploy_delivery_pipeline` | **USES** | `google_storage_bucket` |
| `google_cloud_deploy_service` | **HAS** | `google_cloud_deploy_delivery_pipeline` |
| `google_cloud_filestore_instance` | **USES** | `google_compute_network` |
| `google_cloud_filestore_service` | **HAS** | `google_cloud_filestore_instance` |
| `google_cloud_firestore_service` | **HAS** | `google_cloud_firestore_database` |
| `google_cloud_folder` | **HAS** | `google_cloud_folder` |
| `google_cloud_folder` | **HAS** | `google_cloud_project` |
| `google_cloud_function` | **USES** | `google_iam_service_account` |
| `google_cloud_function` | **USES** | `google_cloud_source_repository` |
| `google_cloud_function` | **USES** | `google_storage_bucket` |
| `google_cloud_function` | **USES** | `google_secret_manager_secret` |
| `google_cloud_identity_group` | **ASSIGNED** | `google_cloud_identity_member_role` |
| `google_cloud_identity_saml_provider` | **USES** | `google_cloud_identity_group` |
| `google_cloud_identity_user` | **IS** | `google_user` |
| `google_cloud_identity_user` | **USES** | `google_cloud_identity_device` |
| `google_cloud_organization` | **HAS** | `google_cloud_folder` |
| `google_cloud_organization` | **HAS** | `google_cloud_project` |
| `google_cloud_organization` | **HAS** | `google_essential_contact` |
| `google_cloud_organization` | **HAS** | `google_cloud_access_approval_settings` |
| `google_cloud_project` | **HAS** | `google_cloud_api_service` |
| `google_cloud_project` | **HAS** | `google_iam_service_account` |
| `google_cloud_project` | **CONTAINS** | `google_sql_postgres_instance` |
| `google_cloud_project` | **CONTAINS** | `google_sql_mysql_instance` |
| `google_cloud_project` | **CONTAINS** | `google_sql_sql_server_instance` |
| `google_cloud_project` | **HAS** | `google_binary_authorization_policy` |
| `google_cloud_project` | **HAS** | `google_spanner_instance` |
| `google_cloud_project` | **HAS** | `google_spanner_instance_config` |
| `google_cloud_project` | **HAS** | `google_cloud_spanner` |
| `google_cloud_project` | **HAS** | `google_billing_budget` |
| `google_cloud_project` | **HAS** | `google_cloud_deploy_service` |
| `google_cloud_project` | **HAS** | `google_cloud_alloydb_cluster` |
| `google_cloud_project` | **HAS** | `google_cloud_artifact_registry_repository` |
| `google_cloud_project` | **HAS** | `google_cloud_artifact_registry` |
| `google_cloud_project` | **USES** | `google_cloud_artifact_registry_vpcsc_configuration` |
| `google_cloud_project` | **ASSIGNED** | `google_cloud_artifact_registry_vpcsc_policy` |
| `google_cloud_project` | **HAS** | `google_api_key` |
| `google_cloud_run_service` | **MANAGES** | `google_cloud_run_route` |
| `google_cloud_run_service` | **MANAGES** | `google_cloud_run_configuration` |
| `google_cloud_scan_config` | **PERFORMED** | `google_cloud_scan_run` |
| `google_cloud_sso` | **ASSIGNED** | `google_cloud_identity_group` |
| `google_cloud_vertex_ai_endpoint` | **CONTAINS** | `google_cloud_vertex_ai_model` |
| `google_cloud_vertex_ai_service` | **HAS** | `google_cloud_vertex_ai_model` |
| `google_cloud_vertex_ai_service` | **HAS** | `google_cloud_vertex_ai_endpoint` |
| `google_cloud_vertex_ai_service` | **HAS** | `google_cloud_vertex_ai_dataset` |
| `google_cloud_vertex_ai_service` | **HAS** | `google_cloud_vertex_ai_training_pipeline` |
| `google_cloud_vertex_ai_service` | **HAS** | `google_cloud_vertex_ai_batch_prediction_job` |
| `google_cloud_vpn_service` | **HAS** | `google_compute_vpn_gateway` |
| `google_cloud_vpn_service` | **HAS** | `google_compute_target_vpn_gateway` |
| `google_cloud_vpn_service` | **HAS** | `google_compute_external_vpn_gateway` |
| `google_cloud_vpn_service` | **HAS** | `google_compute_vpn_tunnel` |
| `google_cloud_workflow` | **USES** | `google_iam_service_account` |
| `google_cloud_workflows_service` | **HAS** | `google_cloud_workflow` |
| `google_cloud_workstation` | **USES** | `google_cloud_workstations_configuration` |
| `google_cloud_workstations_cluster` | **HAS** | `google_cloud_workstations_configuration` |
| `google_cloud_workstations_cluster` | **HAS** | `google_cloud_workstation` |
| `google_cloud_workstations_cluster` | **USES** | `google_compute_network` |
| `google_cloud_workstations_service` | **HAS** | `google_cloud_workstations_cluster` |
| `google_compute_backend_bucket` | **HAS** | `google_storage_bucket` |
| `google_compute_backend_service` | **HAS** | `google_compute_instance_group` |
| `google_compute_backend_service` | **HAS** | `google_compute_health_check` |
| `google_compute_backend_service` | **HAS** | `google_compute_target_ssl_proxy` |
| `google_compute_disk` | **CREATED** | `google_compute_snapshot` |
| `google_compute_disk` | **USES** | `google_compute_image` |
| `google_compute_disk` | **USES** | `google_kms_crypto_key` |
| `google_compute_firewall` | **PROTECTS** | `google_compute_network` |
| `google_compute_forwarding_rule` | **USES** | `google_compute_address` |
| `google_compute_forwarding_rule` | **CONNECTS** | `google_compute_backend_service` |
| `google_compute_forwarding_rule` | **CONNECTS** | `google_compute_subnetwork` |
| `google_compute_forwarding_rule` | **CONNECTS** | `google_compute_network` |
| `google_compute_forwarding_rule` | **CONNECTS** | `google_compute_target_http_proxy` |
| `google_compute_forwarding_rule` | **CONNECTS** | `google_compute_target_https_proxy` |
| `google_compute_forwarding_rule` | **CONNECTS** | `google_compute_target_pool` |
| `google_compute_global_forwarding_rule` | **CONNECTS** | `google_compute_backend_service` |
| `google_compute_global_forwarding_rule` | **CONNECTS** | `google_compute_subnetwork` |
| `google_compute_global_forwarding_rule` | **CONNECTS** | `google_compute_network` |
| `google_compute_global_forwarding_rule` | **CONNECTS** | `google_compute_target_http_proxy` |
| `google_compute_global_forwarding_rule` | **CONNECTS** | `google_compute_target_https_proxy` |
| `google_compute_image` | **USES** | `google_compute_image` |
| `google_compute_image` | **USES** | `google_kms_crypto_key` |
| `google_compute_instance` | **USES** | `google_compute_address` |
| `google_compute_instance` | **USES** | `google_compute_disk` |
| `google_compute_instance` | **TRUSTS** | `google_iam_service_account` |
| `google_compute_instance` | **HAS** | `google_cloud_security_command_center_finding` |
| `google_compute_instance_group` | **HAS** | `google_compute_instance_group_named_port` |
| `google_compute_instance_group` | **HAS** | `google_compute_instance` |
| `google_compute_network` | **CONTAINS** | `google_compute_subnetwork` |
| `google_compute_network` | **HAS** | `google_compute_address` |
| `google_compute_network` | **HAS** | `google_compute_global_address` |
| `google_compute_network` | **HAS** | `google_compute_firewall` |
| `google_compute_network` | **CONNECTS** | `google_compute_network` |
| `google_compute_network` | **HAS** | `google_cloud_compute_router` |
| `google_compute_network` | **HAS** | `google_dns_policy` |
| `google_compute_network` | **HAS** | `google_compute_vpn_gateway` |
| `google_compute_network` | **HAS** | `google_compute_target_vpn_gateway` |
| `google_compute_project` | **HAS** | `google_compute_instance` |
| `google_compute_security_policy` | **PROTECTS** | `google_compute_backend_service` |
| `google_compute_snapshot` | **CREATED** | `google_compute_image` |
| `google_compute_subnetwork` | **HAS** | `google_compute_address` |
| `google_compute_subnetwork` | **HAS** | `google_compute_global_address` |
| `google_compute_subnetwork` | **HAS** | `google_compute_instance` |
| `google_compute_target_https_proxy` | **HAS** | `google_compute_ssl_policy` |
| `google_compute_target_pool` | **HAS** | `google_compute_instance` |
| `google_compute_target_ssl_proxy` | **HAS** | `google_compute_ssl_policy` |
| `google_compute_target_vpn_gateway` | **HAS** | `google_compute_vpn_tunnel` |
| `google_compute_url_map` | **HAS** | `google_compute_backend_service` |
| `google_compute_url_map` | **HAS** | `google_compute_backend_bucket` |
| `google_compute_url_map` | **HAS** | `google_compute_target_https_proxy` |
| `google_compute_url_map` | **HAS** | `google_compute_target_http_proxy` |
| `google_compute_vpn_gateway` | **HAS** | `google_compute_vpn_tunnel` |
| `google_compute_vpn_tunnel` | **USES** | `google_cloud_compute_router` |
| `google_container_cluster` | **HAS** | `google_container_node_pool` |
| `google_container_cluster` | **HAS** | `google_cloud_security_command_center_finding` |
| `google_container_node_pool` | **HAS** | `google_compute_instance_group` |
| `google_dataproc_cluster` | **USES** | `google_kms_crypto_key` |
| `google_dataproc_cluster` | **USES** | `google_compute_image` |
| `google_dataproc_cluster` | **USES** | `google_storage_bucket` |
| `google_dlp_discovery_config` | **HAS** | `google_dlp_table_data_profile` |
| `google_dlp_table_data_profile` | **HAS** | `google_bigquery_table` |
| `google_dns_managed_zone` | **HAS** | `google_dns_managed_zone_record` |
| `google_iam_binding` | **ASSIGNED** | `google_domain` |
| `google_iam_binding` | **ASSIGNED** | `google_iam_service_account` |
| `google_iam_binding` | **ASSIGNED** | `google_group` |
| `google_iam_binding` | **ASSIGNED** | `google_user` |
| `google_iam_binding` | **ASSIGNED** | `google_cloud_authenticated_users` |
| `google_iam_binding` | **ASSIGNED** | `everyone` |
| `google_iam_binding` | **ASSIGNED** | `google_iam_role` |
| `google_iam_binding` | **USES** | `google_iam_role` |
| `google_iam_binding` | **ALLOWS** | `resource` |
| `google_iam_service_account` | **HAS** | `google_iam_service_account_key` |
| `google_iam_service_account` | **CREATED** | `google_app_engine_version` |
| `google_iap_binding` | **ALLOWS** | `google_compute_backend_service` |
| `google_iap_binding` | **USES** | `google_iam_role` |
| `google_iap_binding` | **ASSIGNED** | `google_iam_service_account` |
| `google_iap_binding` | **ASSIGNED** | `google_user` |
| `google_iap_binding` | **ASSIGNED** | `google_group` |
| `google_iap_binding` | **ASSIGNED** | `google_domain` |
| `google_kms_key_ring` | **HAS** | `google_kms_crypto_key` |
| `google_logging_metric` | **HAS** | `google_monitoring_alert_policy` |
| `google_logging_project_sink` | **USES** | `google_storage_bucket` |
| `google_memcache_instance` | **HAS** | `google_memcache_instance_node` |
| `google_memcache_instance` | **USES** | `google_compute_network` |
| `google_privateca_certificate_authority` | **CREATED** | `google_privateca_certificate` |
| `google_privateca_certificate_authority` | **USES** | `google_storage_bucket` |
| `google_privateca_pool` | **HAS** | `google_privateca_certificate_authority` |
| `google_pubsub_subscription` | **USES** | `google_pubsub_topic` |
| `google_pubsub_topic` | **USES** | `google_kms_crypto_key` |
| `google_redis_instance` | **USES** | `google_compute_network` |
| `google_secret_manager_secret` | **HAS** | `google_secret_manager_secret_version` |
| `google_spanner_database` | **USES** | `google_kms_crypto_key` |
| `google_spanner_database` | **ASSIGNED** | `google_cloud_spanner_database_role` |
| `google_spanner_instance` | **USES** | `google_spanner_instance_config` |
| `google_spanner_instance` | **HAS** | `google_spanner_database` |
| `google_spanner_instance` | **HAS** | `google_cloud_spanner_backup` |
| `google_sql_mysql_instance` | **CONNECTS** | `google_kms_crypto_key` |
| `google_sql_mysql_instance` | **USES** | `google_iam_service_account` |
| `google_sql_mysql_instance` | **HAS** | `google_sql_mysql_instance_user` |
| `google_sql_mysql_instance` | **HAS** | `google_sql_mysql_instance_database` |
| `google_sql_mysql_instance` | **HAS** | `google_sql_mysql_instance_backup` |
| `google_sql_mysql_instance` | **HAS** | `google_sql_mysql_instance_cert` |
| `google_sql_mysql_instance` | **USES** | `google_kms_crypto_key` |
| `google_sql_postgres_instance` | **CONNECTS** | `google_kms_crypto_key` |
| `google_sql_postgres_instance` | **USES** | `google_iam_service_account` |
| `google_sql_postgres_instance` | **HAS** | `google_sql_postgres_instance_user` |
| `google_sql_postgres_instance` | **HAS** | `google_sql_postgres_instance_database` |
| `google_sql_postgres_instance` | **HAS** | `google_sql_postgres_instance_backup` |
| `google_sql_postgres_instance` | **HAS** | `google_sql_postgres_instance_cert` |
| `google_sql_postgres_instance` | **USES** | `google_kms_crypto_key` |
| `google_sql_sql_server_instance` | **CONNECTS** | `google_kms_crypto_key` |
| `google_sql_sql_server_instance` | **HAS** | `google_sql_sql_server_instance_user` |
| `google_sql_sql_server_instance` | **HAS** | `google_sql_sql_server_instance_database` |
| `google_sql_sql_server_instance` | **HAS** | `google_sql_sql_server_instance_backup` |
| `google_sql_sql_server_instance` | **USES** | `google_kms_crypto_key` |
| `google_user` | **CREATED** | `google_app_engine_version` |
| `google_user` | **ASSIGNED** | `google_cloud_alloydb_cluster` |
| `internet` | **ALLOWS** | `google_compute_firewall` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `google_access_context_manager_service_perimeter` | **PROTECTS** | `google_cloud_project` | FORWARD |
| `google_access_context_manager_service_perimeter` | **LIMITS** | `google_cloud_api_service` | FORWARD |
| `google_cloud_build_trigger` | **USES** | `github_repo` | FORWARD |
| `google_cloud_deploy_delivery_pipeline` | **USES** | `github_repo` | FORWARD |

### Google Api Key

`google_api_key` inherits from [AccessKey](/data-model/schemas/AccessKey.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`androidKeyRestrictions.allowedApplications` \*

 | `array` **|** `null` |  |  |
| `assetName` | `string` |  |  |
| 

`browserKeyRestrictions.allowedReferrers` \*

 | `array` **|** `null` |  |  |
| `createdOn` | `number` |  |  |
| `deletedOn` | `number` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| 

`iosKeyRestrictions.allowedBundleIds` \*

 | `array` **|** `null` |  |  |
| 

`serverKeyRestrictions.allowedIps` \*

 | `array` **|** `null` |  |  |
| 

`uid` \*

 | `string` **|** `null` |  |  |
| `updatedOn` | `number` |  |  |

---

### Google Cloud Access Approval Settings

`google_cloud_access_approval_settings` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`activeKeyVersion` \*

 | `string` **|** `null` |  |  |
| 

`ancestorHasActiveKeyVersion` \*

 | `boolean` |  |  |
| 

`enrolledAncestor` \*

 | `boolean` |  |  |
| 

`enrolledServices` \*

 | `array` **|** `null` |  |  |
| 

`enrollmentCount` \*

 | `number` |  |  |
| 

`enrollmentLevel` \*

 | `string` **|** `null` |  |  |
| 

`hasAllServicesEnrolled` \*

 | `boolean` **|** `null` |  |  |
| 

`hasNotificationEmails` \*

 | `boolean` |  |  |
| 

`invalidKeyVersion` \*

 | `boolean` |  |  |
| 

`isConfigured` \*

 | `boolean` |  |  |
| 

`notificationEmailCount` \*

 | `number` |  |  |
| 

`notificationEmails` \*

 | `array` of `string`s |  |  |
| 

`notificationPubsubTopic` \*

 | `string` **|** `null` |  |  |
| 

`preferNoBroadApprovalRequests` \*

 | `boolean` **|** `null` |  |  |
| 

`preferredRequestExpirationDays` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceType` \*

 | `string` |  | **Any of**:

-   `organization`

-   `project`

-   `folder`

 |

---

### Google Cloud Filestore Instance

`google_cloud_filestore_instance` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetName` \*

 | `string` **|** `null` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| 

`fileShareNames` \*

 | `array` **|** `null` |  |  |
| 

`isSatisfyingPzi` \*

 | `boolean` **|** `null` |  |  |
| 

`kmsKeyName` \*

 | `string` **|** `null` |  |  |
| 

`networkNames` \*

 | `array` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`statusMessage` \*

 | `string` **|** `null` |  |  |
| 

`suspensionReasons` \*

 | `array` **|** `null` |  |  |
| 

`tier` \*

 | `string` **|** `null` |  |  |
| 

`zone` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Filestore Service

`google_cloud_filestore_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`organizationId` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Firestore Database

`google_cloud_firestore_database` inherits from [Database](/data-model/schemas/Database.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`appEngineIntegrationMode` \*

 | `string` **|** `null` |  |  |
| 

`assetName` \*

 | `string` **|** `null` |  |  |
| 

`concurrencyMode` \*

 | `string` **|** `null` |  |  |
| 

`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`keyPrefix` \*

 | `string` **|** `null` |  |  |
| 

`locationId` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |
| 

`updatedOn` \*

 | `number` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Firestore Service

`google_cloud_firestore_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Security Command Center Finding

`google_cloud_security_command_center_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `canonicalName` | `string` |  |  |
| `createTimeOn` | `number` |  |  |
| `description` | `string` |  |  |
| `eventTimeOn` | `number` |  |  |
| `externalUri` | `string` |  |  |
| `findingClass` | `string` |  |  |
| `mute` | `string` |  |  |
| `muteUpdateTimeOn` | `number` |  |  |
| `name` | `string` |  |  |
| `parent` | `string` |  |  |
| `parentDisplayName` | `string` |  |  |
| `resourceName` | `string` |  |  |
| `securityMarksName` | `string` |  |  |
| `sourcePropertiesDescription` | `string` |  |  |
| `state` | `string` |  |  |
| `vulnerabilityCVEId` | `string` |  |  |
| `vulnerabilityCVEReferences` | `array` of `string`s |  |  |
| `vulnerabilityCvssv3AttackComplexity` | `string` |  |  |
| `vulnerabilityCvssv3AttackVector` | `string` |  |  |
| `vulnerabilityCvssv3AvailabilityImpact` | `string` |  |  |
| `vulnerabilityCvssv3BaseScoret` | `number` |  |  |
| `vulnerabilityCvssv3ConfidentialityImpact` | `string` |  |  |
| `vulnerabilityCvssv3IntegrityImpact` | `string` |  |  |
| `vulnerabilityCvssv3PrivilegesRequired` | `string` |  |  |
| `vulnerabilityCvssv3Scope` | `string` |  |  |
| `vulnerabilityCvssv3UserInteraction` | `string` |  |  |
| `vulnerabilityUpstreamFixAvailable` | `boolean` |  |  |

---

### Google Cloud Vertex Ai Batch Prediction Job

`google_cloud_vertex_ai_batch_prediction_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`acceleratorCount` \*

 | `number` **|** `null` |  |  |
| 

`acceleratorType` \*

 | `string` **|** `null` |  |  |
| `aiCategory` | `string` |  |  |
| `aiPlatform` | `string` |  |  |
| `assetName` | `string` |  |  |
| 

`batchSize` \*

 | `number` **|** `null` |  |  |
| 

`bigQueryOutputDataset` \*

 | `string` **|** `null` |  |  |
| 

`bigQueryOutputTable` \*

 | `string` **|** `null` |  |  |
| 

`endedOn` \*

 | `number` **|** `null` |  |  |
| 

`errorCode` \*

 | `number` **|** `null` |  |  |
| 

`errorMessage` \*

 | `string` **|** `null` |  |  |
| 

`failedCount` \*

 | `string` **|** `null` |  |  |
| 

`gcsOutputDirectory` \*

 | `string` **|** `null` |  |  |
| 

`hasExplanationSpec` \*

 | `boolean` **|** `null` |  |  |
| 

`incompleteCount` \*

 | `string` **|** `null` |  |  |
| 

`inputBigQuerySource` \*

 | `string` **|** `null` |  |  |
| 

`inputGcsSource` \*

 | `string` **|** `null` |  |  |
| `isAi` | `boolean` |  |  |
| 

`isContainerLoggingDisabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isExplanationGenerated` \*

 | `boolean` **|** `null` |  |  |
| 

`kmsKeyName` \*

 | `string` **|** `null` |  |  |
| 

`machineType` \*

 | `string` **|** `null` |  |  |
| 

`model` \*

 | `string` **|** `null` |  |  |
| 

`modelVersionId` \*

 | `string` **|** `null` |  |  |
| 

`outputBigQueryDestination` \*

 | `string` **|** `null` |  |  |
| 

`outputGcsDestination` \*

 | `string` **|** `null` |  |  |
| 

`partialFailureCount` \*

 | `number` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`replicaHours` \*

 | `number` **|** `null` |  |  |
| 

`serviceAccount` \*

 | `string` **|** `null` |  |  |
| 

`startedOn` \*

 | `number` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`successfulCount` \*

 | `string` **|** `null` |  |  |
| 

`unmanagedContainerImageUri` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Vertex Ai Dataset

`google_cloud_vertex_ai_dataset` inherits from [DataCollection](/data-model/schemas/DataCollection.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` |  |  |
| `aiPlatform` | `string` |  |  |
| `assetName` | `string` |  |  |
| 
`dataItemCount` \*

 | `string` **|** `null` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| `isAi` | `boolean` |  |  |
| 

`kmsKeyName` \*

 | `string` **|** `null` |  |  |
| 

`metadataArtifact` \*

 | `string` **|** `null` |  |  |
| 

`metadataSchemaUri` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`savedQueryCount` \*

 | `number` **|** `null` |  |  |
| 

`savedQueryNames` \*

 | `array` **|** `null` |  |  |

---

### Google Cloud Vertex Ai Endpoint

`google_cloud_vertex_ai_endpoint` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` |  |  |
| `aiPlatform` | `string` |  |  |
| `assetName` | `string` |  |  |
| 
`deployedModelCount` \*

 | `number` **|** `null` |  |  |
| 

`deployedModelIds` \*

 | `array` **|** `null` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| `isAi` | `boolean` |  |  |
| 

`isPrivateServiceConnectEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`kmsKeyName` \*

 | `string` **|** `null` |  |  |
| 

`modelDeploymentMonitoringJob` \*

 | `string` **|** `null` |  |  |
| 

`network` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Vertex Ai Model

`google_cloud_vertex_ai_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` |  |  |
| `aiPlatform` | `string` |  |  |
| 
`artifactUri` \*

 | `string` **|** `null` |  |  |
| `assetName` | `string` |  |  |
| 

`containerArgs` \*

 | `array` **|** `null` |  |  |
| 

`containerCommand` \*

 | `array` **|** `null` |  |  |
| 

`containerImageUri` \*

 | `string` **|** `null` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| 

`hasExplanationSpec` \*

 | `boolean` **|** `null` |  |  |
| `isAi` | `boolean` |  |  |
| 

`kmsKeyName` \*

 | `string` **|** `null` |  |  |
| 

`metadataArtifact` \*

 | `string` **|** `null` |  |  |
| 

`metadataSchemaUri` \*

 | `string` **|** `null` |  |  |
| 

`pipelineJob` \*

 | `string` **|** `null` |  |  |
| 

`predictionSchemaUri` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`supportedDeploymentResourcesTypes` \*

 | `array` **|** `null` |  |  |
| 

`supportedExportFormats` \*

 | `array` **|** `null` |  |  |
| 

`supportedInputStorageFormats` \*

 | `array` **|** `null` |  |  |
| 

`supportedOutputStorageFormats` \*

 | `array` **|** `null` |  |  |
| 

`trainingPipeline` \*

 | `string` **|** `null` |  |  |
| 

`versionAliases` \*

 | `array` **|** `null` |  |  |
| 

`versionCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`versionDescription` \*

 | `string` **|** `null` |  |  |
| 

`versionId` \*

 | `string` **|** `null` |  |  |
| 

`versionUpdatedOn` \*

 | `number` **|** `null` |  |  |

---

### Google Cloud Vertex Ai Service

`google_cloud_vertex_ai_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`organizationId` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Vertex Ai Training Pipeline

`google_cloud_vertex_ai_training_pipeline` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` |  |  |
| `aiPlatform` | `string` |  |  |
| `assetName` | `string` |  |  |
| 
`endedOn` \*

 | `number` **|** `null` |  |  |
| 

`errorCode` \*

 | `string` **|** `null` |  |  |
| 

`errorMessage` \*

 | `string` **|** `null` |  |  |
| 

`inputDatasetId` \*

 | `string` **|** `null` |  |  |
| `isAi` | `boolean` |  |  |
| 

`kmsKeyName` \*

 | `string` **|** `null` |  |  |
| 

`modelDisplayName` \*

 | `string` **|** `null` |  |  |
| 

`modelId` \*

 | `string` **|** `null` |  |  |
| 

`parentModel` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`startedOn` \*

 | `number` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`trainingTaskDefinition` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Vpn Service

`google_cloud_vpn_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`organizationId` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Workflow

`google_cloud_workflow` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetName` | `string` |  |  |
| 
`callLogLevel` \*

 | `string` **|** `null` |  |  |
| 

`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`description` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`revisionId` \*

 | `string` **|** `null` |  |  |
| 

`serviceAccount` \*

 | `string` **|** `null` |  |  |
| 

`sourceContents` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`updatedOn` \*

 | `number` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Workflows Service

`google_cloud_workflows_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Workstation

`google_cloud_workstation` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetName` | `string` |  |  |
| 
`etag` \*

 | `string` **|** `null` |  |  |
| 

`isReconciling` \*

 | `boolean` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`startedOn` \*

 | `number` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`uid` \*

 | `string` **|** `null` |  |  |
| 

`zone` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Workstations Cluster

`google_cloud_workstations_cluster` inherits from [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`allowedProjects` \*

 | `array` **|** `null` |  |  |
| `assetName` | `string` |  |  |
| 

`clusterHostname` \*

 | `string` **|** `null` |  |  |
| 

`conditionCodes` \*

 | `array` **|** `null` |  |  |
| 

`controlPlaneIp` \*

 | `string` **|** `null` |  |  |
| 

`degraded` \*

 | `boolean` **|** `null` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| 

`isPrivateEndpointEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isReconciling` \*

 | `boolean` **|** `null` |  |  |
| 

`network` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`serviceAttachmentUri` \*

 | `string` **|** `null` |  |  |
| 

`subnetwork` \*

 | `string` **|** `null` |  |  |
| 

`uid` \*

 | `string` **|** `null` |  |  |
| 

`zone` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Workstations Configuration

`google_cloud_workstations_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetName` | `string` |  |  |
| 
`conditionCodes` \*

 | `array` **|** `null` |  |  |
| 

`containerArgs` \*

 | `array` **|** `null` |  |  |
| 

`containerCommand` \*

 | `array` **|** `null` |  |  |
| 

`containerImage` \*

 | `string` **|** `null` |  |  |
| 

`containerRunAsUser` \*

 | `number` **|** `null` |  |  |
| 

`containerWorkingDir` \*

 | `string` **|** `null` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| 

`idleTimeout` \*

 | `string` **|** `null` |  |  |
| 

`isDegraded` \*

 | `boolean` **|** `null` |  |  |
| 

`isReconciling` \*

 | `boolean` **|** `null` |  |  |
| 

`kmsKey` \*

 | `string` **|** `null` |  |  |
| 

`kmsKeyServiceAccount` \*

 | `string` **|** `null` |  |  |
| 

`persistentDirectoriesDiskTypes` \*

 | `array` **|** `null` |  |  |
| 

`persistentDirectoriesFsTypes` \*

 | `array` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`readinessCheckPaths` \*

 | `array` **|** `null` |  |  |
| 

`readinessCheckPorts` \*

 | `array` **|** `null` |  |  |
| 

`replicaZones` \*

 | `array` **|** `null` |  |  |
| 

`runningTimeout` \*

 | `string` **|** `null` |  |  |
| 

`uid` \*

 | `string` **|** `null` |  |  |
| 

`zone` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Workstations Service

`google_cloud_workstations_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`organizationId` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |

---

### Google Compute External Vpn Gateway

`google_compute_external_vpn_gateway` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetName` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| 

`interfaceIds` \*

 | `array` **|** `null` |  |  |
| 

`interfaceIpAddresses` \*

 | `array` **|** `null` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`redundancyType` \*

 | `string` **|** `null` |  |  |
| 

`selfLink` \*

 | `string` **|** `null` |  |  |

---

### Google Compute Security Policy

`google_compute_security_policy` inherits from [Policy](/data-model/schemas/Policy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`adaptiveProtectionLayer7DdosDefenseRuleVisibility` \*

 | `string` **|** `null` | STANDARD (opaque) or PREMIUM (transparent) rule visibility for adaptive protection. |  |
| 

`advancedOptionsJsonParsing` \*

 | `string` **|** `null` | JSON request body parsing mode (DISABLED, STANDARD, STANDARD\_WITH\_GRAPHQL). |  |
| 

`advancedOptionsLogLevel` \*

 | `string` **|** `null` | Verbosity of Cloud Armor logs (NORMAL, VERBOSE). |  |
| 

`ddosProtection` \*

 | `string` **|** `null` | Network-edge DDoS protection level (e.g. STANDARD, ADVANCED). |  |
| 

`fingerprint` \*

 | `string` **|** `null` | Optimistic-locking hash of the policy contents (rotates on update). |  |
| 

`function` \*

 | `array` **|** `null` | JupiterOne function facet (\["firewall"\]). |  |
| 

`id` \*

 | `string` | Server-defined unique identifier for the security policy. |  |
| 

`isAdaptiveProtectionLayer7DdosDefenseEnabled` \*

 | `boolean` **|** `null` | Whether Cloud Armor Adaptive Protection L7 DDoS defense (CAAP) is enabled. |  |
| 

`kind` \*

 | `string` **|** `null` | GCP resource kind discriminator (compute#securityPolicy). |  |
| 

`labelFingerprint` \*

 | `string` **|** `null` | Optimistic-locking hash of the policy labels (rotates on setLabels). |  |
| 

`projectId` \*

 | `string` **|** `null` | GCP project that owns the security policy. Source of attribution. |  |
| 

`recaptchaRedirectSiteKey` \*

 | `string` **|** `null` | reCAPTCHA Enterprise site key used by GOOGLE\_RECAPTCHA redirect rules. |  |
| 

`region` \*

 | `string` **|** `null` | Short region name for regional policies; null for global policies. |  |
| 

`regional` \*

 | `boolean` | True if this is a regional security policy; false for global. |  |
| 

`ruleCount` \*

 | `number` | Number of rules attached to the policy (length of `rules[]`). Promoted so that gap analysis queries can target empty policies without retrieving raw data. |  |
| 

`selfLink` \*

 | `string` | Server-defined fully-qualified URL of the resource. Used as `_key`. |  |
| 

`type` \*

 | `string` **|** `null` | Policy type: CLOUD\_ARMOR, CLOUD\_ARMOR\_EDGE, CLOUD\_ARMOR\_INTERNAL\_SERVICE, or CLOUD\_ARMOR\_NETWORK. |  |

---

### Google Compute Target Vpn Gateway

`google_compute_target_vpn_gateway` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetName` | `string` |  |  |
| 
`forwardingRules` \*

 | `array` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`network` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`selfLink` \*

 | `string` **|** `null` |  |  |
| 

`tunnels` \*

 | `array` **|** `null` |  |  |

---

### Google Compute Vpn Gateway

`google_compute_vpn_gateway` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetName` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`network` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`selfLink` \*

 | `string` **|** `null` |  |  |
| 

`stackType` \*

 | `string` **|** `null` |  |  |
| 

`vpnInterfaceIpAddresses` \*

 | `array` **|** `null` |  |  |

---

### Google Compute Vpn Tunnel

`google_compute_vpn_tunnel` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetName` | `string` |  |  |
| 
`detailedStatus` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`ikeVersion` \*

 | `number` **|** `null` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`localTrafficSelector` \*

 | `array` **|** `null` |  |  |
| 

`peerExternalGateway` \*

 | `string` **|** `null` |  |  |
| 

`peerExternalGatewayInterface` \*

 | `number` **|** `null` |  |  |
| 

`peerGcpGateway` \*

 | `string` **|** `null` |  |  |
| 

`peerIp` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`remoteTrafficSelector` \*

 | `array` **|** `null` |  |  |
| 

`router` \*

 | `string` **|** `null` |  |  |
| 

`selfLink` \*

 | `string` **|** `null` |  |  |
| 

`targetVpnGateway` \*

 | `string` **|** `null` |  |  |
| 

`vpnGateway` \*

 | `string` **|** `null` |  |  |
| 

`vpnGatewayInterface` \*

 | `number` **|** `null` |  |  |

---

### Google Dlp Discovery Config

`google_dlp_discovery_config` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdOn` | `number` |  |  |
| 
`inspectTemplates` \*

 | `array` **|** `null` |  |  |
| `projectId` | `string` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| `updatedOn` | `number` |  |  |

---

### Google Dlp Table Data Profile

`google_dlp_table_data_profile` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdOn` | `number` |  |  |
| `projectId` | `string` |  |  |
| 
`state` \*

 | `string` **|** `null` |  |  |
| `updatedOn` | `number` |  |  |

---

### Google Essential Contact

`google_essential_contact` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetName` | `string` |  |  |
| 
`email` \*

 | `string` **|** `null` |  |  |
| 

`languageTag` \*

 | `string` **|** `null` |  |  |
| `name` | `string` |  |  |
| 

`notificationCategories` \*

 | `array` **|** `null` |  |  |
| `validateTime` | `number` |  |  |
| 

`validationState` \*

 | `string` **|** `null` |  |  |

---

### Google Iap Binding

`google_iap_binding` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`backendServiceId` \*

 | `string` **|** `null` |  |  |
| 

`backendServiceName` \*

 | `string` **|** `null` |  |  |
| 

`condition.description` \*

 | `string` **|** `null` |  |  |
| 

`condition.expression` \*

 | `string` **|** `null` |  |  |
| 

`condition.location` \*

 | `string` **|** `null` |  |  |
| 

`condition.title` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`members` \*

 | `array` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`permissions` \*

 | `array` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`readonly` \*

 | `boolean` **|** `null` |  |  |
| 

`role` \*

 | `string` **|** `null` |  |  |

---

## Release Notes

-   **2026-04-08** — Added configuration option to automatically delete child integration instances when their parent is removed from the Google Cloud integration.
-   **2026-04-08** — Improved OS name and OS type detection for Google Cloud Compute Engine instances using inventory OS short names.
-   **2026-04-08** — Added relationships linking Google Cloud projects directly to their associated IAM service accounts.
-   **2026-03-31** — Added OS kernel version property to Google Cloud Compute Engine instances and Cloud Identity device entities.
-   **2025-11-18** — Added additional configuration and metadata properties to Cloud SQL MySQL instance entities.
-   **2025-10-29** — Added ingestion of Organization Access Approval settings as new entity types.
-   **2025-10-24** — Added Cloud Functions environment variable capture for secret detection analysis.
-   **2025-10-24** — Added GCP asset identifier properties (akin to AWS ARNs) to compute, networking, and storage resources across multiple rounds of promotion.
-   **2025-10-22** — Added Google Cloud DLP Configuration and DLP Profiles as new ingested entity types.
-   **2025-10-22** — Added Identity-Aware Proxy (IAP) ingestion, relating IAP-protected resources to their backend services.
-   **2025-10-16** — Added App Engine version handler configurations to App Engine version entities.
-   **2025-10-13** — Added Google Cloud API Keys ingestion as new entity types.
-   **2025-10-10** — Added computed public property to Google Cloud firewall entities indicating whether the firewall allows public internet access.
-   **2025-10-06** — Added HTTP(S) Load Balancer logging configuration properties to backend service entities.
-   **2025-10-06** — Added Google Cloud Essential Contacts ingestion for incident notification contacts.
-   **2025-10-01** — Added pgAudit enabled property to Cloud SQL PostgreSQL instances, exposing audit logging configuration.
-   **2025-09-03** — Added GCP Cloud Workstations ingestion, including workstation clusters and workstations as new entity types.
-   **2025-08-20** — Added allowed targets and denied targets queryable properties to GCP firewall entities.
-   **2025-08-20** — Added Google Cloud Vertex AI ingestion, including datasets, models, and endpoints.
-   **2025-08-18** — Added Google Cloud Filestore ingestion as new entity types.
-   **2025-08-18** — Added Google Cloud VPN ingestion, including VPN gateways, tunnels, and router configurations.
-   **2025-08-12** — Added Google Cloud Firestore database ingestion as new entity types.
-   **2025-08-11** — Added Google Cloud Workflows ingestion as new entity types.
-   **2025-05-27** — Added relationship from VPC Service Controls ingress policy to Access Context Manager access levels.
-   **2025-04-25** — Added active property to Google IAM service account key entities.

---

Source: /integrations/directory/google-drive

# Google Drive

Visualize Google Drive Shared Drives and their contents, map file permissions and access controls, and monitor changes to files and folders through queries and alerts.

## Installation

For this integration, you will need to add the necessary API scope to your Google Workspace for the JupiterOne Service Account.

### Understanding impersonation

The Google Drive integration uses Domain-Wide Delegation to access your organization's Drive data. Here's how it works:

-   The JupiterOne service account is configured in Google Cloud Platform with Domain-Wide Delegation enabled.
-   In the Google Admin Console, you grant OAuth scopes to the service account.
-   On each request, the service account impersonates a real user from your domain.
-   **Effective permissions = OAuth scopes granted ∩ permissions of the impersonated user**.

### Requirements for the impersonated user

The user you configure as the **Admin Email** in JupiterOne will be impersonated by the service account. This user needs:

-   To be an **active user** in your Google Workspace domain
-   To have **access to Google Drive** (a basic Workspace license is sufficient)
-   To be a **member of the Shared Drives** you want to ingest

The impersonated user does **not** need to be a Super Admin or have any special admin privileges.

**What the integration can see:**

Since the integration uses the `drive.readonly` scope, it will only be able to read:

-   Files and folders in Shared Drives where the impersonated user is a member
-   Metadata such as owners, permissions, dates, and sizes

**Recommendation:** Create a dedicated service user (e.g., `jupiterone-drive@yourdomain.com`) and add it as a member to all Shared Drives you want JupiterOne to ingest.

### Add the JupiterOne API scope

Log in to the Google Workspace Admin Console as a super administrator to perform the following actions:

1.  Click **Account > Account Settings > Profile** and retrieve your Customer ID. It will have a format similar to `C1111abcd`. Alternatively, click **Security** and expand Setup single sign-on (SSO) for SAML applications and copy the `idpid` property value from the SSO URL. For example, `https://accounts.google.com/o/saml2/idp?idpid=C1111abcd` provides the ID `C1111abcd`. Retain this value for the **Customer ID** field in the JupiterOne integration configuration.
    
2.  Return to the Admin Console home page. Click **Security > Access and data control > API controls**.
    
3.  In the Domain wide delegation pane, select **Manage Domain Wide Delegation**.
    
4.  Click **Add new** and enter the JupiterOne Service Account client ID `105066730509134419857` into the **Client ID** field. If the JupiterOne integration configuration UI shows you a different client ID, use the one it shows — that value is authoritative for your account.
    
5.  Add the following API scope:
    
    ```text
    https://www.googleapis.com/auth/drive.readonly
    ```
    
6.  Click **Authorize**.
    

> **NOTE**
> 
> If your organization has enabled multi-party approval for sensitive admin actions, authorizing domain-wide delegation requires a second super administrator to approve the change before it takes effect. Scope changes can also take up to 24 hours to propagate.

### Configuration in JupiterOne

To add the Google Drive integration in JupiterOne, navigate to the Integrations tab and select Google Drive. Click New Instance to begin configuring your integration. Enter the following:

-   **Account Name** by which you want to identify this Google Drive account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **AccountName toggle** is enabled.
-   **Description** that assists your team when identifying the integration instance.
-   Select a **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
-   Enter the **Customer ID** collected during the setup of Google Workspace.
-   Enter the **Admin Email** of the Google Workspace user that the service account will impersonate. This user must be a member of the Shared Drives you want to ingest.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| File | `google_drive_file` | [DataObject](https://docs.jupiterone.io/data-model/schemas/DataObject) |
| Folder | `google_drive_folder` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Permission | `google_drive_permission` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Shared Drive | `google_drive_shared_drive` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| User | `google_drive_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `google_drive_file` | **ALLOWS** | `google_drive_permission` |
| `google_drive_folder` | **ALLOWS** | `google_drive_permission` |
| `google_drive_folder` | **CONTAINS** | `google_drive_file` |
| `google_drive_folder` | **CONTAINS** | `google_drive_folder` |
| `google_drive_permission` | **ASSIGNED** | `google_drive_user` |
| `google_drive_shared_drive` | **ALLOWS** | `google_drive_permission` |
| `google_drive_shared_drive` | **CONTAINS** | `google_drive_folder` |
| `google_drive_shared_drive` | **CONTAINS** | `google_drive_file` |
| `google_drive_user` | **OWNS** | `google_drive_folder` |
| `google_drive_user` | **OWNS** | `google_drive_file` |
| `google-account` | **HAS** | `google_drive_shared_drive` |
| `google-account` | **HAS** | `google_drive_user` |

### Google Drive File

`google_drive_file` inherits from [DataObject](/data-model/schemas/DataObject.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `canWritersShare` | `boolean` |  |  |
| `doesCopyRequiresWriterPermission` | `boolean` |  |  |
| `driveId` | `string` |  |  |
| `fileExtension` | `string` |  |  |
| `fullFileExtension` | `string` |  |  |
| `headRevisionId` | `string` |  |  |
| `iconLink` | `string` |  |  |
| `isAppAuthorized` | `boolean` |  |  |
| `isExplicitlyTrashed` | `boolean` |  |  |
| `isModifiedByMe` | `boolean` |  |  |
| `isOwnedByMe` | `boolean` |  |  |
| `isShared` | `boolean` |  |  |
| `isStarred` | `boolean` |  |  |
| `isTrashed` | `boolean` |  |  |
| `isViewedByMe` | `boolean` |  |  |
| `lastModifyingUser` | `string` |  |  |
| `md5Checksum` | `string` |  |  |
| `mimeType` | `string` |  |  |
| `modifiedByCurrentUserOn` | `number` |  |  |
| `originalFilename` | `string` |  |  |
| `owners` | `array` of `string`s |  |  |
| `parents` | `array` of `string`s |  |  |
| `permissionIds` | `array` of `string`s |  |  |
| `quotaUsedInBytes` | `string` |  |  |
| `resourceKey` | `string` |  |  |
| `sha1Checksum` | `string` |  |  |
| `sha256Checksum` | `string` |  |  |
| `sharedWithCurrentUserOn` | `number` |  |  |
| `sharingUser` | `string` |  |  |
| `sizeInBytes` | `string` |  |  |
| `spaces` | `array` of `string`s |  |  |
| `thumbnailLink` | `string` |  |  |
| `thumbnailVersion` | `string` |  |  |
| `version` | `string` |  |  |
| `viewedByCurrentUserOn` | `number` |  |  |
| `webContentLink` | `string` |  |  |
| `webViewLink` | `string` |  |  |

---

### Google Drive Folder

`google_drive_folder` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `canWritersShare` | `boolean` |  |  |
| `doesCopyRequiresWriterPermission` | `boolean` |  |  |
| `driveId` | `string` |  |  |
| `fileExtension` | `string` |  |  |
| `fullFileExtension` | `string` |  |  |
| `headRevisionId` | `string` |  |  |
| `iconLink` | `string` |  |  |
| `isAppAuthorized` | `boolean` |  |  |
| `isExplicitlyTrashed` | `boolean` |  |  |
| `isModifiedByMe` | `boolean` |  |  |
| `isOwnedByMe` | `boolean` |  |  |
| `isShared` | `boolean` |  |  |
| `isStarred` | `boolean` |  |  |
| `isTrashed` | `boolean` |  |  |
| `isViewedByMe` | `boolean` |  |  |
| `lastModifyingUser` | `string` |  |  |
| `md5Checksum` | `string` |  |  |
| `mimeType` | `string` |  |  |
| `modifiedByCurrentUserOn` | `number` |  |  |
| `originalFilename` | `string` |  |  |
| `owners` | `array` of `string`s |  |  |
| `parents` | `array` of `string`s |  |  |
| `permissionIds` | `array` of `string`s |  |  |
| `quotaUsedInBytes` | `string` |  |  |
| `resourceKey` | `string` |  |  |
| `sha1Checksum` | `string` |  |  |
| `sha256Checksum` | `string` |  |  |
| `sharedWithCurrentUserOn` | `number` |  |  |
| `sharingUser` | `string` |  |  |
| `sizeInBytes` | `string` |  |  |
| `spaces` | `array` of `string`s |  |  |
| `thumbnailLink` | `string` |  |  |
| `thumbnailVersion` | `string` |  |  |
| `version` | `string` |  |  |
| `viewedByCurrentUserOn` | `number` |  |  |
| `webContentLink` | `string` |  |  |
| `webViewLink` | `string` |  |  |

---

### Google Drive Permission

`google_drive_permission` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowFileDiscovery` | `boolean` |  |  |
| `domain` | `string` |  |  |
| `emailAddress` | `string` |  |  |
| `isDeleted` | `boolean` |  |  |
| `isPendingOwner` | `boolean` |  |  |
| `kind` | `string` |  |  |
| `permissionDetails` | `array` of `string`s |  |  |
| `photoLink` | `string` |  |  |
| `role` | `string` |  |  |
| `teamDrivePermissionDetails` | `array` of `string`s |  |  |
| `type` | `string` |  |  |
| `view` | `string` |  |  |

---

### Google Drive Shared Drive

`google_drive_shared_drive` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `backgroundImageLink` | `string` |  |  |
| `canAddChildren` | `boolean` |  |  |
| `canChangeDriveBackground` | `boolean` |  |  |
| `canComment` | `boolean` |  |  |
| `canCopy` | `boolean` |  |  |
| `canDeleteChildren` | `boolean` |  |  |
| `canDeleteDrive` | `boolean` |  |  |
| `canDownload` | `boolean` |  |  |
| `canEdit` | `boolean` |  |  |
| `canListChildren` | `boolean` |  |  |
| `canManageMembers` | `boolean` |  |  |
| `canReadRevisions` | `boolean` |  |  |
| `canRenameDrive` | `boolean` |  |  |
| `canResetDriveRestrictions` | `boolean` |  |  |
| `canShare` | `boolean` |  |  |
| `canTrashChildren` | `boolean` |  |  |
| `isHidden` | `boolean` |  |  |
| `orgUnitId` | `string` |  |  |
| `themeId` | `string` |  |  |

---

### Google Drive User

`google_drive_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `canCreateDrives` | `boolean` |  |  |
| `canCreateTeamDrives` | `boolean` |  |  |
| `isAppInstalled` | `boolean` |  |  |
| `kind` | `string` |  |  |
| `maxUploadSizeInBytes` | `string` |  |  |
| `storageLimitInBytes` | `string` |  |  |
| `storageUsedByDriveInBytes` | `string` |  |  |
| `storageUsedByTrashInBytes` | `string` |  |  |
| `totalStorageUsageInBytes` | `string` |  |  |
| `userPermissionId` | `string` |  |  |

---

## Release Notes

-   **2026-01-22** — New Google Drive integration: ingests shared drives, folders, files, and permissions, with relationship mapping between drives, folders, files, and users.

---

Source: /integrations/directory/google-firebase

# Google Firebase

Visualize Google Firebase projects and users and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> To use this integration, you must provide the contents of a Google Cloud service account key file with the correct API services enabled. You must also have permission in JupiterOne to install new integrations.

### Configuration in Google Firebase

You must create a Google Cloud service account and a Google Cloud service account key to run the integration. The service account key authenticates on behalf of the integration's Google Cloud project and ingests data into JupiterOne.

To create a Google Firebase service account and service account key:

1.  Go to Project Settings and click the Service Acounts tab.
2.  Click **Create Service Account**.
3.  After the service account is created, click **Generate new private key**.
4.  In the pop-up, click **Generate key**.
5.  Flatten the key and generate the .env file by running `yarn create-env-file ~/SERVICE_ACCOUNT_FILE_PATH_HERE.json`.

### Configuration in JupiterOne

To install this integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Google Firebase. Click **New Instance** to begin configuring the integration.

Configure the following settings:

-   Enter the Account Name by which you'd like to identify this Google Firebase account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is selected.
    
-   Enter a Description that will further assist your team when identifying the integration instance.
    
-   Select a Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.
    
-   Enter the flattened Google Firebase Service Account Key File and generated for use by JupiterOne.
    

Click **Create Configuration** after providing all the values to finalize the integration instance.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `google_firebase_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Project | `google_firebase_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| User | `google_firebase_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Web App | `google_firebase_webapp` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `google_firebase_account` | **HAS** | `google_firebase_project` |
| `google_firebase_project` | **HAS** | `google_firebase_user` |
| `google_firebase_project` | **HAS** | `google_firebase_webapp` |

---

Source: /integrations/directory/govcloud

# GovCloud

Secure your government workloads with JupiterOne's AWS GovCloud integration. Our guide walks you through the installation process and showcases the integration's data model, providing you with comprehensive visibility into your GovCloud environment. Learn how AWS GovCloud integration can help you monitor and manage your security posture, ensuring that you meet government security and compliance requirements

## Installation

To install this integration, you will need to configure settings both within AWS GovCloud and on JupiterOne. Unlike the commercial AWS integration, which assumes an IAM role, the GovCloud integration authenticates with the **Access Key ID** and **Secret Access Key** of a dedicated IAM user, along with the **Account ID** of the GovCloud account to synchronize.

Information is ingested from the AWS GovCloud regions `us-gov-east-1` and `us-gov-west-1`. A small number of AWS services are only offered in `us-gov-west-1`, and are ingested from that region only.

> **INFO**
> 
> The GovCloud integration runs the same ingestion code as the commercial AWS integration, so it produces the same entities and relationships. See the **Data Model** and **Types** tabs for the full list. Resource ARNs use the `aws-us-gov` partition.

### Configuration in AWS GovCloud

JupiterOne maintains the IAM policy, the CloudFormation template, and the Terraform for GovCloud in the public [JupiterOne AWS CloudFormation](https://github.com/JupiterOne/jupiterone-aws-cloudformation/tree/main/cloudformation/iam-cloudformation-govcloud) project on GitHub. Use one of the three options below. CloudFormation is recommended, because the permission set is kept up to date there as the integration adds coverage for new services.

#### Option 1: CloudFormation (recommended)

1.  Download the latest GovCloud CloudFormation template: [iam-cloudformation-govcloud.json](https://jupiterone-prod-us-aws-cloudformation-templates.s3.us-east-2.amazonaws.com/iam-cloudformation-govcloud.json).
2.  In the AWS GovCloud Console, go to **CloudFormation** and select **Stacks**.
3.  Select **Create stack**, then **With new resources (standard)**.
4.  Select **Template is ready** and **Upload a template file**, upload the file you downloaded, and click **Next**.
5.  Enter `JupiterOneAccess` as the stack name, then click **Next**.
6.  On the **Review and create** page, accept the checkbox labeled **I acknowledge that AWS CloudFormation might create IAM resources with custom names**. JupiterOne uses this permission to create the `JupiterOneSecurityAudit` managed policy; you can review the exact permissions it grants in [managed-policy.md](https://raw.githubusercontent.com/JupiterOne/jupiterone-aws-cloudformation/main/cloudformation/iam-cloudformation-govcloud/managed-policy.md).
7.  Click **Submit**.

The stack creates an IAM user named **`JupiterOneAccessUser`** with the AWS-managed `SecurityAudit` policy and the `JupiterOneSecurityAudit` policy attached. Continue to [Create an access key](#create-an-access-key).

#### Option 2: Terraform

1.  Download the latest GovCloud Terraform: [terraform.tf](https://raw.githubusercontent.com/JupiterOne/jupiterone-aws-cloudformation/main/cloudformation/iam-cloudformation-govcloud/terraform.tf).
2.  Apply it in each AWS GovCloud account you want to ingest.

The Terraform creates an IAM user named **`jupiterone-access-user`** with the same two policies attached. Continue to [Create an access key](#create-an-access-key).

#### Option 3: Manual configuration

1.  From the AWS GovCloud Console, search for and select **IAM** under **Services**.
2.  Select **Policies**, click **Create policy**, and select the **JSON** tab.
3.  Paste the policy document from [managed-policy.md](https://raw.githubusercontent.com/JupiterOne/jupiterone-aws-cloudformation/main/cloudformation/iam-cloudformation-govcloud/managed-policy.md). This is the same document deployed by the CloudFormation template and is the authoritative permission set.
4.  Click **Next**, enter `JupiterOneSecurityAudit` as the name, and click **Create policy**.
5.  Go to **Users** and select **Create user**. Enter `JupiterOneAccessUser` as the user name.
6.  On the permissions step, select **Attach policies directly** and select both **SecurityAudit** (the AWS-managed policy) and the **JupiterOneSecurityAudit** policy you just created.
7.  Click **Next**, review the user information, and click **Create user**.

> **CAUTION**
> 
> Keep the manually created policy in sync with [managed-policy.md](https://raw.githubusercontent.com/JupiterOne/jupiterone-aws-cloudformation/main/cloudformation/iam-cloudformation-govcloud/managed-policy.md). A policy that drifts behind the maintained one causes individual ingestion steps to fail with access-denied errors as the integration adds coverage for new services.

#### Create an access key

1.  In the IAM console, open the user created above (`JupiterOneAccessUser` for CloudFormation and manual setups, `jupiterone-access-user` for Terraform).
2.  Select the **Security credentials** tab.
3.  Under **Access keys**, click **Create access key**.
4.  Select **Other**, then create the access key.
5.  Copy both the **Access key ID** and the **Secret access key** (click **Show** to display it). These values are needed for the JupiterOne configuration and the secret cannot be retrieved again after you leave this page.

### Set Permissions

The GovCloud integration requires security auditor permissions in the target AWS GovCloud account, defined by the combination of the AWS-managed `SecurityAudit` policy and the additional `List*`, `Get*`, and `Describe*` permissions that `SecurityAudit` does not cover. The exact policy and permission statements are maintained in the public [JupiterOne AWS CloudFormation](https://github.com/JupiterOne/jupiterone-aws-cloudformation/tree/main/cloudformation/iam-cloudformation-govcloud) project.

For the permissions required by each individual ingestion source, see the **Authorization** tab.

### Configuration in JupiterOne

1.  From the top navigation of the J1 Search homepage, select **Integrations**.
2.  Scroll to the **GovCloud** integration tile and click it.
3.  Click **New instance** and configure the following settings:
    -   The **Account Name** used to identify this AWS GovCloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    -   A **Description** to assist in identifying the integration instance, if desired.
    -   A **Polling Interval** that fits your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    -   The **Account ID** of the AWS GovCloud account you are ingesting data from.
    -   The **Access Key ID** of the IAM user created above.
    -   The **Secret Access Key** associated with the Access Key ID.
4.  Click **Create Configuration** after all values are provided.

### Service Control Policy Issues

Errors may occur if a Service Control Policy (SCP) is blocking specified services or regions. AWS services that JupiterOne cannot ingest are listed in the **Integration Jobs** logs (**Integrations > Configurations > Settings > Jobs**).

For each SCP that is blocking JupiterOne ingestion, add the following condition to your SCP JSON. Note the `aws-us-gov` partition in the ARN:

```json
"Condition": {
  "ArnNotLike": {
    "aws:PrincipalARN": [
        "arn:aws-us-gov:iam::*:user/JupiterOne*",
        "arn:aws-us-gov:iam::*:user/jupiterone*"
    ]
  }
}
```

Ensure these ARNs match the IAM user used to configure your JupiterOne GovCloud integration.

> **INFO**
> 
> See the [AWS Service control policies documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) for the latest information.

### Differences from the commercial AWS integration

Both integrations ingest the same entity types, but the GovCloud integration instance offers a smaller set of configuration options:

| Capability | AWS | GovCloud |
| --- | --- | --- |
| Authentication | Role ARN with an External ID, optionally chained through an intermediate role | Account ID with an IAM user Access Key ID and Secret Access Key |
| Regions | All AWS regions that do not require additional contractual arrangements with AWS | `us-gov-east-1` and `us-gov-west-1` |
| ARN partition | `aws` | `aws-us-gov` |
| Organization account management | Supported. Sub-account instances are created and managed automatically. | Not supported. Configure one integration instance per GovCloud account. |
| Ingestion window and data filtering options | Configurable per instance (ECR, Inspector V2, and Security Hub findings) | Not configurable. Defaults apply. |
| Ingestion sources | Individually toggleable | Individually toggleable |

### Reference

#### S3 Bucket `public` Property

The `aws_s3_bucket.public` property is calculated based on the **Access** field in the AWS S3 console:

| Access | `aws_s3_bucket.public` |
| --- | --- |
| Public | `true` |
| Objects can be public | `undefined` |
| Bucket and objects not public | `false` |

#### AWS IAM Policies

Each `aws_iam_policy` entity includes a boolean `admin` property that indicates whether the policy grants administrative-level access. The flag is determined from the policy name: if the name contains the word "admin" (case-insensitive), the flag is set to `true`. Examples: `AdministratorAccess`, `AdminPolicy`, `MyCustomAdminRole`.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. See the [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (712)

-   `access-analyzer:ListAnalyzers`
-   `access-analyzer:ListFindings`
-   `account:GetAlternateContact`
-   `account:GetContactInformation`
-   `acm-pca:ListCertificateAuthorities`
-   `acm-pca:ListTags`
-   `acm:DescribeCertificate`
-   `acm:ListCertificates`
-   `acm:ListTagsForCertificate`
-   `airflow:GetEnvironment`
-   `airflow:ListEnvironments`
-   `apigateway:GET arn:aws:apigateway:*::/apis`
-   `apigateway:GET arn:aws:apigateway:*::/apis/*/authorizers`
-   `apigateway:GET arn:aws:apigateway:*::/apis/*/integrations`
-   `apigateway:GET arn:aws:apigateway:*::/apis/*/routes`
-   `apigateway:GET arn:aws:apigateway:*::/apis/*/stages`
-   `apigateway:GET arn:aws:apigateway:*::/domainnames`
-   `apigateway:GET arn:aws:apigateway:*::/domainnames/*/apimappings`
-   `apigateway:GET arn:aws:apigateway:*::/restapis`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/authorizers`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/authorizers/*`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*/methods/*`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/stages`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/stages/*`
-   `appconfig:GetAccountSettings`
-   `appconfig:GetConfigurationProfile`
-   `appconfig:GetDeployment`
-   `appconfig:ListApplications`
-   `appconfig:ListConfigurationProfiles`
-   `appconfig:ListDeploymentStrategies`
-   `appconfig:ListDeployments`
-   `appconfig:ListEnvironments`
-   `appconfig:ListHostedConfigurationVersions`
-   `appconfig:ListTagsForResource`
-   `aps:DescribeLoggingConfiguration`
-   `aps:DescribeQueryLoggingConfiguration`
-   `aps:DescribeResourcePolicy`
-   `aps:DescribeScraper`
-   `aps:DescribeWorkspace`
-   `aps:DescribeWorkspaceConfiguration`
-   `aps:ListScrapers`
-   `aps:ListWorkspaces`
-   `athena:GetWorkGroup`
-   `athena:ListTagsForResource`
-   `athena:ListWorkGroups`
-   `auditmanager:GetAssessment`
-   `auditmanager:GetAssessmentFramework`
-   `auditmanager:GetControl`
-   `auditmanager:GetDelegations`
-   `auditmanager:GetEvidenceFoldersByAssessmentControl`
-   `auditmanager:GetSettings`
-   `auditmanager:ListAssessmentFrameworks`
-   `auditmanager:ListAssessments`
-   `auditmanager:ListControls`
-   `auditmanager:ListTagsForResource`
-   `autoscaling:DescribeAutoScalingGroups`
-   `autoscaling:DescribeLaunchConfigurations`
-   `autoscaling:DescribePolicies`
-   `aws-marketplace:GetEntitlements`
-   `aws-marketplace:ListEntities`
-   `backup:GetBackupVaultAccessPolicy`
-   `backup:ListBackupJobs`
-   `backup:ListBackupPlans`
-   `backup:ListBackupVaults`
-   `backup:ListCopyJobs`
-   `backup:ListRecoveryPointsByBackupVault`
-   `backup:ListRestoreJobs`
-   `backup:ListRestoreTestingPlans`
-   `backup:ListTags`
-   `backup:ListTagsForResource`
-   `batch:DescribeComputeEnvironments`
-   `batch:DescribeJobDefinitions`
-   `batch:DescribeJobQueues`
-   `batch:ListJobs`
-   `bedrock-agentcore:GetAgentRuntime`
-   `bedrock-agentcore:GetCodeInterpreter`
-   `bedrock-agentcore:ListAgentRuntimes`
-   `bedrock-agentcore:ListCodeInterpreters`
-   `bedrock:GetAgent`
-   `bedrock:GetAgentActionGroup`
-   `bedrock:GetCustomModel`
-   `bedrock:GetDataSource`
-   `bedrock:GetEvaluationJob`
-   `bedrock:GetFlow`
-   `bedrock:GetGuardrail`
-   `bedrock:GetInferenceProfile`
-   `bedrock:GetKnowledgeBase`
-   `bedrock:GetModelCustomizationJob`
-   `bedrock:GetModelInvocationLoggingConfiguration`
-   `bedrock:GetProvisionedModelThroughput`
-   `bedrock:ListAgentActionGroups`
-   `bedrock:ListAgents`
-   `bedrock:ListCustomModels`
-   `bedrock:ListDataSources`
-   `bedrock:ListEvaluationJobs`
-   `bedrock:ListFlows`
-   `bedrock:ListFoundationModels`
-   `bedrock:ListGuardrails`
-   `bedrock:ListInferenceProfiles`
-   `bedrock:ListKnowledgeBases`
-   `bedrock:ListModelCustomizationJobs`
-   `bedrock:ListProvisionedModelThroughputs`
-   `cloudformation:DescribeStacks`
-   `cloudformation:ListStacks`
-   `cloudfront:GetDistributionConfig`
-   `cloudfront:ListDistributions`
-   `cloudfront:ListKeyGroups`
-   `cloudfront:ListPublicKeys`
-   `cloudfront:ListTagsForResource`
-   `cloudhsm:DescribeBackups`
-   `cloudhsm:DescribeClusters`
-   `cloudhsm:ListTags`
-   `cloudtrail:DescribeTrails`
-   `cloudtrail:GetEventSelectors`
-   `cloudtrail:GetTrailStatus`
-   `cloudtrail:ListTags`
-   `cloudwatch:DescribeAlarms`
-   `cloudwatch:GetMetricData`
-   `cloudwatch:ListTagsForResource`
-   `codeartifact:DescribeDomain`
-   `codeartifact:DescribeRepository`
-   `codeartifact:GetDomainPermissionsPolicy`
-   `codeartifact:GetRepositoryEndpoint`
-   `codeartifact:GetRepositoryPermissionsPolicy`
-   `codeartifact:ListDomains`
-   `codeartifact:ListPackageGroups`
-   `codeartifact:ListPackages`
-   `codeartifact:ListRepositories`
-   `codeartifact:ListTagsForResource`
-   `codebuild:BatchGetProjects`
-   `codebuild:BatchGetReportGroups`
-   `codebuild:GetResourcePolicy`
-   `codebuild:ListProjects`
-   `codebuild:ListReportGroups`
-   `codecommit:GetRepository`
-   `codecommit:ListRepositories`
-   `codecommit:ListTagsForResource`
-   `codedeploy:BatchGetApplications`
-   `codedeploy:BatchGetDeploymentGroups`
-   `codedeploy:GetDeploymentConfig`
-   `codedeploy:ListApplications`
-   `codedeploy:ListDeploymentConfigs`
-   `codedeploy:ListDeploymentGroups`
-   `codedeploy:ListTagsForResource`
-   `codeguru-profiler:ListProfilingGroups`
-   `codeguru-reviewer:DescribeRepositoryAssociation`
-   `codeguru-reviewer:ListRepositoryAssociations`
-   `codeguru-reviewer:ListTagsForResource`
-   `codepipeline:GetPipeline`
-   `codepipeline:ListPipelines`
-   `cognito-identity:DescribeIdentityPool`
-   `cognito-identity:ListIdentityPools`
-   `cognito-idp:DescribeRiskConfiguration`
-   `cognito-idp:DescribeUserPool`
-   `cognito-idp:DescribeUserPoolClient`
-   `cognito-idp:DescribeUserPoolDomain`
-   `cognito-idp:ListUserPoolClients`
-   `cognito-idp:ListUserPools`
-   `cognito-idp:ListUsers`
-   `config:BatchGetResourceConfig`
-   `config:DescribeComplianceByConfigRule`
-   `config:DescribeConfigRules`
-   `config:GetComplianceDetailsByConfigRule`
-   `datasync:DescribeLocationEfs`
-   `datasync:DescribeLocationFsxLustre`
-   `datasync:DescribeLocationFsxOntap`
-   `datasync:DescribeLocationFsxOpenZfs`
-   `datasync:DescribeLocationFsxWindows`
-   `datasync:DescribeLocationHdfs`
-   `datasync:DescribeLocationNfs`
-   `datasync:DescribeLocationObjectStorage`
-   `datasync:DescribeLocationS3`
-   `datasync:DescribeLocationSmb`
-   `datasync:DescribeTask`
-   `datasync:ListLocations`
-   `datasync:ListTagsForResource`
-   `datasync:ListTasks`
-   `dax:DescribeClusters`
-   `detective:GetInvestigation`
-   `detective:ListGraphs`
-   `detective:ListInvestigations`
-   `detective:ListTagsForResource`
-   `devops-guru:DescribeAccountHealth`
-   `devops-guru:DescribeServiceIntegration`
-   `devops-guru:ListAnomaliesForInsight`
-   `devops-guru:ListInsights`
-   `devops-guru:ListNotificationChannels`
-   `directconnect:DescribeConnections`
-   `directconnect:DescribeDirectConnectGateways`
-   `directconnect:DescribeLags`
-   `directconnect:DescribeVirtualInterfaces`
-   `dms:DescribeEndpoints`
-   `dms:DescribeReplicationInstances`
-   `dms:ListTagsForResource`
-   `ds:DescribeDirectories`
-   `dynamodb:DescribeContinuousBackups`
-   `dynamodb:DescribeGlobalTable`
-   `dynamodb:DescribeTable`
-   `dynamodb:ListBackups`
-   `dynamodb:ListGlobalTables`
-   `dynamodb:ListTables`
-   `dynamodb:ListTagsOfResource`
-   `ec2:DescribeAddresses`
-   `ec2:DescribeCustomerGateways`
-   `ec2:DescribeFlowLogs`
-   `ec2:DescribeHosts`
-   `ec2:DescribeIamInstanceProfileAssociations`
-   `ec2:DescribeImageAttribute`
-   `ec2:DescribeImages`
-   `ec2:DescribeInstanceAttribute`
-   `ec2:DescribeInstances`
-   `ec2:DescribeInternetGateways`
-   `ec2:DescribeKeyPairs`
-   `ec2:DescribeLaunchTemplateVersions`
-   `ec2:DescribeLaunchTemplates`
-   `ec2:DescribeManagedPrefixLists`
-   `ec2:DescribeNatGateways`
-   `ec2:DescribeNetworkAcls`
-   `ec2:DescribeNetworkInterfaces`
-   `ec2:DescribeRegions`
-   `ec2:DescribeRouteTables`
-   `ec2:DescribeSecurityGroups`
-   `ec2:DescribeSnapshotAttribute`
-   `ec2:DescribeSnapshots`
-   `ec2:DescribeSubnets`
-   `ec2:DescribeTransitGatewayAttachments`
-   `ec2:DescribeTransitGatewayRouteTables`
-   `ec2:DescribeTransitGatewayVpcAttachments`
-   `ec2:DescribeTransitGateways`
-   `ec2:DescribeVolumes`
-   `ec2:DescribeVpcEndpointConnections`
-   `ec2:DescribeVpcEndpointServiceConfigurations`
-   `ec2:DescribeVpcEndpointServicePermissions`
-   `ec2:DescribeVpcEndpointServices`
-   `ec2:DescribeVpcEndpoints`
-   `ec2:DescribeVpcPeeringConnections`
-   `ec2:DescribeVpcs`
-   `ec2:DescribeVpnConnections`
-   `ec2:DescribeVpnGateways`
-   `ec2:GetEbsDefaultKmsKeyId`
-   `ec2:GetEbsEncryptionByDefault`
-   `ec2:GetManagedPrefixListEntries`
-   `ecr:DescribeImageScanFindings`
-   `ecr:DescribeImages`
-   `ecr:DescribeRepositories`
-   `ecr:GetLifecyclePolicy`
-   `ecr:GetRepositoryPolicy`
-   `ecr:ListTagsForResource`
-   `ecs:DescribeClusters`
-   `ecs:DescribeContainerInstances`
-   `ecs:DescribeServices`
-   `ecs:DescribeTaskDefinition`
-   `ecs:DescribeTasks`
-   `ecs:ListClusters`
-   `ecs:ListContainerInstances`
-   `ecs:ListServices`
-   `ecs:ListTaskDefinitionFamilies`
-   `ecs:ListTasks`
-   `eks:DescribeCluster`
-   `eks:DescribeClusterVersions`
-   `eks:DescribeNodegroup`
-   `eks:ListClusters`
-   `eks:ListNodegroups`
-   `elasticache:DescribeCacheClusters`
-   `elasticache:DescribeCacheSubnetGroups`
-   `elasticache:DescribeReplicationGroups`
-   `elasticache:DescribeSnapshots`
-   `elasticache:ListTagsForResource`
-   `elasticfilesystem:DescribeFileSystemPolicy`
-   `elasticfilesystem:DescribeFileSystems`
-   `elasticfilesystem:DescribeMountTargetSecurityGroups`
-   `elasticfilesystem:DescribeMountTargets`
-   `elasticloadbalancing:DescribeListeners`
-   `elasticloadbalancing:DescribeLoadBalancerAttributes`
-   `elasticloadbalancing:DescribeLoadBalancers`
-   `elasticloadbalancing:DescribeRules`
-   `elasticloadbalancing:DescribeTags`
-   `elasticloadbalancing:DescribeTargetGroups`
-   `elasticloadbalancing:DescribeTargetHealth`
-   `elasticmapreduce:DescribeCluster`
-   `elasticmapreduce:DescribeSecurityConfiguration`
-   `elasticmapreduce:ListClusters`
-   `elasticmapreduce:ListInstances`
-   `elasticmapreduce:ListSecurityConfigurations`
-   `emr-serverless:GetApplication`
-   `emr-serverless:ListApplications`
-   `es:DescribeDomains`
-   `es:DescribeElasticsearchDomains`
-   `es:ListDomainNames`
-   `es:ListTags`
-   `events:DescribeApiDestination`
-   `events:DescribeArchive`
-   `events:DescribeConnection`
-   `events:DescribeEventBus`
-   `events:ListApiDestinations`
-   `events:ListArchives`
-   `events:ListConnections`
-   `events:ListEndpoints`
-   `events:ListEventBuses`
-   `events:ListRules`
-   `events:ListTagsForResource`
-   `events:ListTargetsByRule`
-   `firehose:DescribeDeliveryStream`
-   `firehose:ListDeliveryStreams`
-   `firehose:ListTagsForDeliveryStream`
-   `fms:ListAppsLists`
-   `fms:ListPolicies`
-   `fms:ListProtocolsLists`
-   `fms:ListResourceSetResources`
-   `fms:ListResourceSets`
-   `fms:ListTagsForResource`
-   `fsx:DescribeFileSystems`
-   `glacier:GetVaultAccessPolicy`
-   `glacier:GetVaultLock`
-   `glacier:ListTagsForVault`
-   `glacier:ListVaults`
-   `globalaccelerator:ListAccelerators`
-   `globalaccelerator:ListCustomRoutingAccelerators`
-   `globalaccelerator:ListCustomRoutingEndpointGroups`
-   `globalaccelerator:ListCustomRoutingListeners`
-   `globalaccelerator:ListEndpointGroups`
-   `globalaccelerator:ListListeners`
-   `globalaccelerator:ListTagsForResource`
-   `glue:GetConnection`
-   `glue:GetConnections`
-   `glue:GetDataCatalogEncryptionSettings`
-   `glue:GetDatabase`
-   `glue:GetDatabases`
-   `glue:GetDevEndpoint`
-   `glue:GetDevEndpoints`
-   `glue:GetJob`
-   `glue:GetResourcePolicy`
-   `glue:GetSecurityConfigurations`
-   `glue:GetTags`
-   `glue:ListJobs`
-   `glue:ListSessions`
-   `grafana:DescribeWorkspace`
-   `grafana:ListWorkspaces`
-   `guardduty:DescribeOrganizationConfiguration`
-   `guardduty:DescribePublishingDestination`
-   `guardduty:GetDetector`
-   `guardduty:GetFindings`
-   `guardduty:ListDetectors`
-   `guardduty:ListFindings`
-   `guardduty:ListOrganizationAdminAccounts`
-   `guardduty:ListPublishingDestinations`
-   `health:DescribeEventDetails`
-   `health:DescribeEvents`
-   `iam:GenerateCredentialReport`
-   `iam:GetAccessKeyLastUsed`
-   `iam:GetAccountPasswordPolicy`
-   `iam:GetAccountSummary`
-   `iam:GetCredentialReport`
-   `iam:GetGroup`
-   `iam:GetGroupPolicy`
-   `iam:GetOpenIDConnectProvider`
-   `iam:GetPolicyVersion`
-   `iam:GetRole`
-   `iam:GetRolePolicy`
-   `iam:GetSAMLProvider`
-   `iam:GetServerCertificate`
-   `iam:GetUser`
-   `iam:GetUserPolicy`
-   `iam:ListAccessKeys`
-   `iam:ListAccountAliases`
-   `iam:ListEntitiesForPolicy`
-   `iam:ListGroupPolicies`
-   `iam:ListGroups`
-   `iam:ListInstanceProfiles`
-   `iam:ListMFADevices`
-   `iam:ListOpenIDConnectProviderTags`
-   `iam:ListOpenIDConnectProviders`
-   `iam:ListPolicies`
-   `iam:ListRolePolicies`
-   `iam:ListRoleTags`
-   `iam:ListRoles`
-   `iam:ListSAMLProviders`
-   `iam:ListServerCertificates`
-   `iam:ListServiceSpecificCredentials`
-   `iam:ListUserPolicies`
-   `iam:ListUserTags`
-   `iam:ListUsers`
-   `identitystore:ListGroupMemberships`
-   `identitystore:ListGroups`
-   `identitystore:ListUsers`
-   `imagebuilder:GetComponent`
-   `imagebuilder:GetContainerRecipe`
-   `imagebuilder:GetDistributionConfiguration`
-   `imagebuilder:GetImage`
-   `imagebuilder:GetImagePipeline`
-   `imagebuilder:GetInfrastructureConfiguration`
-   `imagebuilder:GetLifecyclePolicy`
-   `imagebuilder:GetWorkflow`
-   `imagebuilder:ListComponents`
-   `imagebuilder:ListContainerRecipes`
-   `imagebuilder:ListDistributionConfigurations`
-   `imagebuilder:ListImageBuildVersions`
-   `imagebuilder:ListImagePipelines`
-   `imagebuilder:ListImages`
-   `imagebuilder:ListInfrastructureConfigurations`
-   `imagebuilder:ListLifecyclePolicies`
-   `imagebuilder:ListWorkflows`
-   `inspector2:DescribeOrganizationConfiguration`
-   `inspector2:GetConfiguration`
-   `inspector2:GetDelegatedAdminAccount`
-   `inspector2:GetEncryptionKey`
-   `inspector2:ListCoverage`
-   `inspector2:ListFilters`
-   `inspector2:ListFindings`
-   `inspector2:ListTagsForResource`
-   `inspector:DescribeAssessmentRuns`
-   `inspector:DescribeFindings`
-   `inspector:DescribeRulesPackages`
-   `inspector:ListAssessmentRuns`
-   `inspector:ListFindings`
-   `kafka:GetBootstrapBrokers`
-   `kafka:ListClustersV2`
-   `kafka:ListTagsForResource`
-   `kinesis:DescribeStreamSummary`
-   `kinesis:ListStreamConsumers`
-   `kinesis:ListStreams`
-   `kinesis:ListTagsForStream`
-   `kms:DescribeKey`
-   `kms:GetKeyPolicy`
-   `kms:GetKeyRotationStatus`
-   `kms:ListAliases`
-   `kms:ListKeys`
-   `kms:ListResourceTags`
-   `lambda:GetFunction`
-   `lambda:GetFunctionUrlConfig`
-   `lambda:GetPolicy`
-   `lambda:ListCodeSigningConfigs`
-   `lambda:ListFunctions`
-   `lambda:ListFunctionsByCodeSigningConfig`
-   `lambda:ListTags`
-   `lex:DescribeResourcePolicy`
-   `lex:ListBotAliases`
-   `lex:ListBots`
-   `license-manager:ListLicenses`
-   `license-manager:ListReceivedLicenses`
-   `logs:DescribeDestinations`
-   `logs:DescribeLogGroups`
-   `logs:DescribeMetricFilters`
-   `logs:DescribeSubscriptionFilters`
-   `macie2:GetFindings`
-   `macie2:ListFindings`
-   `mq:DescribeBroker`
-   `mq:ListBrokers`
-   `neptune-graph:GetGraph`
-   `neptune-graph:GetImportTask`
-   `neptune-graph:ListExportTasks`
-   `neptune-graph:ListGraphSnapshots`
-   `neptune-graph:ListGraphs`
-   `neptune-graph:ListImportTasks`
-   `neptune-graph:ListPrivateGraphEndpoints`
-   `neptune-graph:ListTagsForResource`
-   `neptune:DescribeDBClusters`
-   `neptune:DescribeDBInstances`
-   `network-firewall:DescribeFirewall`
-   `network-firewall:DescribeFirewallPolicy`
-   `network-firewall:DescribeRuleGroup`
-   `network-firewall:ListFirewallPolicies`
-   `network-firewall:ListFirewalls`
-   `network-firewall:ListRuleGroups`
-   `networkmanager:GetConnectPeer`
-   `networkmanager:GetCoreNetwork`
-   `networkmanager:GetCoreNetworkPolicy`
-   `networkmanager:ListAttachmentRoutingPolicyAssociations`
-   `networkmanager:ListAttachments`
-   `networkmanager:ListConnectPeers`
-   `networkmanager:ListCoreNetworkPolicyVersions`
-   `networkmanager:ListCoreNetworks`
-   `organizations:DescribeAccount`
-   `organizations:DescribeOrganization`
-   `organizations:DescribeOrganizationalUnit`
-   `organizations:DescribePolicy`
-   `organizations:ListAccounts`
-   `organizations:ListChildren`
-   `organizations:ListPolicies`
-   `organizations:ListRoots`
-   `organizations:ListTagsForResource`
-   `organizations:ListTargetsForPolicy`
-   `quicksight:DescribeAccountSettings`
-   `quicksight:DescribeAccountSubscription`
-   `quicksight:DescribeDashboard`
-   `quicksight:DescribeDashboardPermissions`
-   `quicksight:DescribeDataSet`
-   `quicksight:DescribeDataSource`
-   `quicksight:DescribeIpRestriction`
-   `quicksight:DescribeKeyRegistration`
-   `quicksight:DescribeVpcConnection`
-   `quicksight:ListCustomPermissions`
-   `quicksight:ListDashboards`
-   `quicksight:ListDataSets`
-   `quicksight:ListDataSources`
-   `quicksight:ListGroupMemberships`
-   `quicksight:ListGroups`
-   `quicksight:ListNamespaces`
-   `quicksight:ListTagsForResource`
-   `quicksight:ListUsers`
-   `quicksight:ListVpcConnections`
-   `ram:GetResourceShareAssociations`
-   `ram:GetResourceShareInvitations`
-   `ram:GetResourceShares`
-   `ram:ListResources`
-   `rds:DescribeDBClusterParameterGroups`
-   `rds:DescribeDBClusterParameters`
-   `rds:DescribeDBClusterSnapshots`
-   `rds:DescribeDBClusters`
-   `rds:DescribeDBInstances`
-   `rds:DescribeDBParameterGroups`
-   `rds:DescribeDBParameters`
-   `rds:DescribeDBProxies`
-   `rds:DescribeDBProxyTargetGroups`
-   `rds:DescribeDBProxyTargets`
-   `rds:DescribeDBSnapshots`
-   `rds:DescribeDBSubnetGroups`
-   `rds:DescribeOptionGroups`
-   `redshift-serverless:ListEndpointAccess`
-   `redshift-serverless:ListNamespaces`
-   `redshift-serverless:ListRecoveryPoints`
-   `redshift-serverless:ListSnapshots`
-   `redshift-serverless:ListTagsForResource`
-   `redshift-serverless:ListUsageLimits`
-   `redshift-serverless:ListWorkgroups`
-   `redshift:DescribeClusterParameterGroups`
-   `redshift:DescribeClusterParameters`
-   `redshift:DescribeClusters`
-   `redshift:DescribeDataShares`
-   `redshift:DescribeLoggingStatus`
-   `resource-explorer-2:GetDefaultView`
-   `resource-explorer-2:GetIndex`
-   `resource-explorer-2:GetView`
-   `resource-explorer-2:ListIndexes`
-   `resource-explorer-2:ListTagsForResource`
-   `resource-explorer-2:ListViews`
-   `rolesanywhere:GetProfile`
-   `rolesanywhere:GetTrustAnchor`
-   `rolesanywhere:ListProfiles`
-   `rolesanywhere:ListTagsForResource`
-   `rolesanywhere:ListTrustAnchors`
-   `route53:GetHostedZone`
-   `route53:ListHostedZones`
-   `route53:ListResourceRecordSets`
-   `route53domains:GetDomainDetail`
-   `route53domains:ListDomains`
-   `route53domains:ListTagsForDomain`
-   `route53resolver:ListResolverRuleAssociations`
-   `route53resolver:ListResolverRules`
-   `route53resolver:ListTagsForResource`
-   `s3:GetAccountPublicAccessBlock`
-   `s3:GetBucketAcl`
-   `s3:GetBucketLocation`
-   `s3:GetBucketLogging`
-   `s3:GetBucketNotification`
-   `s3:GetBucketObjectLockConfiguration`
-   `s3:GetBucketOwnershipControls`
-   `s3:GetBucketPolicy`
-   `s3:GetBucketPolicyStatus`
-   `s3:GetBucketPublicAccessBlock`
-   `s3:GetBucketTagging`
-   `s3:GetBucketVersioning`
-   `s3:GetBucketWebsite`
-   `s3:GetEncryptionConfiguration`
-   `s3:GetInventoryConfiguration`
-   `s3:GetLifecycleConfiguration`
-   `s3:GetReplicationConfiguration`
-   `s3:ListAccessPoints`
-   `s3:ListAllMyBuckets`
-   `sagemaker:DescribeDomain`
-   `sagemaker:DescribeEndpoint`
-   `sagemaker:DescribeEndpointConfig`
-   `sagemaker:DescribeFeatureGroup`
-   `sagemaker:DescribeModel`
-   `sagemaker:DescribeNotebookInstance`
-   `sagemaker:DescribeProcessingJob`
-   `sagemaker:DescribeTrainingJob`
-   `sagemaker:DescribeTransformJob`
-   `sagemaker:ListDomains`
-   `sagemaker:ListEndpoints`
-   `sagemaker:ListFeatureGroups`
-   `sagemaker:ListModels`
-   `sagemaker:ListNotebookInstances`
-   `sagemaker:ListProcessingJobs`
-   `sagemaker:ListTags`
-   `sagemaker:ListTrainingJobs`
-   `sagemaker:ListTransformJobs`
-   `secretsmanager:DescribeSecret`
-   `secretsmanager:GetResourcePolicy`
-   `secretsmanager:ListSecretVersionIds`
-   `secretsmanager:ListSecrets`
-   `securityhub:DescribeHub`
-   `securityhub:DescribeStandards`
-   `securityhub:DescribeStandardsControls`
-   `securityhub:GetEnabledStandards`
-   `securityhub:GetFindings`
-   `servicecatalog:DescribeConstraint`
-   `servicecatalog:DescribePortfolio`
-   `servicecatalog:DescribeProductAsAdmin`
-   `servicecatalog:ListConstraintsForPortfolio`
-   `servicecatalog:ListLaunchPaths`
-   `servicecatalog:ListPortfolios`
-   `servicecatalog:ListPortfoliosForProduct`
-   `servicecatalog:ListPrincipalsForPortfolio`
-   `servicecatalog:ListProvisioningArtifacts`
-   `servicecatalog:ListResourcesForTagOption`
-   `servicecatalog:ListTagOptions`
-   `servicecatalog:SearchProductsAsAdmin`
-   `servicediscovery:GetInstance`
-   `servicediscovery:ListInstances`
-   `servicediscovery:ListNamespaces`
-   `servicediscovery:ListServices`
-   `servicediscovery:ListTagsForResource`
-   `ses:GetConfigurationSet`
-   `ses:GetEmailIdentity`
-   `ses:ListConfigurationSets`
-   `ses:ListEmailIdentities`
-   `ses:ListReceiptFilters`
-   `shield:DescribeDRTAccess`
-   `shield:DescribeEmergencyContactSettings`
-   `shield:DescribeSubscription`
-   `shield:GetSubscriptionState`
-   `shield:ListProtectionGroups`
-   `shield:ListProtections`
-   `shield:ListResourcesInProtectionGroup`
-   `shield:ListTagsForResource`
-   `signer:GetSigningProfile`
-   `signer:ListProfilePermissions`
-   `signer:ListSigningJobs`
-   `signer:ListSigningProfiles`
-   `sns:GetSubscriptionAttributes`
-   `sns:GetTopicAttributes`
-   `sns:ListSubscriptions`
-   `sns:ListTagsForResource`
-   `sns:ListTopics`
-   `sqs:GetQueueAttributes`
-   `sqs:ListQueueTags`
-   `sqs:ListQueues`
-   `ssm:DescribeDocumentPermission`
-   `ssm:DescribeInstanceInformation`
-   `ssm:DescribeInstancePatchStates`
-   `ssm:DescribeParameters`
-   `ssm:DescribePatchBaselines`
-   `ssm:DescribePatchGroupState`
-   `ssm:DescribePatchGroups`
-   `ssm:GetDocument`
-   `ssm:GetServiceSetting`
-   `ssm:ListAssociations`
-   `ssm:ListComplianceItems`
-   `ssm:ListComplianceSummaries`
-   `ssm:ListDocuments`
-   `ssm:ListInventoryEntries`
-   `ssm:ListTagsForResource`
-   `sso:DescribePermissionSet`
-   `sso:GetInlinePolicyForPermissionSet`
-   `sso:ListAccountAssignments`
-   `sso:ListAccountAssignmentsForPrincipal`
-   `sso:ListAccountsForProvisionedPermissionSet`
-   `sso:ListApplications`
-   `sso:ListCustomerManagedPolicyReferencesInPermissionSet`
-   `sso:ListInstances`
-   `sso:ListManagedPoliciesInPermissionSet`
-   `sso:ListPermissionSets`
-   `sso:ListTagsForResource`
-   `states:DescribeStateMachine`
-   `states:ListStateMachines`
-   `states:ListTagsForResource`
-   `storagegateway:DescribeCachediSCSIVolumes`
-   `storagegateway:DescribeGatewayInformation`
-   `storagegateway:DescribeNFSFileShares`
-   `storagegateway:DescribeSMBFileShares`
-   `storagegateway:DescribeStorediSCSIVolumes`
-   `storagegateway:DescribeTapeArchives`
-   `storagegateway:ListFileShares`
-   `storagegateway:ListGateways`
-   `storagegateway:ListTagsForResource`
-   `storagegateway:ListTapePools`
-   `storagegateway:ListTapes`
-   `storagegateway:ListVolumes`
-   `tag:GetResources`
-   `transfer:DescribeServer`
-   `transfer:ListServers`
-   `transfer:ListTagsForResource`
-   `transfer:ListUsers`
-   `vpc-lattice:ListListeners`
-   `vpc-lattice:ListServiceNetworkServiceAssociations`
-   `vpc-lattice:ListServiceNetworkVpcAssociations`
-   `vpc-lattice:ListServiceNetworkVpcEndpointAssociations`
-   `vpc-lattice:ListServiceNetworks`
-   `vpc-lattice:ListServices`
-   `vpc-lattice:ListTargetGroups`
-   `waf:GetWebACL`
-   `waf:ListWebACLs`
-   `wafv2:GetIPSet`
-   `wafv2:GetLoggingConfiguration`
-   `wafv2:GetRuleGroup`
-   `wafv2:GetWebACL`
-   `wafv2:ListIPSets`
-   `wafv2:ListResourcesForWebACL`
-   `wafv2:ListRuleGroups`
-   `wafv2:ListTagsForResource`
-   `wafv2:ListWebACLs`
-   `workspaces:DescribeTags`
-   `workspaces:DescribeWorkspaceBundles`
-   `workspaces:DescribeWorkspaces`
-   `xray:GetEncryptionConfig`
-   `xray:GetGroups`
-   `xray:ListResourcePolicies`
-   `xray:ListTagsForResource`

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (205)

-   `access-analyzer:List*`
-   `account:Get*`
-   `acm-pca:List*`
-   `acm:Describe*`
-   `acm:List*`
-   `airflow:Get*`
-   `airflow:List*`
-   `apigateway:GET arn:aws:apigateway:*::/*`
-   `appconfig:Get*`
-   `appconfig:List*`
-   `aps:Describe*`
-   `aps:Get*`
-   `aps:List*`
-   `athena:Get*`
-   `athena:List*`
-   `auditmanager:Get*`
-   `auditmanager:List*`
-   `autoscaling:Describe*`
-   `aws-marketplace:Get*`
-   `aws-marketplace:List*`
-   `backup:Get*`
-   `backup:List*`
-   `batch:Describe*`
-   `batch:List*`
-   `bedrock-agentcore:Get*`
-   `bedrock-agentcore:List*`
-   `bedrock:Get*`
-   `bedrock:List*`
-   `cloudformation:Describe*`
-   `cloudformation:List*`
-   `cloudfront:Get*`
-   `cloudfront:List*`
-   `cloudhsm:Describe*`
-   `cloudhsm:List*`
-   `cloudtrail:Describe*`
-   `cloudtrail:Get*`
-   `cloudtrail:List*`
-   `cloudwatch:Describe*`
-   `cloudwatch:Get*`
-   `cloudwatch:List*`
-   `codeartifact:Describe*`
-   `codeartifact:Get*`
-   `codeartifact:List*`
-   `codebuild:BatchGet*`
-   `codebuild:Get*`
-   `codebuild:List*`
-   `codecommit:Get*`
-   `codecommit:List*`
-   `codedeploy:BatchGet*`
-   `codedeploy:Get*`
-   `codedeploy:List*`
-   `codeguru-profiler:List*`
-   `codeguru-reviewer:Describe*`
-   `codeguru-reviewer:List*`
-   `codepipeline:Get*`
-   `codepipeline:List*`
-   `cognito-identity:Describe*`
-   `cognito-identity:List*`
-   `cognito-idp:Describe*`
-   `cognito-idp:List*`
-   `config:BatchGet*`
-   `config:Describe*`
-   `config:Get*`
-   `datasync:Describe*`
-   `datasync:List*`
-   `dax:Describe*`
-   `detective:Get*`
-   `detective:List*`
-   `devops-guru:Describe*`
-   `devops-guru:List*`
-   `directconnect:Describe*`
-   `dms:Describe*`
-   `dms:List*`
-   `ds:Describe*`
-   `dynamodb:Describe*`
-   `dynamodb:List*`
-   `ec2:Describe*`
-   `ec2:Get*`
-   `ecr:Describe*`
-   `ecr:Get*`
-   `ecr:List*`
-   `ecs:Describe*`
-   `ecs:List*`
-   `eks:Describe*`
-   `eks:List*`
-   `elasticache:Describe*`
-   `elasticache:List*`
-   `elasticfilesystem:Describe*`
-   `elasticloadbalancing:Describe*`
-   `elasticmapreduce:Describe*`
-   `elasticmapreduce:List*`
-   `emr-serverless:Get*`
-   `emr-serverless:List*`
-   `es:Describe*`
-   `es:List*`
-   `events:List*`
-   `firehose:Describe*`
-   `firehose:List*`
-   `fms:List*`
-   `fsx:Describe*`
-   `glacier:Get*`
-   `glacier:List*`
-   `globalaccelerator:List*`
-   `glue:Get*`
-   `glue:List*`
-   `grafana:Describe*`
-   `grafana:List*`
-   `guardduty:Describe*`
-   `guardduty:Get*`
-   `guardduty:List*`
-   `health:Describe*`
-   `iam:Generate*`
-   `iam:Get*`
-   `iam:List*`
-   `identitystore:List*`
-   `imagebuilder:Get*`
-   `imagebuilder:List*`
-   `inspector2:Describe*`
-   `inspector2:Get*`
-   `inspector2:List*`
-   `inspector:Describe*`
-   `inspector:List*`
-   `kafka:Get*`
-   `kafka:List*`
-   `kinesis:Describe*`
-   `kinesis:List*`
-   `kms:Describe*`
-   `kms:Get*`
-   `kms:List*`
-   `lambda:Get*`
-   `lambda:List*`
-   `lex:Describe*`
-   `lex:List*`
-   `license-manager:List*`
-   `logs:Describe*`
-   `macie2:Get*`
-   `macie2:List*`
-   `mq:Describe*`
-   `mq:List*`
-   `neptune-graph:Get*`
-   `neptune-graph:List*`
-   `neptune:Describe*`
-   `network-firewall:Describe*`
-   `network-firewall:List*`
-   `networkmanager:Get*`
-   `networkmanager:List*`
-   `organizations:Describe*`
-   `organizations:List*`
-   `quicksight:Describe*`
-   `quicksight:List*`
-   `ram:Get*`
-   `ram:List*`
-   `rds:Describe*`
-   `redshift-serverless:List*`
-   `redshift:Describe*`
-   `rolesanywhere:Get*`
-   `rolesanywhere:List*`
-   `route53:Get*`
-   `route53:List*`
-   `route53domains:Get*`
-   `route53domains:List*`
-   `route53resolver:List*`
-   `s3:Get*`
-   `s3:List*`
-   `sagemaker:Describe*`
-   `sagemaker:List*`
-   `secretsmanager:Describe*`
-   `secretsmanager:Get*`
-   `secretsmanager:List*`
-   `securityhub:Describe*`
-   `securityhub:Get*`
-   `servicediscovery:Get*`
-   `servicediscovery:List*`
-   `ses:Get*`
-   `ses:List*`
-   `shield:Describe*`
-   `shield:Get*`
-   `shield:List*`
-   `signer:Get*`
-   `signer:List*`
-   `sns:Get*`
-   `sns:List*`
-   `sqs:Get*`
-   `sqs:List*`
-   `ssm:Describe*`
-   `ssm:Get*`
-   `ssm:List*`
-   `sso:Describe*`
-   `sso:Get*`
-   `sso:List*`
-   `states:Describe*`
-   `states:List*`
-   `storagegateway:Describe*`
-   `storagegateway:List*`
-   `tag:Get*`
-   `transfer:Describe*`
-   `transfer:List*`
-   `vpc-lattice:List*`
-   `waf:Get*`
-   `waf:List*`
-   `wafv2:Get*`
-   `wafv2:List*`
-   `workspaces:Describe*`
-   `xray:Get*`
-   `xray:List*`

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (211)

| Step | Permissions | Roles |
| --- | --- | --- |
| Build AccessAnalyzer Finding Principal Relationships | \- | \- |
| Build ACM Certificate to Cognito User Pool Relationships | `cognito-idp:DescribeUserPoolDomain` | `cognito-idp:Describe*` |
| Build AWS ApiGateway API to Domain Name Relationships | `apigateway:GET arn:aws:apigateway:*::/domainnames/*/apimappings` | `apigateway:GET arn:aws:apigateway:*::/*` |
| Build AWS EC2 VPC Endpoint Service to LB Relationships | \- | \- |
| Build AWS EC2 VPC Endpoint Service to VPC Endpoint Relationships | \- | \- |
| Build Bedrock Action Group to Lambda Function Relationships | \- | \- |
| Build Bedrock Agent Runtime to IAM Role Relationships | \- | \- |
| Build Bedrock Agent Runtime to VPC Relationships | \- | \- |
| Build Bedrock Agent to Foundation Model Relationships | \- | \- |
| Build Bedrock Agent to IAM Role Relationships | \- | \- |
| Build Bedrock Agent to KMS Key Relationships | \- | \- |
| Build Bedrock API Key to IAM User Relationships | \- | \- |
| Build Bedrock Code Interpreter to IAM Role Relationships | \- | \- |
| Build Bedrock Code Interpreter to VPC Relationships | \- | \- |
| Build Bedrock Custom Model to Foundation Model Relationships | \- | \- |
| Build Bedrock Custom Model to KMS Key Relationships | \- | \- |
| Build Bedrock Custom Model to S3 Bucket Relationships | \- | \- |
| Build Bedrock Data Source to S3 Bucket Relationships | \- | \- |
| Build Bedrock Evaluation Job to S3 Bucket Relationships | \- | \- |
| Build Bedrock Flow to IAM Role Relationships | \- | \- |
| Build Bedrock Flow to KMS Key Relationships | \- | \- |
| Build Bedrock Guardrail to Agent Relationships | \- | \- |
| Build Bedrock Guardrail to KMS Key Relationships | \- | \- |
| Build Bedrock Knowledge Base to Foundation Model Relationships | \- | \- |
| Build Bedrock Knowledge Base to IAM Role Relationships | \- | \- |
| Build Bedrock Knowledge Base to OpenSearch Domain Relationships | \- | \- |
| Build Bedrock Logging to CloudWatch Log Group Relationships | \- | \- |
| Build Bedrock Logging to S3 Bucket Relationships | \- | \- |
| Build Bedrock Model Customization Job to S3 Bucket Relationships | \- | \- |
| Build Bedrock Provisioned Throughput to Model Relationships | \- | \- |
| Build CodeArtifact Domain KMS Key Relationships | \- | \- |
| Build CodeArtifact Package Group Parent Relationships | \- | \- |
| Build CodeArtifact VPC Endpoint Relationships | \- | \- |
| Build CodeBuild Project Has VPC Relationship | \- | \- |
| Build CodeDeploy Deployment Group IAM Relationships | \- | \- |
| Build CodeGuru Reviewer Repository Association KMS Key Relationships | \- | \- |
| Build EC2 Instance uses IAM Instance Profile Relationships | `ec2:DescribeIamInstanceProfileAssociations` | `ec2:Describe*` |
| Build EMR Cluster to IAM Relationships | \- | \- |
| Build EMR Cluster to Security Configuration Relationships | \- | \- |
| Build EMR Cluster to VPC Endpoint Relationships | \- | \- |
| Build GuardDuty Publishing Destination to KMS Key Relationships | \- | \- |
| Build GuardDuty Publishing Destination to S3 Bucket Relationships | \- | \- |
| Build IAM Identity Center Group has User relationships | `identitystore:ListGroupMemberships` | `identitystore:List*` |
| Build IAM Identity Center Permission Set relationships | `sso:ListAccountAssignments`, `sso:ListAccountAssignmentsForPrincipal`, `sso:ListAccountsForProvisionedPermissionSet`, `sso:GetInlinePolicyForPermissionSet`, `sso:ListManagedPoliciesInPermissionSet`, `sso:ListCustomerManagedPolicyReferencesInPermissionSet` | `sso:Get*`, `sso:List*` |
| Build IAM Roles Anywhere Profile to IAM Policy Relationships | \- | \- |
| Build IAM Roles Anywhere Profile to IAM Role Relationships | \- | \- |
| Build IAM Roles Anywhere Trust Anchor to ACM PCA Relationships | \- | \- |
| Build Inspector v2 to KMS Key Relationships | \- | \- |
| Build Inspector v2 to Resource Relationships | `inspector2:ListCoverage` | `inspector2:List*` |
| Build Inspector v2 to VPC Endpoint Relationships | \- | \- |
| Build Kinesis Stream to Consumer Relationships | `kinesis:ListStreamConsumers` | `kinesis:List*` |
| Build Launch Template Version to Ami Relationships | \- | \- |
| Build OpenSearch Domain to CloudWatch Log Group Relationships | \- | \- |
| Build Quicksight Group to User Relationships | `quicksight:ListGroupMemberships` | `quicksight:List*` |
| Build Quicksight User to Custom Permissions Relationships | \- | \- |
| Build RDS DB Proxy connects RDS Cluster relationships | \- | \- |
| Build RDS DB Proxy connects RDS DB Instance relationships | \- | \- |
| Build Resource Explorer CloudTrail Relationships | \- | \- |
| Build Resource Explorer VPC Endpoint Relationships | \- | \- |
| Build Route53 Resolver Rules uses VPC relationships | `route53resolver:ListResolverRuleAssociations` | `route53resolver:List*` |
| Build S3 Bucket Lifecycle Rules | `s3:GetLifecycleConfiguration` | `s3:Get*` |
| Build SageMaker Domain Relationships | \- | \- |
| Build SageMaker Endpoint Relationships | \- | \- |
| Build SageMaker Feature Group Relationships | \- | \- |
| Build SageMaker Processing Job Relationships | \- | \- |
| Build SageMaker Training Job Relationships | \- | \- |
| Build SageMaker Transform Job Relationships | \- | \- |
| Build Service Catalog Portfolio Product Relationships | `servicecatalog:ListPortfoliosForProduct` | \- |
| Build Service Catalog Principal Relationships | `servicecatalog:ListPrincipalsForPortfolio` | \- |
| Build Shared DB Cluster Snapshot to Account Relationships | `rds:DescribeDBClusterSnapshots` | `rds:Describe*` |
| Build Shared DB Snapshot to Account Relationships | `rds:DescribeDBSnapshots` | `rds:Describe*` |
| Build States to CloudWatch Log Group Relationships | \- | \- |
| Build States to IAM Relationships | \- | \- |
| Build VPC Endpoint to Service Relationships | \- | \- |
| Build VPC has OpenSearch Domain Relationships | \- | \- |
| Build WAF v2 Web ACL to Resource Relationships | `wafv2:ListResourcesForWebACL` | `wafv2:List*` |
| Build WAF Web ACL to Cognito User Pool Relationships | `wafv2:ListResourcesForWebACL` | `wafv2:List*` |
| Fetch AccessAnalyzer Findings | `access-analyzer:ListFindings` | `access-analyzer:List*` |
| Fetch ApiGateway Api to Integration Relationship | `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources`, `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration` | `apigateway:GET arn:aws:apigateway:*::/*` |
| Fetch ApiGateway Resources | `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources`, `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*` | `apigateway:GET arn:aws:apigateway:*::/*` |
| Fetch ApiGateway Stages | `apigateway:GET arn:aws:apigateway:*::/restapis/*/stages`, `apigateway:GET arn:aws:apigateway:*::/restapis/*/stages/*` | `apigateway:GET arn:aws:apigateway:*::/*` |
| Fetch ApiGatewayV2 Authorizers | `apigateway:GET arn:aws:apigateway:*::/apis/*/authorizers` | `apigateway:GET arn:aws:apigateway:*::/*` |
| Fetch ApiGatewayV2 Integrations | `apigateway:GET arn:aws:apigateway:*::/apis/*/integrations` | `apigateway:GET arn:aws:apigateway:*::/*` |
| Fetch ApiGatewayV2 Routes | `apigateway:GET arn:aws:apigateway:*::/apis/*/routes` | `apigateway:GET arn:aws:apigateway:*::/*` |
| Fetch ApiGatewayV2 Stages | `apigateway:GET arn:aws:apigateway:*::/apis/*/stages` | `apigateway:GET arn:aws:apigateway:*::/*` |
| Fetch AppConfig Configuration Profiles | `appconfig:ListConfigurationProfiles`, `appconfig:GetConfigurationProfile` | `appconfig:List*`, `appconfig:Get*` |
| Fetch AppConfig Deployments | `appconfig:ListDeployments`, `appconfig:GetDeployment`, `appconfig:ListTagsForResource` | `appconfig:List*`, `appconfig:Get*` |
| Fetch AppConfig Environments | `appconfig:ListEnvironments` | `appconfig:List*` |
| Fetch AppConfig Hosted Configuration Versions | `appconfig:ListHostedConfigurationVersions` | `appconfig:List*` |
| Fetch Audit Manager Evidence Folders | `auditmanager:GetEvidenceFoldersByAssessmentControl` | `auditmanager:Get*` |
| Fetch Autoscaling Launch Config to Image Relationships | `ec2:DescribeImages` | `ec2:Describe*` |
| Fetch AWS EC2 Images | `ec2:DescribeImages`, `ec2:DescribeImageAttribute` | `ec2:Describe*` |
| Fetch AWS EC2 Internet Gateways | `ec2:DescribeInternetGateways` | `ec2:Describe*` |
| Fetch AWS EC2 Launch Template Versions | `ec2:DescribeLaunchTemplateVersions` | `ec2:Describe*` |
| Fetch AWS EC2 NAT Gateways | `ec2:DescribeNatGateways` | `ec2:Describe*` |
| Fetch AWS EC2 Subnets | `ec2:DescribeSubnets` | `ec2:Describe*` |
| Fetch AWS EC2 Volumes | `ec2:DescribeVolumes` | `ec2:Describe*` |
| Fetch AWS EC2 VPC Endpoints | `ec2:DescribeVpcEndpoints` | `ec2:Describe*` |
| Fetch AWS EC2 VPN Gateways | `ec2:DescribeVpnGateways`, `ec2:DescribeCustomerGateways` | `ec2:Describe*` |
| Fetch AWS EMR Instances | `elasticmapreduce:ListInstances` | `elasticmapreduce:List*` |
| Fetch AWS Organization | `organizations:DescribeOrganization`, `organizations:ListAccounts`, `organizations:ListTagsForResource` | `organizations:Describe*`, `organizations:List*` |
| Fetch Backup Copy Jobs | `backup:ListCopyJobs` | `backup:List*` |
| Fetch Backup Jobs | `backup:ListBackupJobs` | `backup:List*` |
| Fetch Backup Recovery Points | `backup:ListRecoveryPointsByBackupVault`, `backup:ListTagsForResource` | `backup:List*` |
| Fetch Backup Restore Jobs | `backup:ListRestoreJobs` | `backup:List*` |
| Fetch Batch Jobs | `batch:ListJobs` | `batch:List*` |
| Fetch Bedrock Agent Action Groups | `bedrock:ListAgentActionGroups`, `bedrock:GetAgentActionGroup` | `bedrock:Get*`, `bedrock:List*` |
| Fetch Bedrock Knowledge Base Data Sources | `bedrock:ListDataSources`, `bedrock:GetDataSource` | `bedrock:Get*`, `bedrock:List*` |
| Fetch Cloudfront Key Groups | `cloudfront:ListKeyGroups` | `cloudfront:List*` |
| Fetch Cloudhsm Backups | `cloudhsm:DescribeBackups` | `cloudhsm:Describe*` |
| Fetch CloudMap Service Instances | `servicediscovery:ListInstances`, `servicediscovery:GetInstance` | `servicediscovery:Get*`, `servicediscovery:List*` |
| Fetch CloudMap Services | `servicediscovery:ListServices`, `servicediscovery:ListTagsForResource` | `servicediscovery:Get*`, `servicediscovery:List*` |
| Fetch Cloudtrail Event Selectors | `cloudtrail:DescribeTrails`, `cloudtrail:GetEventSelectors` | `cloudtrail:Describe*`, `cloudtrail:Get*` |
| Fetch CloudWAN Attachments | `networkmanager:ListAttachments`, `networkmanager:ListAttachmentRoutingPolicyAssociations` | `networkmanager:List*` |
| Fetch CloudWAN Connect Peers | `networkmanager:ListConnectPeers`, `networkmanager:GetConnectPeer` | `networkmanager:List*`, `networkmanager:Get*` |
| Fetch CloudWAN Core Network Policies | `networkmanager:GetCoreNetworkPolicy` | `networkmanager:Get*` |
| Fetch CloudWatch Log Group Metrics | `cloudwatch:GetMetricData` | `cloudwatch:Get*` |
| Fetch Cloudwatch Logs Metric Filters | `logs:DescribeMetricFilters` | `logs:Describe*` |
| Fetch Cloudwatch Logs Subscription Filters | `logs:DescribeSubscriptionFilters` | `logs:Describe*` |
| Fetch CodeArtifact Package Groups | `codeartifact:ListPackageGroups`, `codeartifact:ListTagsForResource` | `codeartifact:List*` |
| Fetch CodeArtifact Packages | `codeartifact:ListPackages` | `codeartifact:List*` |
| Fetch CodeArtifact Repositories | `codeartifact:ListRepositories`, `codeartifact:DescribeRepository`, `codeartifact:GetRepositoryPermissionsPolicy`, `codeartifact:GetRepositoryEndpoint`, `codeartifact:ListTagsForResource` | `codeartifact:List*`, `codeartifact:Describe*`, `codeartifact:Get*` |
| Fetch CodeDeploy Deployment Groups | `codedeploy:ListDeploymentGroups`, `codedeploy:BatchGetDeploymentGroups`, `codedeploy:ListTagsForResource` | `codedeploy:BatchGet*`, `codedeploy:List*` |
| Fetch Cognito IDP User Pool Clients | `cognito-idp:ListUserPoolClients`, `cognito-idp:DescribeUserPoolClient` | `cognito-idp:Describe*`, `cognito-idp:List*` |
| Fetch Cognito IDP User Pool Users | `cognito-idp:ListUsers` | `cognito-idp:List*` |
| Fetch DataSync Locations | `datasync:ListLocations`, `datasync:DescribeLocationS3`, `datasync:DescribeLocationEfs`, `datasync:DescribeLocationFsxWindows`, `datasync:DescribeLocationFsxLustre`, `datasync:DescribeLocationFsxOntap`, `datasync:DescribeLocationFsxOpenZfs`, `datasync:DescribeLocationNfs`, `datasync:DescribeLocationSmb`, `datasync:DescribeLocationObjectStorage`, `datasync:DescribeLocationHdfs`, `datasync:ListTagsForResource` | `datasync:Describe*`, `datasync:List*` |
| Fetch DataSync Tasks | `datasync:ListTasks`, `datasync:DescribeTask`, `datasync:ListTagsForResource` | `datasync:Describe*`, `datasync:List*` |
| Fetch Detective Investigations | `detective:ListInvestigations`, `detective:GetInvestigation` | `detective:Get*`, `detective:List*` |
| Fetch DevOps Guru Anomalies | `devops-guru:ListAnomaliesForInsight` | `devops-guru:List*` |
| Fetch DevOps Guru Notification Channels | `devops-guru:ListNotificationChannels` | `devops-guru:List*` |
| Fetch EC2 Transit Gateway Attachments | `ec2:DescribeTransitGatewayAttachments` | `ec2:Describe*` |
| Fetch EC2 Transit Gateway Route Tables | `ec2:DescribeTransitGatewayRouteTables` | `ec2:Describe*` |
| Fetch EC2 Transit Gateway VPC Attachments | `ec2:DescribeTransitGatewayVpcAttachments` | `ec2:Describe*` |
| Fetch ECR Image Findings | `ecr:DescribeImageScanFindings` | `ecr:Describe*` |
| Fetch ECR Images | `ecr:DescribeImages` | `ecr:Describe*` |
| Fetch ECS Cluster Services | `ecs:ListServices`, `ecs:DescribeServices` | `ecs:Describe*`, `ecs:List*` |
| Fetch ECS Container Instances | `ecs:DescribeContainerInstances`, `ecs:ListContainerInstances` | `ecs:Describe*`, `ecs:List*` |
| Fetch ECS Task Definitions | `ecs:DescribeTaskDefinition`, `ecs:ListTaskDefinitionFamilies` | `ecs:Describe*`, `ecs:List*` |
| Fetch ECS Tasks | `ecs:DescribeTasks`, `ecs:ListTasks` | `ecs:Describe*`, `ecs:List*` |
| Fetch EFS Mount Targets | `elasticfilesystem:DescribeMountTargetSecurityGroups`, `elasticfilesystem:DescribeMountTargets` | `elasticfilesystem:Describe*` |
| Fetch EKS Node Groups | `eks:ListNodegroups`, `eks:DescribeNodegroup` | `eks:Describe*`, `eks:List*` |
| Fetch Elasticache Clusters Subnet Groups | `elasticache:DescribeCacheSubnetGroups` | `elasticache:Describe*` |
| Fetch Elasticache Snapshots | `elasticache:ListTagsForResource`, `elasticache:DescribeSnapshots` | `elasticache:Describe*`, `elasticache:List*` |
| Fetch ELB Listener Rules | `elasticloadbalancing:DescribeTags`, `elasticloadbalancing:DescribeRules` | `elasticloadbalancing:Describe*` |
| Fetch ELB Listeners | `elasticloadbalancing:DescribeTags`, `elasticloadbalancing:DescribeListeners` | `elasticloadbalancing:Describe*` |
| Fetch ELB Target Groups | `elasticloadbalancing:DescribeTags`, `elasticloadbalancing:DescribeTargetGroups`, `elasticloadbalancing:DescribeTargetHealth` | `elasticloadbalancing:Describe*` |
| Fetch Firewall Manager Resource Set Resources | `fms:ListResourceSetResources` | `fms:List*` |
| Fetch Global Accelerator Custom Routing Endpoint Groups | `globalaccelerator:ListCustomRoutingEndpointGroups` | `globalaccelerator:List*` |
| Fetch Global Accelerator Custom Routing Listeners | `globalaccelerator:ListCustomRoutingListeners` | `globalaccelerator:List*` |
| Fetch Global Accelerator Endpoint Groups | `globalaccelerator:ListEndpointGroups` | `globalaccelerator:List*` |
| Fetch Global Accelerator Listeners | `globalaccelerator:ListListeners` | `globalaccelerator:List*` |
| Fetch Guardduty Findings | `guardduty:ListFindings`, `guardduty:GetFindings` | `guardduty:Get*`, `guardduty:List*` |
| Fetch GuardDuty Publishing Destinations | `guardduty:ListPublishingDestinations`, `guardduty:DescribePublishingDestination` | `guardduty:List*`, `guardduty:Describe*` |
| Fetch IAM Group Policies | `iam:ListGroupPolicies`, `iam:GetGroupPolicy` | `iam:Get*`, `iam:List*` |
| Fetch IAM Group to User Relationships | `iam:GetGroup` | `iam:Get*` |
| Fetch IAM Identity Center Applications | `sso:ListApplications` | `sso:List*` |
| Fetch IAM Identity Center Groups | `identitystore:ListGroups` | `identitystore:List*` |
| Fetch IAM Identity Center Permission Sets | `sso:ListPermissionSets`, `sso:DescribePermissionSet`, `sso:ListTagsForResource` | `sso:Describe*`, `sso:List*` |
| Fetch IAM Identity Center Users | `identitystore:ListUsers` | `identitystore:List*` |
| Fetch IAM Policies | `iam:ListPolicies`, `iam:GetPolicyVersion`, `iam:ListEntitiesForPolicy`, `tag:GetResources` | `iam:Get*`, `iam:List*`, `tag:Get*` |
| Fetch IAM Role Policies | `iam:ListRolePolicies`, `iam:GetRolePolicy` | `iam:Get*`, `iam:List*` |
| Fetch IAM Roles | `iam:ListInstanceProfiles`, `iam:GetRole`, `iam:ListRoles`, `iam:ListRoleTags` | `iam:Get*`, `iam:List*` |
| Fetch IAM User Policies | `iam:ListUserPolicies`, `iam:GetUserPolicy` | `iam:Get*`, `iam:List*` |
| Fetch IAM Users | `iam:GetUser`, `iam:ListUsers`, `iam:ListUserTags`, `iam:ListAccessKeys`, `iam:ListMFADevices`, `iam:GetAccessKeyLastUsed` | `iam:Get*`, `iam:List*` |
| Fetch Inspector Findings | `inspector:DescribeFindings`, `inspector:DescribeRulesPackages`, `inspector:ListFindings` | `inspector:Describe*`, `inspector:List*` |
| Fetch Instance to Image Relationships | `ec2:DescribeImages` | `ec2:Describe*` |
| Fetch Lex V2 Bot Aliases | `lex:ListBotAliases`, `lex:DescribeResourcePolicy` | `lex:Describe*`, `lex:List*` |
| Fetch Marketplace Entitlements | `aws-marketplace:GetEntitlements` | `aws-marketplace:Get*` |
| Fetch Neptune Analytics Graph Export Tasks | `neptune-graph:ListExportTasks` | `neptune-graph:List*` |
| Fetch Neptune Analytics Graph Import Tasks | `neptune-graph:ListImportTasks`, `neptune-graph:GetImportTask` | `neptune-graph:Get*`, `neptune-graph:List*` |
| Fetch Neptune Analytics Graph Snapshots | `neptune-graph:ListGraphSnapshots`, `neptune-graph:ListTagsForResource` | `neptune-graph:List*` |
| Fetch Organization Policy Targets | `organizations:ListTargetsForPolicy` | `organizations:List*` |
| Fetch Organization Roots | `organizations:ListRoots` | `organizations:List*` |
| Fetch Organizational Units | `organizations:DescribeOrganizationalUnit`, `organizations:ListChildren` | `organizations:Describe*`, `organizations:List*` |
| Fetch Quicksight Dashboards | `quicksight:ListDashboards`, `quicksight:DescribeDashboard`, `quicksight:DescribeDashboardPermissions` | `quicksight:Describe*`, `quicksight:List*` |
| Fetch Quicksight Data Sets | `quicksight:ListDataSets`, `quicksight:DescribeDataSet` | `quicksight:Describe*`, `quicksight:List*` |
| Fetch Quicksight Data Sources | `quicksight:ListDataSources`, `quicksight:DescribeDataSource` | `quicksight:Describe*`, `quicksight:List*` |
| Fetch RAM Resource Share Associations | `ram:GetResourceShareAssociations` | `ram:Get*` |
| Fetch RAM Resource Share Invitations | `ram:GetResourceShareInvitations` | `ram:Get*` |
| Fetch RAM Shared Resources | `ram:ListResources` | `ram:List*` |
| Fetch RDS DB Proxy Target Groups | `rds:DescribeDBProxyTargetGroups` | `rds:Describe*` |
| Fetch Restore Testing Plans | `backup:ListRestoreTestingPlans`, `backup:ListTags` | `backup:List*` |
| Fetch Route53 Records | `route53:ListResourceRecordSets` | `route53:List*` |
| Fetch S3 Access Points | `s3:ListAccessPoints` | `s3:List*` |
| Fetch S3 Buckets | `cloudwatch:GetMetricData`, `s3:ListAllMyBuckets`, `s3:GetBucketLocation`, `s3:GetBucketPolicy`, `s3:GetBucketTagging`, `s3:GetBucketAcl`, `s3:GetBucketLogging`, `s3:GetBucketNotification`, `s3:GetBucketVersioning`, `s3:GetReplicationConfiguration`, `s3:GetBucketPublicAccessBlock`, `s3:GetBucketObjectLockConfiguration`, `s3:GetLifecycleConfiguration`, `s3:GetBucketOwnershipControls`, `s3:GetBucketPolicyStatus`, `s3:GetEncryptionConfiguration`, `s3:GetInventoryConfiguration` | `cloudwatch:Get*`, `s3:Get*`, `s3:List*` |
| Fetch S3 Buckets Website Config | `s3:GetBucketWebsite` | `s3:Get*` |
| Fetch Secret Versions | `secretsmanager:ListSecretVersionIds` | `secretsmanager:List*` |
| Fetch Secrets | `secretsmanager:ListSecrets`, `secretsmanager:DescribeSecret`, `secretsmanager:GetResourcePolicy` | `secretsmanager:Describe*`, `secretsmanager:Get*`, `secretsmanager:List*` |
| Fetch Service Catalog Constraints | `servicecatalog:ListConstraintsForPortfolio`, `servicecatalog:DescribeConstraint` | \- |
| Fetch Service Catalog Launch Paths | `servicecatalog:ListLaunchPaths` | \- |
| Fetch Service Catalog Provisioning Artifacts | `servicecatalog:ListProvisioningArtifacts` | \- |
| Fetch Service Catalog Tag Options | `servicecatalog:ListTagOptions`, `servicecatalog:ListResourcesForTagOption` | \- |
| Fetch Signer Signing Jobs | `signer:ListSigningJobs` | `signer:List*` |
| Fetch Signer Signing Profiles | `signer:ListSigningProfiles`, `signer:GetSigningProfile`, `signer:ListProfilePermissions` | `signer:List*`, `signer:Get*` |
| Fetch SSM Instance Inventory Entries | `ssm:ListInventoryEntries` | `ssm:List*` |
| Fetch SSM Instance Patch States | `ssm:DescribeInstancePatchStates` | `ssm:Describe*` |
| Fetch SSM Service to EC2 Instance Relationships | `ssm:DescribeInstanceInformation` | `ssm:Describe*` |
| Fetch Storage Gateway File Shares | `storagegateway:ListFileShares`, `storagegateway:DescribeNFSFileShares`, `storagegateway:DescribeSMBFileShares`, `storagegateway:ListTagsForResource` | `storagegateway:Describe*`, `storagegateway:List*` |
| Fetch Storage Gateway Tapes | `storagegateway:ListTapes`, `storagegateway:DescribeTapeArchives`, `storagegateway:ListTagsForResource` | `storagegateway:Describe*`, `storagegateway:List*` |
| Fetch Storage Gateway Volumes | `storagegateway:ListVolumes`, `storagegateway:DescribeCachediSCSIVolumes`, `storagegateway:DescribeStorediSCSIVolumes`, `storagegateway:ListTagsForResource` | `storagegateway:Describe*`, `storagegateway:List*` |
| Fetch Transfer Servers details | \- | \- |
| Fetch Transfer Users | `transfer:ListUsers`, `transfer:ListTagsForResource` | `transfer:List*` |
| Fetch VPC Lattice Listeners | `vpc-lattice:ListListeners` | `vpc-lattice:List*` |
| Fetch VPC Lattice Networks | `vpc-lattice:ListServiceNetworks` | `vpc-lattice:List*` |
| Fetch VPC Lattice Service Network Service Associations | `vpc-lattice:ListServiceNetworkServiceAssociations` | `vpc-lattice:List*` |
| Fetch VPC Lattice Service Network VPC Associations | `vpc-lattice:ListServiceNetworkVpcAssociations` | `vpc-lattice:List*` |
| Fetch VPC Lattice Service Network VPC Endpoint Associations | `vpc-lattice:ListServiceNetworkVpcEndpointAssociations` | `vpc-lattice:List*` |
| Fetch VPC Lattice Services | `vpc-lattice:ListServices` | `vpc-lattice:List*` |
| Fetch VPC Lattice Target Groups | `vpc-lattice:ListTargetGroups` | `vpc-lattice:List*` |
| Fetch VPC to VPC Relationships | `ec2:DescribeVpcPeeringConnections` | `ec2:Describe*` |
| Fetch WAF v2 IP Sets | `wafv2:GetIPSet`, `wafv2:ListIPSets`, `wafv2:ListTagsForResource` | `wafv2:Get*`, `wafv2:List*` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| AccessAnalyzer Analyzer | `aws_accessanalyzer_analyzer` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment), [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| AccessAnalyzer Finding | `aws_accessanalyzer_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| ACM Certificate | `aws_acm_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| Amazon Managed Grafana | `aws_grafana` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Amazon Managed Service for Prometheus | `aws_prometheus` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| ApiGateway Domain Name | `aws_api_gateway_domain_name` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| ApiGateway Resource | `aws_api_gateway_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| ApiGateway Resource Method | `aws_api_gateway_method` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| ApiGateway Rest Api | `aws_api_gateway_rest_api` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ApiGateway Stage | `aws_api_gateway_stage` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| ApiGateway Stage Method Setting | `aws_api_gateway_stage_method_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ApiGatewayV2 Api | `aws_api_gateway_v2_api` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ApiGatewayV2 Authorizer | `aws_api_gateway_v2_authorizer` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ApiGatewayV2 Integration | `aws_api_gateway_v2_integration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ApiGatewayV2 Route | `aws_api_gateway_v2_route` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| ApiGatewayV2 Stage | `aws_api_gateway_v2_stage` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Athena Work Group | `aws_athena_work_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Audit Manager Assessment | `aws_auditmanager_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Audit Manager Control | `aws_auditmanager_control` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Audit Manager Evidence Folder | `aws_auditmanager_evidence_folder` | [DataObject](https://docs.jupiterone.io/data-model/schemas/DataObject) |
| Audit Manager Framework | `aws_auditmanager_framework` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Autoscaling Group | `aws_autoscaling_group` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Autoscaling Launch Configuration | `aws_autoscaling_launch_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Autoscaling Policy | `aws_autoscaling_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AccessAnalyzer Service | `aws_accessanalyzer` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Account | `aws_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AWS ACM Service | `aws_acm` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS ApiGateway Service | `aws_apigateway` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS AppConfig | `aws_appconfig` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS AppConfig Account Settings | `aws_appconfig_account_settings` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AppConfig Application | `aws_appconfig_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS AppConfig Configuration Profile | `aws_appconfig_configuration_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AppConfig Deployment | `aws_appconfig_deployment` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| AWS AppConfig Deployment Strategy | `aws_appconfig_deployment_strategy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AppConfig Environment | `aws_appconfig_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AppConfig Hosted Configuration Version | `aws_appconfig_hosted_configuration_version` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Athena Service | `aws_athena` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Audit Manager Delegation | `aws_auditmanager_delegation` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Audit Manager Service | `aws_auditmanager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Audit Manager Settings | `aws_auditmanager_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Auto Scaling Plans Service | `aws_autoscalingplans` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Autoscaling Service | `aws_autoscaling` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Backup Copy Job | `aws_backup_copy_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Backup Job | `aws_backup_job` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Backup Plan | `aws_backup_plan` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Backup Recovery Point | `aws_backup_recovery_point` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Backup Restore Job | `aws_backup_restore_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Backup Service | `aws_backup` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Backup Vault | `aws_backup_vault` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Batch Compute Environment | `aws_batch_compute_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Batch Job Definition | `aws_batch_job_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| AWS Batch Job Queue | `aws_batch_job_queue` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| AWS Batch Service | `aws_batch` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Bedrock Agent | `aws_bedrock_agent` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| AWS Bedrock Agent Action Group | `aws_bedrock_agent_action_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Agent Runtime | `aws_bedrock_agent_runtime` | [Workload](https://docs.jupiterone.io/data-model/schemas/Workload) |
| AWS Bedrock API Key | `aws_bedrock_api_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| AWS Bedrock Code Interpreter | `aws_bedrock_code_interpreter` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Bedrock Custom Model | `aws_bedrock_custom_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Bedrock Evaluation Job | `aws_bedrock_evaluation_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Bedrock Flow | `aws_bedrock_flow` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AWS Bedrock Foundation Model | `aws_bedrock_foundation_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Bedrock Guardrail | `aws_bedrock_guardrail` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| AWS Bedrock Inference Profile | `aws_bedrock_inference_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Knowledge Base | `aws_bedrock_knowledge_base` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Bedrock Knowledge Base Data Source | `aws_bedrock_knowledge_base_data_source` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Model Customization Job | `aws_bedrock_model_customization_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Bedrock Model Invocation Logging | `aws_bedrock_model_invocation_logging` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Provisioned Throughput | `aws_bedrock_provisioned_throughput` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Bedrock Service | `aws_bedrock` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cloud WAN Attachment | `aws_networkmanager_attachment` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Cloud WAN Connect Peer | `aws_networkmanager_connect_peer` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloud WAN Core Network | `aws_networkmanager_core_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Cloud WAN Core Network Policy | `aws_networkmanager_core_network_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloudformation Service | `aws_cloudformation` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cloudformation Stacks | `aws_cloudformation_stack` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloudfront Distribution | `aws_cloudfront_distribution` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Cloudfront Distribution Origin | `aws_cloudfront_distribution_origin` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloudfront Key Group | `aws_cloudfront_key_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS Cloudfront Public Key | `aws_cloudfront_public_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| AWS Cloudfront Service | `aws_cloudfront` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cloudhsm Service | `aws_cloudhsm` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudMap Namespace | `aws_cloudmap_namespace` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS CloudMap Service | `aws_cloudmap` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudMap Service | `aws_cloudmap_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudMap Service Instance | `aws_cloudmap_service_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS Cloudtrail Service | `aws_cloudtrail` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudTrail Trail | `aws_cloudtrail_trail` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloudwatch Alarms | `aws_cloudwatch_metric_alarm` | Monitor |
| AWS Cloudwatch Event | `aws_cloudwatch_events` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudWatch Log Group Metrics | `aws_cloudwatch_log_group_metrics` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| AWS Cloudwatch Logs Service | `aws_cloudwatch_logs` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cloudwatch Service | `aws_cloudwatch` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeArtifact Service | `aws_codeartifact` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeBuild Service | `aws_codebuild` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeCommit Service | `aws_codecommit` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeDeploy Service | `aws_codedeploy` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeGuru Service | `aws_codeguru` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodePipeline Service | `aws_codepipeline` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cognito Identity | `aws_cognito_identity` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cognito Identity Pool | `aws_cognito_identity_pool` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cognito IDP Service | `aws_cognito_idp` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cognito IDP User Pool Client | `aws_cognito_user_pool_client` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS Cognito IDP User Pool User | `aws_cognito_user_pool_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| AWS Config Rule Finding | `aws_config_rule_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| AWS Customer Gateway | `aws_customer_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Database Migration Service | `aws_dms` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Database Migration Service Endpoint | `aws_dms_endpoint` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| AWS Database Migration Service Instance | `aws_dms_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS DataSync Location | `aws_datasync_location` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS DataSync Service | `aws_datasync` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS DataSync Task | `aws_datasync_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Dedicated Host | `aws_dedicated_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS Detective Service | `aws_detective` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS DevOps Guru Service | `aws_devops_guru` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Direct Connect BGP Peer | `aws_directconnect_bgp_peer` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Direct Connect Connection | `aws_directconnect_connection` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Direct Connect Gateway | `aws_directconnect_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Direct Connect LAG | `aws_directconnect_lag` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Direct Connect Service | `aws_directconnect` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Direct Connect Virtual Interface | `aws_directconnect_virtual_interface` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Directory Service | `aws_ds` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Directory Service Directory | `aws_ds_directory` | [Directory](https://docs.jupiterone.io/data-model/schemas/Directory) |
| AWS DynamoDB Service | `aws_dynamodb` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EC2 Image Builder | `aws_imagebuilder` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EC2 Service | `aws_ec2` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EC2 Settings | `aws_ec2_settings` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS EC2 Transit Gateway | `aws_ec2_transit_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS EC2 Transit Gateway Attachment | `aws_ec2_transit_gateway_attachment` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS EC2 Transit Gateway Route Table | `aws_ec2_transit_gateway_route_table` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS EC2 Transit Gateway VPC Attachment | `aws_ec2_transit_gateway_vpc_attachment` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS ECR Service | `aws_ecr` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS ECS Service | `aws_ecs` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EFS Service | `aws_efs` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EIP Address | `aws_eip` | [IpAddress](https://docs.jupiterone.io/data-model/schemas/IpAddress) |
| AWS EKS Service | `aws_eks` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS ElastiCache Service | `aws_elasticache` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Elasticsearch Service | `aws_es` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS ELB Service | `aws_elasticloadbalancing` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EMR Cluster | `aws_elasticmapreduce_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS EMR Security Configuration | `aws_emr_security_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS EMR Serverless | `aws_emr_serverless` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EMR Serverless Application | `aws_emr_serverless_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS EMR Service | `aws_elasticmapreduce` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Firehose Delivery Stream | `aws_firehose_delivery_stream` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection), [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| AWS Firehose Service | `aws_firehose` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Firewall Manager | `aws_fms` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS FSx | `aws_fsx` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Glacier Service | `aws_glacier` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Global Accelerator Accelerator | `aws_global_accelerator_accelerator` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Global Accelerator Endpoint Group | `aws_global_accelerator_endpoint_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS Global Accelerator Listener | `aws_global_accelerator_listener` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Global Accelerator Service | `aws_global_accelerator` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Glue Catalog Database | `aws_glue_catalog_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| AWS Glue Connection | `aws_glue_connection` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Glue Data Catalog Encryption Settings | `aws_glue_data_catalog_encryption_settings` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| AWS Glue Dev Endpoint | `aws_glue_dev_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| AWS Glue Job | `aws_glue_job` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AWS Glue Security Configurations | `aws_glue_security_configuration` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| AWS Glue Service | `aws_glue` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Glue Session | `aws_glue_session` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Grafana Workspace | `aws_grafana_workspace` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS Guardduty Service | `aws_guardduty` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Health Event | `aws_health_event` | Event |
| AWS Health Service | `aws_health` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS IAM Identity Center | `aws_sso` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS IAM Identity Center Application | `aws_sso_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS IAM Identity Center Group | `aws_sso_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| AWS IAM Identity Center Instance | `aws_sso_instance` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS IAM Identity Center Permission Set | `aws_sso_permission_set` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS IAM Identity Center User | `aws_sso_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| AWS IAM Roles Anywhere Profile | `aws_iam_roles_anywhere_profile` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| AWS IAM Roles Anywhere Service | `aws_iam_roles_anywhere` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS IAM Roles Anywhere Trust Anchor | `aws_iam_roles_anywhere_trust_anchor` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| AWS IAM Service | `aws_iam` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Image | `aws_ami` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource), [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| AWS Image Builder Component | `aws_imagebuilder_component` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| AWS Image Builder Container Recipe | `aws_imagebuilder_container_recipe` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Image Builder Distribution Configuration | `aws_imagebuilder_distribution_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Image Builder Image | `aws_imagebuilder_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| AWS Image Builder Image Pipeline | `aws_imagebuilder_image_pipeline` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AWS Image Builder Infrastructure Configuration | `aws_imagebuilder_infrastructure_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Image Builder Lifecycle Policy | `aws_imagebuilder_lifecycle_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Image Builder Workflow | `aws_imagebuilder_workflow` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AWS Inspector Assessment | `aws_inspector_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| AWS Inspector Service | `aws_inspector` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Inspector v2 Service | `aws_inspectorv2` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Instance | `aws_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS Instance Application | `aws_instance_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS Internet Gateway | `aws_internet_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Key Pair | `aws_key_pair` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| AWS Kinesis Consumer | `aws_kinesis_consumer` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS Kinesis Service | `aws_kinesis` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Kinesis Stream | `aws_kinesis_stream` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection), [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| AWS KMS Key | `aws_kms_key` | [CryptoKey](https://docs.jupiterone.io/data-model/schemas/CryptoKey), [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| AWS KMS Service | `aws_kms` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Lambda Service | `aws_lambda` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Launch Template | `aws_launch_template` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Launch Template Version | `aws_launch_template_version` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| AWS Lex V2 Bot | `aws_lexv2_bot` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Lex V2 Bot Alias | `aws_lexv2_bot_alias` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Lex V2 Service | `aws_lexv2` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS License Manager License | `aws_license_manager_license` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| AWS License Manager Received License | `aws_license_manager_received_license` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| AWS License Manager Service | `aws_license_manager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Macie Finding | `aws_macie_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| AWS Macie Service | `aws_macie` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Marketplace Entitlement | `aws_marketplace_entitlement` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| AWS Marketplace Entity | `aws_marketplace_entity` | [Product](https://docs.jupiterone.io/data-model/schemas/Product) |
| AWS Marketplace Service | `aws_marketplace` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS MQ | `aws_mq` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS MQ Broker | `aws_mq_broker` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS MSK | `aws_msk` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS MSK Cluster | `aws_msk_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS MWAA Environment | `aws_mwaa_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS NAT Gateway | `aws_nat_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Neptune Service | `aws_neptune` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Network ACL | `aws_network_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Network Firewall Service | `aws_networkfirewall` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Network Interface | `aws_eni` | [NetworkInterface](https://docs.jupiterone.io/data-model/schemas/NetworkInterface) |
| AWS Network Manager | `aws_networkmanager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS OpenSearch Domain | `aws_opensearch_domain` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS OpenSearch Service | `aws_opensearch` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Organization | `aws_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| AWS Organization Root | `aws_organization_root` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS Organizational Unit | `aws_organizational_unit` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS Prefix List | `aws_prefix_list` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Private Certificate Authority Service | `aws_acm_pca` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Prometheus Scraper | `aws_prometheus_scraper` | [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| AWS Prometheus Workspace | `aws_prometheus_workspace` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Quicksight Service | `aws_quicksight` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS RAM Principal | `aws_ram_principal` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AWS RAM Resource Share | `aws_ram_resource_share` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS RAM Resource Share Invitation | `aws_ram_resource_share_invitation` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| AWS RAM Shared Resource | `aws_ram_shared_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS RDS Service | `aws_rds` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Redshift Serverless Service | `aws_redshift_serverless` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Redshift Service | `aws_redshift` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Resource Access Manager Service | `aws_ram_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Resource Explorer Service | `aws_resource_explorer` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Restore Testing Plan | `aws_backup_restore_testing_plan` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Route Table | `aws_route_table` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Route53 Domain | `aws_route53_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| AWS Route53 Hosted Zone | `aws_route53_zone` | [DomainZone](https://docs.jupiterone.io/data-model/schemas/DomainZone) |
| AWS Route53 record | `aws_route53_record` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |
| AWS Route53 Resolver Rule | `aws_route53_resolver_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS Route53 Service | `aws_route53` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS S3 Access Point | `aws_s3_access_point` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| AWS S3 Bucket | `aws_s3_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS S3 Bucket Lifecycle Rule | `aws_s3_bucket_lifecycle_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS S3 Bucket Policy | `aws_s3_bucket_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| AWS S3 Service | `aws_s3` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS S3 Website Configuration | `aws_s3_website_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SageMaker | `aws_sagemaker` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS SageMaker Domain | `aws_sagemaker_domain` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS SageMaker Endpoint | `aws_sagemaker_endpoint` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS SageMaker Feature Group | `aws_sagemaker_feature_group` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS SageMaker Model | `aws_sagemaker_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS SageMaker Notebook Instance | `aws_sagemaker_notebook_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS SageMaker Processing Job | `aws_sagemaker_processing_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS SageMaker Training Job | `aws_sagemaker_training_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS SageMaker Transform Job | `aws_sagemaker_transform_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Secrets Manager Service | `aws_secretsmanager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Security Group | `aws_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Security Hub | `aws_securityhub` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Security Hub Control | `aws_securityhub_control` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| AWS Security Hub Standard | `aws_securityhub_standard` | [Standard](https://docs.jupiterone.io/data-model/schemas/Standard) |
| AWS Service Catalog | `aws_servicecatalog` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Service Catalog Constraint | `aws_servicecatalog_constraint` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| AWS Service Catalog Launch Path | `aws_servicecatalog_launch_path` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Service Catalog Portfolio | `aws_servicecatalog_portfolio` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Service Catalog Product | `aws_servicecatalog_product` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Service Catalog Provisioning Artifact | `aws_servicecatalog_provisioning_artifact` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Service Catalog Tag Option | `aws_servicecatalog_tag_option` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SES Configuration Set | `aws_ses_configuration_set` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SES Identity | `aws_ses_identity` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| AWS SES Receipt Filter | `aws_ses_receipt_filter` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| AWS SES Service | `aws_ses` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Shield Protection | `aws_shield_protection` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Shield Protection Group | `aws_shield_protection_group` | ResourceGroup |
| AWS Shield Service | `aws_shield` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Shield Subscription | `aws_shield_subscription` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| AWS Signer Service | `aws_signer` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Signer Signing Job | `aws_signer_signing_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Signer Signing Profile | `aws_signer_signing_profile` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Snapshot | `aws_ebs_snapshot` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk), [Image](https://docs.jupiterone.io/data-model/schemas/Image), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS SNS Service | `aws_sns` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS SNS Subscription | `aws_sns_subscription` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| AWS SNS Topic | `aws_sns_topic` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| AWS SQS Service | `aws_sqs` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS SSM Associations | `aws_ssm_associations` | [Document](https://docs.jupiterone.io/data-model/schemas/Document) |
| AWS SSM Compliance Summary | `aws_ssm_compliance_summary` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| AWS SSM Document | `aws_ssm_document` | [Document](https://docs.jupiterone.io/data-model/schemas/Document) |
| AWS SSM Instance Inventory | `aws_instance_inventory` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SSM Instance Patch State | `aws_instance_patch_state` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| AWS SSM Patch Baseline | `aws_patch_baseline` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SSM Patch Group | `aws_patch_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS SSM Secure String Parameter Metadata | `aws_secure_string_parameter` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| AWS SSM Service | `aws_ssm` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS SSM Service Setting | `aws_ssm_service_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SSM Session Document | `aws_session_document` | [Document](https://docs.jupiterone.io/data-model/schemas/Document) |
| AWS States Service | `aws_states` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS States State Machine | `aws_states_state_machine` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| AWS Storage Gateway | `aws_storage_gateway_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Storage Gateway File Share | `aws_storage_gateway_file_share` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Storage Gateway Service | `aws_storage_gateway` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Storage Gateway Tape | `aws_storage_gateway_tape` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Storage Gateway Tape Pool | `aws_storage_gateway_tape_pool` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Storage Gateway Volume | `aws_storage_gateway_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| AWS Subnet | `aws_subnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Transfer Server | `aws_transfer_server` | [Host](https://docs.jupiterone.io/data-model/schemas/Host), [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Transfer Service | `aws_transfer` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Transfer User | `aws_transfer_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| AWS Volume | `aws_ebs_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| AWS VPC | `aws_vpc` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS VPC Endpoint | `aws_vpc_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| AWS VPC Endpoint Service | `aws_vpc_endpoint_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS VPC Lattice | `aws_vpc_lattice` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS VPC Lattice Listener | `aws_vpc_lattice_listener` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| AWS VPC Lattice Listener Rule | `aws_vpc_lattice_listener_rule` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS VPC Lattice Service | `aws_vpc_lattice_service` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| AWS VPC Lattice Service Network | `aws_vpc_lattice_service_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS VPC Lattice Target Group | `aws_vpc_lattice_target_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS VPC Service | `aws_ec2_vpc` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS VPN Connection | `aws_vpn_connection` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS VPN Gateway | `aws_vpn_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS WAF Classic Service | `aws_waf` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS WAF v2 IP Set | `aws_waf_v2_ip_set` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS WAF v2 Rule Group | `aws_waf_v2_rule_group` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| AWS WAF v2 Service | `aws_wafv2` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS WAF v2 Web ACL | `aws_waf_v2_web_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS WAF v2 Web ACL Firewall Manager Rule Group | `aws_waf_v2_web_acl_firewall_manager_rule_group` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS WAF v2 Web ACL Rule | `aws_waf_v2_web_acl_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS WAF Web ACL | `aws_waf_web_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS WorkSpaces Bundle | `aws_workspaces_bundle` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS WorkSpaces Service | `aws_workspaces` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS WorkSpaces Workspace | `aws_workspace` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS X-Ray Service | `aws_xray` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Batch Job | `aws_batch_job` | [Process](https://docs.jupiterone.io/data-model/schemas/Process), [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Cloudhsm Backup | `aws_cloudhsm_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup), [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |
| Cloudhsm Cluster | `aws_cloudhsm_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster), [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |
| Cloudhsm Instance | `aws_cloudhsm_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host), [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |
| Cloudwatch Events Rule | `aws_cloudwatch_event_rule` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Cloudwatch Logs Destination | `aws_cloudwatch_log_destination` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| Cloudwatch Logs Log Group | `aws_cloudwatch_log_group` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| CloudWatch Logs Metric Filter | `aws_cloudwatch_log_metric_filter` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Cloudwatch Logs Subscription Filter | `aws_cloudwatch_log_subscription_filter` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| CodeArtifact Domain | `aws_codeartifact_domain` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| CodeArtifact Package | `aws_codeartifact_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| CodeArtifact Package Group | `aws_codeartifact_package_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| CodeArtifact Repository | `aws_codeartifact_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| CodeBuild Project | `aws_codebuild_project` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodeBuild Report Group | `aws_codebuild_report_group` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| CodeCommit Repository | `aws_codecommit_repository` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| CodeDeploy Application | `aws_codedeploy_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| CodeDeploy Deployment Config | `aws_codedeploy_deployment_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodeDeploy Deployment Group | `aws_codedeploy_deployment_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodeGuru Profiling Group | `aws_codeguru_profiling_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodeGuru Reviewer Repository Association | `aws_codeguru_reviewer_repository_association` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodePipeline Pipeline | `aws_codepipeline_pipeline` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| Cognito User Pool | `aws_cognito_user_pool` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Configservice Rule | `aws_config_rule` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Configservice Service | `aws_config` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Detective Graph | `aws_detective_graph` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Detective Investigation | `aws_detective_investigation` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| DevOps Guru Anomaly | `aws_devops_guru_anomaly` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| DevOps Guru Insight | `aws_devops_guru_insight` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| DevOps Guru Notification Channel | `aws_devops_guru_notification_channel` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| DynamoDB Accelerator (DAX) Cluster | `aws_dax_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| DynamoDB Accelerator (DAX) Service | `aws_dax` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| DynamoDB Global Table | `aws_dynamodb_global_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| DynamoDB Table | `aws_dynamodb_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| ECR Image | `aws_ecr_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| ECR Image Finding | `aws_ecr_image_scan_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| ECR Repository | `aws_ecr_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| ECS Cluster | `aws_ecs_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| ECS Cluster Service | `aws_ecs_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| ECS Container Instance | `aws_ecs_container_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host), [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| ECS Task | `aws_ecs_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task), [Process](https://docs.jupiterone.io/data-model/schemas/Process) |
| ECS Task Container Definition | `aws_ecs_task_container_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ECS Task Definition | `aws_ecs_task_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| EFS File System | `aws_efs_file_system` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| EFS Mount Target | `aws_efs_mount_target` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| EKS Clusters | `aws_eks_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| EKS Node Group | `aws_eks_node_group` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Elasticache Cluster | `aws_elasticache_memcached_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Elasticache Node | `aws_elasticache_cluster_node` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Elasticache Redis Cluster | `aws_elasticache_redis_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Elasticache Snapshot | `aws_elasticache_snapshot` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Image](https://docs.jupiterone.io/data-model/schemas/Image), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Elasticsearch Domain | `aws_elasticsearch_domain` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| ELB Application Load Balancer | `aws_alb` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ELB Gateway Load Balancer | `aws_elb` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ELB Listener | `aws_lb_listener` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| ELB Listener Rule | `aws_lb_listener_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| ELB Network Load Balancer | `aws_nlb` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ELB Target Group | `aws_lb_target_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| EventBridge API Destination | `aws_eventbridge_api_destination` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| EventBridge Archive | `aws_eventbridge_archive` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| EventBridge Connection | `aws_eventbridge_connection` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| EventBridge Event Bus | `aws_eventbridge_event_bus` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| EventBridge Global Endpoint | `aws_eventbridge_endpoint` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Firewall | `aws_firewall` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Firewall Policy | `aws_firewall_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Firewall Rule Group | `aws_firewall_rule_group` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| FMS Application List | `aws_fms_application_list` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| FMS Policy | `aws_fms_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| FMS Protocols List | `aws_fms_protocols_list` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| FMS Resource Set | `aws_fms_resource_set` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| FSx File System | `aws_fsx_file_system` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Glacier Vault | `aws_glacier_vault` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Guardduty Detector | `aws_guardduty_detector` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment), [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| Guardduty Finding | `aws_guardduty_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| GuardDuty Publishing Destination | `aws_guardduty_publishing_destination` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| IAM Access Key | `aws_iam_access_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key), [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAM Account Password Policy | `aws_iam_account_password_policy` | [PasswordPolicy](https://docs.jupiterone.io/data-model/schemas/PasswordPolicy) |
| IAM Group | `aws_iam_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| IAM Group Policy | `aws_iam_group_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| IAM Instance Profile | `aws_iam_instance_profile` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAM MFA Device | `mfa_device` | [Key](https://docs.jupiterone.io/data-model/schemas/Key), [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| IAM OIDC Provider | `aws_iam_oidc_provider` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| IAM Policy | `aws_iam_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| IAM Role | `aws_iam_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAM Role Policy | `aws_iam_role_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| IAM SAML Provider | `aws_iam_saml_provider` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| IAM Server Certificate | `aws_iam_server_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAM User | `aws_iam_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| IAM User Policy | `aws_iam_user_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Inspector Finding | `aws_inspector_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Inspector Finding | `aws_inspector_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Inspector v2 Configuration | `aws_inspectorv2_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Inspector v2 Filter | `aws_inspectorv2_filter` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Inspector v2 Finding | `aws_inspectorv2_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Inspector v2 Finding | `aws_inspectorv2_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Lambda Functions | `aws_lambda_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| Managed Workflows for Apache Airflow | `aws_mwaa` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Neptune Analytics Graph | `aws_neptune_analytics_graph` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Neptune Analytics Graph Export Task | `aws_neptune_analytics_graph_export_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Neptune Analytics Graph Import Task | `aws_neptune_analytics_graph_import_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Neptune Analytics Graph Snapshot | `aws_neptune_analytics_graph_snapshot` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Neptune Database Cluster | `aws_neptune_database_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Neptune Database Instance | `aws_neptune_database_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Organization Policy | `aws_organization_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Organization Tag Policy | `aws_organization_tag_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Private Certificate Authority | `aws_acm_pca_certificate_authority` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| Quicksight Custom Permissions | `aws_quicksight_custom_permissions` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Quicksight Dashboard | `aws_quicksight_dashboard` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Quicksight Data Set | `aws_quicksight_data_set` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| Quicksight Data Source | `aws_quicksight_data_source` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Quicksight Group | `aws_quicksight_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Quicksight User | `aws_quicksight_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Quicksight VPC Connection | `aws_quicksight_vpc_connection` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS Cluster | `aws_rds_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| RDS DB Cluster Parameter Group | `aws_rds_cluster_parameter_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Cluster Snapshots | `aws_db_cluster_snapshot` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Image](https://docs.jupiterone.io/data-model/schemas/Image), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| RDS DB Instance | `aws_db_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| RDS DB Option Group | `aws_db_option_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Parameter Group | `aws_db_parameter_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Proxy | `aws_db_proxy` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| RDS DB Proxy Target | `aws_db_proxy_target` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Proxy Target Group | `aws_db_proxy_target_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Snapshots | `aws_db_snapshot` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Image](https://docs.jupiterone.io/data-model/schemas/Image), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| RDS DB Subnet Group | `aws_db_subnet_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Redshift Cluster | `aws_redshift_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Redshift Cluster Parameter Group | `aws_redshift_cluster_parameter_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Redshift Datashare | `aws_redshift_datashare` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| Redshift Datashare Authorization | `aws_redshift_datashare_authorization` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Redshift Serverless Endpoint Access | `aws_redshift_serverless_endpoint_access` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| Redshift Serverless Namespace | `aws_redshift_serverless_namespace` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Redshift Serverless Recovery Point | `aws_redshift_serverless_recovery_point` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Redshift Serverless Snapshot | `aws_redshift_serverless_snapshot` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Redshift Serverless Usage Limit | `aws_redshift_serverless_usage_limit` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Redshift Serverless Workgroup | `aws_redshift_serverless_workgroup` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Resource Explorer Index | `aws_resource_explorer_index` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Resource Explorer View | `aws_resource_explorer_view` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Secret | `aws_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Secret Version | `aws_secret_version` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Security Hub Account | `aws_securityhub_account` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Security Hub Finding | `aws_securityhub_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Security Hub Finding | `aws_securityhub_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| SQS Queue | `aws_sqs_queue` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| X-Ray Encryption Config | `aws_xray_encryption_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| X-Ray Group | `aws_xray_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| X-Ray Resource Policy | `aws_xray_resource_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `aws_accessanalyzer` | **HAS** | `aws_accessanalyzer_analyzer` |
| `aws_accessanalyzer_analyzer` | **IDENTIFIED** | `aws_accessanalyzer_finding` |
| `aws_accessanalyzer_finding` | **IDENTIFIED** | `aws_resource` |
| `aws_account` | **HAS** | `aws_accessanalyzer` |
| `aws_account` | **HAS** | `aws_acm` |
| `aws_account` | **HAS** | `aws_acm_pca` |
| `aws_account` | **HAS** | `aws_autoscalingplans` |
| `aws_account` | **HAS** | `aws_ec2_vpc` |
| `aws_account` | **HAS** | `aws_apigateway` |
| `aws_account` | **HAS** | `aws_appconfig` |
| `aws_account` | **HAS** | `aws_athena` |
| `aws_account` | **HAS** | `aws_auditmanager` |
| `aws_account` | **HAS** | `aws_autoscaling` |
| `aws_account` | **HAS** | `aws_backup` |
| `aws_account` | **HAS** | `aws_batch` |
| `aws_account` | **HAS** | `aws_bedrock` |
| `aws_account` | **HAS** | `aws_cloudformation` |
| `aws_account` | **HAS** | `aws_cloudfront` |
| `aws_account` | **HAS** | `aws_cloudhsm` |
| `aws_account` | **HAS** | `aws_cloudtrail` |
| `aws_account` | **HAS** | `aws_cloudmap` |
| `aws_account` | **HAS** | `aws_cloudwatch_events` |
| `aws_account` | **HAS** | `aws_cloudwatch_logs` |
| `aws_account` | **HAS** | `aws_cloudwatch` |
| `aws_account` | **HAS** | `aws_cognito_idp` |
| `aws_account` | **HAS** | `aws_cognito_identity` |
| `aws_account` | **HAS** | `aws_codeartifact` |
| `aws_account` | **HAS** | `aws_codebuild` |
| `aws_account` | **HAS** | `aws_codedeploy` |
| `aws_account` | **HAS** | `aws_codeguru` |
| `aws_account` | **HAS** | `aws_codecommit` |
| `aws_account` | **HAS** | `aws_codepipeline` |
| `aws_account` | **HAS** | `aws_config` |
| `aws_account` | **HAS** | `aws_datasync` |
| `aws_account` | **HAS** | `aws_detective` |
| `aws_account` | **HAS** | `aws_devops_guru` |
| `aws_account` | **HAS** | `aws_directconnect` |
| `aws_account` | **HAS** | `aws_dms` |
| `aws_account` | **HAS** | `aws_ds` |
| `aws_account` | **HAS** | `aws_dynamodb` |
| `aws_account` | **HAS** | `aws_dax` |
| `aws_account` | **HAS** | `aws_ec2` |
| `aws_account` | **HAS** | `aws_ecr` |
| `aws_account` | **HAS** | `aws_ecs` |
| `aws_account` | **HAS** | `aws_efs` |
| `aws_account` | **HAS** | `aws_eks` |
| `aws_account` | **HAS** | `aws_elasticache` |
| `aws_account` | **HAS** | `aws_elasticloadbalancing` |
| `aws_account` | **HAS** | `aws_elasticmapreduce` |
| `aws_account` | **HAS** | `aws_emr_serverless` |
| `aws_account` | **HAS** | `aws_es` |
| `aws_account` | **HAS** | `aws_firehose` |
| `aws_account` | **HAS** | `aws_fms` |
| `aws_account` | **HAS** | `aws_glacier` |
| `aws_account` | **HAS** | `aws_global_accelerator` |
| `aws_account` | **HAS** | `aws_glue` |
| `aws_account` | **HAS** | `aws_grafana` |
| `aws_account` | **HAS** | `aws_guardduty` |
| `aws_account` | **HAS** | `aws_health` |
| `aws_account` | **HAS** | `aws_iam` |
| `aws_account` | **HAS** | `aws_iam_roles_anywhere` |
| `aws_account` | **HAS** | `aws_imagebuilder` |
| `aws_account` | **HAS** | `aws_inspector` |
| `aws_account` | **HAS** | `aws_inspectorv2` |
| `aws_account` | **HAS** | `aws_kinesis` |
| `aws_account` | **HAS** | `aws_kms` |
| `aws_account` | **HAS** | `aws_lambda` |
| `aws_account` | **HAS** | `aws_license_manager` |
| `aws_account` | **HAS** | `aws_lexv2` |
| `aws_account` | **HAS** | `aws_macie` |
| `aws_account` | **HAS** | `aws_marketplace` |
| `aws_account` | **OWNS** | `aws_marketplace_entity` |
| `aws_account` | **HAS** | `aws_mwaa` |
| `aws_account` | **HAS** | `aws_mq` |
| `aws_account` | **HAS** | `aws_msk` |
| `aws_account` | **HAS** | `aws_neptune` |
| `aws_account` | **HAS** | `aws_networkfirewall` |
| `aws_account` | **HAS** | `aws_networkmanager` |
| `aws_account` | **HAS** | `aws_prometheus` |
| `aws_account` | **HAS** | `aws_quicksight` |
| `aws_account` | **HAS** | `aws_resource_explorer` |
| `aws_account` | **HAS** | `aws_ram_service` |
| `aws_account` | **HAS** | `aws_rds` |
| `aws_account` | **HAS** | `aws_db_instance` |
| `aws_account` | **HAS** | `aws_redshift_serverless` |
| `aws_account` | **HAS** | `aws_redshift` |
| `aws_account` | **HAS** | `aws_route53` |
| `aws_account` | **HAS** | `aws_s3` |
| `aws_account` | **HAS** | `aws_sagemaker` |
| `aws_account` | **HAS** | `aws_secretsmanager` |
| `aws_account` | **HAS** | `aws_securityhub` |
| `aws_account` | **HAS** | `aws_servicecatalog` |
| `aws_account` | **HAS** | `aws_ses` |
| `aws_account` | **HAS** | `aws_shield` |
| `aws_account` | **HAS** | `aws_signer` |
| `aws_account` | **HAS** | `aws_sns` |
| `aws_account` | **HAS** | `aws_sqs` |
| `aws_account` | **HAS** | `aws_states` |
| `aws_account` | **HAS** | `aws_ssm` |
| `aws_account` | **HAS** | `aws_sso` |
| `aws_account` | **OWNS** | `aws_sso_instance` |
| `aws_account` | **HAS** | `aws_transfer` |
| `aws_account` | **HAS** | `aws_waf` |
| `aws_account` | **HAS** | `aws_wafv2` |
| `aws_account` | **HAS** | `aws_workspaces` |
| `aws_account` | **HAS** | `aws_vpc_lattice` |
| `aws_account` | **HAS** | `aws_fsx` |
| `aws_account` | **HAS** | `aws_opensearch` |
| `aws_account` | **HAS** | `aws_storage_gateway` |
| `aws_account` | **HAS** | `aws_xray` |
| `aws_acm` | **HAS** | `aws_acm_certificate` |
| `aws_acm_certificate` | **PROTECTS** | `aws_cognito_user_pool` |
| `aws_acm_pca` | **HAS** | `aws_acm_pca_certificate_authority` |
| `aws_alb` | **USES** | `aws_eni` |
| `aws_alb` | **HAS** | `aws_security_group` |
| `aws_alb` | **HAS** | `aws_lb_listener` |
| `aws_alb` | **CONNECTS** | `aws_lb_target_group` |
| `aws_ami` | **CONTAINS** | `aws_ebs_snapshot` |
| `aws_api_gateway_domain_name` | **HAS** | `aws_acm_certificate` |
| `aws_api_gateway_resource` | **HAS** | `aws_api_gateway_method` |
| `aws_api_gateway_rest_api` | **TRIGGERS** | `aws_lambda_function` |
| `aws_api_gateway_rest_api` | **HAS** | `aws_api_gateway_resource` |
| `aws_api_gateway_rest_api` | **HAS** | `aws_api_gateway_stage` |
| `aws_api_gateway_rest_api` | **USES** | `aws_api_gateway_domain_name` |
| `aws_api_gateway_stage` | **DEFINES** | `aws_api_gateway_stage_method_setting` |
| `aws_api_gateway_stage` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_api_gateway_v2_api` | **HAS** | `aws_api_gateway_v2_route` |
| `aws_api_gateway_v2_api` | **HAS** | `aws_api_gateway_v2_stage` |
| `aws_api_gateway_v2_api` | **USES** | `aws_api_gateway_domain_name` |
| `aws_api_gateway_v2_authorizer` | **CONNECTS** | `aws_lambda_function` |
| `aws_api_gateway_v2_integration` | **CONNECTS** | `aws_lambda_function` |
| `aws_api_gateway_v2_route` | **HAS** | `aws_api_gateway_v2_authorizer` |
| `aws_api_gateway_v2_route` | **HAS** | `aws_api_gateway_v2_integration` |
| `aws_api_gateway_v2_stage` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_apigateway` | **HAS** | `aws_api_gateway_rest_api` |
| `aws_apigateway` | **HAS** | `aws_api_gateway_domain_name` |
| `aws_apigateway` | **HAS** | `aws_api_gateway_v2_api` |
| `aws_appconfig` | **HAS** | `aws_appconfig_account_settings` |
| `aws_appconfig` | **HAS** | `aws_appconfig_application` |
| `aws_appconfig` | **HAS** | `aws_appconfig_deployment_strategy` |
| `aws_appconfig` | **CONNECTS** | `aws_vpc_endpoint` |
| `aws_appconfig_application` | **HAS** | `aws_appconfig_environment` |
| `aws_appconfig_application` | **HAS** | `aws_appconfig_configuration_profile` |
| `aws_appconfig_application` | **HAS** | `aws_appconfig_deployment` |
| `aws_appconfig_configuration_profile` | **HAS** | `aws_appconfig_hosted_configuration_version` |
| `aws_appconfig_configuration_profile` | **USES** | `aws_kms_key` |
| `aws_appconfig_configuration_profile` | **USES** | `aws_iam_role` |
| `aws_appconfig_deployment` | **USES** | `aws_kms_key` |
| `aws_appconfig_environment` | **USES** | `aws_cloudwatch_metric_alarm` |
| `aws_appconfig_environment` | **USES** | `aws_iam_role` |
| `aws_appconfig_hosted_configuration_version` | **USES** | `aws_kms_key` |
| `aws_athena` | **HAS** | `aws_athena_work_group` |
| `aws_athena_work_group` | **USES** | `aws_iam_role` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_framework` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_assessment` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_control` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_setting` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_delegation` |
| `aws_auditmanager_assessment` | **USES** | `aws_auditmanager_framework` |
| `aws_auditmanager_assessment` | **HAS** | `aws_auditmanager_evidence_folder` |
| `aws_auditmanager_delegation` | **ASSIGNED** | `aws_iam_role` |
| `aws_auditmanager_delegation` | **HAS** | `aws_auditmanager_assessment` |
| `aws_auditmanager_framework` | **HAS** | `aws_auditmanager_control` |
| `aws_auditmanager_setting` | **USES** | `aws_kms_key` |
| `aws_auditmanager_setting` | **USES** | `aws_sns_topic` |
| `aws_auditmanager_setting` | **ASSIGNED** | `aws_iam_role` |
| `aws_auditmanager_setting` | **USES** | `aws_s3_bucket` |
| `aws_autoscaling` | **HAS** | `aws_autoscaling_group` |
| `aws_autoscaling` | **HAS** | `aws_autoscaling_launch_configuration` |
| `aws_autoscaling_group` | **USES** | `aws_autoscaling_launch_configuration` |
| `aws_autoscaling_group` | **USES** | `aws_launch_template` |
| `aws_autoscaling_group` | **HAS** | `aws_instance` |
| `aws_autoscaling_group` | **USES** | `aws_autoscaling_policy` |
| `aws_autoscaling_launch_configuration` | **USES** | `aws_ami` |
| `aws_backup` | **HAS** | `aws_backup_vault` |
| `aws_backup` | **HAS** | `aws_backup_plan` |
| `aws_backup` | **HAS** | `aws_backup_restore_testing_plan` |
| `aws_backup_copy_job` | **CREATED** | `aws_backup_recovery_point` |
| `aws_backup_copy_job` | **USES** | `aws_backup_recovery_point` |
| `aws_backup_plan` | **HAS** | `aws_backup_job` |
| `aws_backup_plan` | **HAS** | `aws_backup_copy_job` |
| `aws_backup_recovery_point` | **PROTECTS** | `aws_resource` |
| `aws_backup_restore_job` | **HAS** | `aws_instance` |
| `aws_backup_restore_job` | **HAS** | `aws_db_instance` |
| `aws_backup_restore_testing_plan` | **HAS** | `aws_backup_restore_job` |
| `aws_backup_vault` | **HAS** | `aws_backup_recovery_point` |
| `aws_batch` | **HAS** | `aws_batch_job_definition` |
| `aws_batch` | **HAS** | `aws_batch_job_queue` |
| `aws_batch_compute_environment` | **USES** | `aws_iam_role` |
| `aws_batch_compute_environment` | **USES** | `aws_ecs_cluster` |
| `aws_batch_compute_environment` | **HAS** | `aws_security_group` |
| `aws_batch_job_queue` | **HAS** | `aws_batch_job` |
| `aws_bedrock` | **HAS** | `aws_bedrock_evaluation_job` |
| `aws_bedrock` | **HAS** | `aws_bedrock_model_customization_job` |
| `aws_bedrock` | **HAS** | `aws_bedrock_code_interpreter` |
| `aws_bedrock` | **HAS** | `aws_bedrock_foundation_model` |
| `aws_bedrock` | **HAS** | `aws_bedrock_guardrail` |
| `aws_bedrock` | **HAS** | `aws_bedrock_model_invocation_logging` |
| `aws_bedrock` | **HAS** | `aws_bedrock_agent` |
| `aws_bedrock` | **HAS** | `aws_bedrock_knowledge_base` |
| `aws_bedrock` | **HAS** | `aws_bedrock_custom_model` |
| `aws_bedrock` | **HAS** | `aws_bedrock_provisioned_throughput` |
| `aws_bedrock` | **HAS** | `aws_bedrock_flow` |
| `aws_bedrock` | **HAS** | `aws_bedrock_inference_profile` |
| `aws_bedrock` | **HAS** | `aws_bedrock_agent_runtime` |
| `aws_bedrock` | **HAS** | `aws_bedrock_api_key` |
| `aws_bedrock_agent` | **HAS** | `aws_bedrock_agent_action_group` |
| `aws_bedrock_agent` | **USES** | `aws_iam_role` |
| `aws_bedrock_agent` | **USES** | `aws_kms_key` |
| `aws_bedrock_agent` | **USES** | `aws_bedrock_foundation_model` |
| `aws_bedrock_agent_action_group` | **USES** | `aws_lambda_function` |
| `aws_bedrock_agent_runtime` | **USES** | `aws_iam_role` |
| `aws_bedrock_agent_runtime` | **USES** | `aws_security_group` |
| `aws_bedrock_agent_runtime` | **USES** | `aws_subnet` |
| `aws_bedrock_code_interpreter` | **USES** | `aws_iam_role` |
| `aws_bedrock_code_interpreter` | **USES** | `aws_security_group` |
| `aws_bedrock_code_interpreter` | **USES** | `aws_subnet` |
| `aws_bedrock_custom_model` | **USES** | `aws_bedrock_foundation_model` |
| `aws_bedrock_custom_model` | **USES** | `aws_s3_bucket` |
| `aws_bedrock_custom_model` | **USES** | `aws_kms_key` |
| `aws_bedrock_evaluation_job` | **SENDS** | `aws_s3_bucket` |
| `aws_bedrock_flow` | **USES** | `aws_iam_role` |
| `aws_bedrock_flow` | **USES** | `aws_kms_key` |
| `aws_bedrock_guardrail` | **USES** | `aws_kms_key` |
| `aws_bedrock_guardrail` | **PROTECTS** | `aws_bedrock_agent` |
| `aws_bedrock_knowledge_base` | **HAS** | `aws_bedrock_knowledge_base_data_source` |
| `aws_bedrock_knowledge_base` | **USES** | `aws_iam_role` |
| `aws_bedrock_knowledge_base` | **USES** | `aws_bedrock_foundation_model` |
| `aws_bedrock_knowledge_base` | **USES** | `aws_opensearch_domain` |
| `aws_bedrock_knowledge_base_data_source` | **USES** | `aws_s3_bucket` |
| `aws_bedrock_model_customization_job` | **USES** | `aws_s3_bucket` |
| `aws_bedrock_model_customization_job` | **SENDS** | `aws_s3_bucket` |
| `aws_bedrock_model_invocation_logging` | **SENDS** | `aws_s3_bucket` |
| `aws_bedrock_model_invocation_logging` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_bedrock_provisioned_throughput` | **USES** | `aws_bedrock_foundation_model` |
| `aws_bedrock_provisioned_throughput` | **USES** | `aws_bedrock_custom_model` |
| `aws_cloudformation` | **HAS** | `aws_cloudformation_stack` |
| `aws_cloudfront` | **HAS** | `aws_cloudfront_distribution` |
| `aws_cloudfront` | **HAS** | `aws_cloudfront_key_group` |
| `aws_cloudfront` | **HAS** | `aws_cloudfront_public_key` |
| `aws_cloudfront_distribution` | **HAS** | `aws_cloudfront_distribution_origin` |
| `aws_cloudfront_distribution` | **TRIGGERS** | `aws_lambda_function` |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_api_gateway_rest_api` |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_elb` |
| `aws_cloudfront_key_group` | **HAS** | `aws_cloudfront_public_key` |
| `aws_cloudhsm` | **HAS** | `aws_cloudhsm_cluster` |
| `aws_cloudhsm_cluster` | **HAS** | `aws_cloudhsm_instance` |
| `aws_cloudhsm_cluster` | **HAS** | `aws_security_group` |
| `aws_cloudhsm_cluster` | **HAS** | `aws_cloudhsm_backup` |
| `aws_cloudhsm_instance` | **HAS** | `aws_security_group` |
| `aws_cloudmap` | **HAS** | `aws_cloudmap_namespace` |
| `aws_cloudmap_namespace` | **HAS** | `aws_cloudmap_service` |
| `aws_cloudmap_service` | **HAS** | `aws_cloudmap_service_instance` |
| `aws_cloudtrail` | **HAS** | `aws_cloudtrail_trail` |
| `aws_cloudtrail` | **LOGS** | `aws_resource_explorer` |
| `aws_cloudwatch` | **HAS** | `aws_cloudwatch_metric_alarm` |
| `aws_cloudwatch_events` | **HAS** | `aws_cloudwatch_event_rule` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_event_bus` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_archive` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_connection` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_api_destination` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_endpoint` |
| `aws_cloudwatch_log_group` | **USES** | `aws_kms_key` |
| `aws_cloudwatch_log_group` | **HAS** | `aws_cloudwatch_log_metric_filter` |
| `aws_cloudwatch_log_group` | **HAS** | `aws_cloudwatch_log_group_metrics` |
| `aws_cloudwatch_logs` | **HAS** | `aws_cloudwatch_log_group` |
| `aws_cloudwatch_logs` | **HAS** | `aws_cloudwatch_log_destination` |
| `aws_cloudwatch_logs` | **HAS** | `aws_cloudwatch_log_subscription_filter` |
| `aws_cloudwatch_logs` | **HAS** | `aws_cloudwatch_log_metric_filter` |
| `aws_cloudwatch_metric_alarm` | **TRIGGERS** | `aws_resource` |
| `aws_codeartifact` | **HAS** | `aws_codeartifact_domain` |
| `aws_codeartifact` | **USES** | `aws_vpc_endpoint` |
| `aws_codeartifact_domain` | **HAS** | `aws_codeartifact_repository` |
| `aws_codeartifact_domain` | **HAS** | `aws_codeartifact_package_group` |
| `aws_codeartifact_domain` | **USES** | `aws_kms_key` |
| `aws_codeartifact_package_group` | **HAS** | `aws_codeartifact_package_group` |
| `aws_codeartifact_repository` | **CONTAINS** | `aws_codeartifact_package` |
| `aws_codebuild` | **HAS** | `aws_codebuild_project` |
| `aws_codebuild` | **HAS** | `aws_codebuild_report_group` |
| `aws_codecommit` | **HAS** | `aws_codecommit_repository` |
| `aws_codedeploy` | **HAS** | `aws_codedeploy_application` |
| `aws_codedeploy` | **HAS** | `aws_codedeploy_deployment_config` |
| `aws_codedeploy_application` | **HAS** | `aws_codedeploy_deployment_group` |
| `aws_codedeploy_deployment_group` | **USES** | `aws_codedeploy_deployment_config` |
| `aws_codedeploy_deployment_group` | **USES** | `aws_iam_role` |
| `aws_codeguru` | **HAS** | `aws_codeguru_profiling_group` |
| `aws_codeguru` | **HAS** | `aws_codeguru_reviewer_repository_association` |
| `aws_codeguru_reviewer_repository_association` | **USES** | `aws_kms_key` |
| `aws_codepipeline` | **HAS** | `aws_codepipeline_pipeline` |
| `aws_cognito_identity` | **HAS** | `aws_cognito_identity_pool` |
| `aws_cognito_idp` | **HAS** | `aws_cognito_user_pool` |
| `aws_cognito_user_pool` | **HAS** | `aws_cognito_user_pool_client` |
| `aws_cognito_user_pool` | **HAS** | `aws_cognito_user_pool_user` |
| `aws_config` | **HAS** | `aws_config_rule` |
| `aws_config_rule` | **EVALUATES** | `aws_resource` |
| `aws_config_rule` | **IDENTIFIED** | `aws_config_rule_finding` |
| `aws_datasync` | **HAS** | `aws_datasync_task` |
| `aws_datasync` | **HAS** | `aws_datasync_location` |
| `aws_datasync_location` | **CONNECTS** | `aws_s3_bucket` |
| `aws_datasync_location` | **CONNECTS** | `aws_efs_file_system` |
| `aws_datasync_location` | **CONNECTS** | `aws_fsx_file_system` |
| `aws_datasync_task` | **USES** | `aws_datasync_location` |
| `aws_datasync_task` | **USES** | `aws_cloudwatch_log_group` |
| `aws_dax` | **HAS** | `aws_dax_cluster` |
| `aws_db_cluster_snapshot` | **USES** | `aws_kms_key` |
| `aws_db_instance` | **USES** | `aws_db_parameter_group` |
| `aws_db_instance` | **HAS** | `aws_security_group` |
| `aws_db_instance` | **USES** | `aws_kms_key` |
| `aws_db_instance` | **USES** | `aws_secret` |
| `aws_db_instance` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_db_instance` | **HAS** | `aws_db_snapshot` |
| `aws_db_instance` | **USES** | `aws_db_option_group` |
| `aws_db_instance` | **USES** | `aws_db_subnet_group` |
| `aws_db_proxy` | **USES** | `aws_subnet` |
| `aws_db_proxy` | **USES** | `aws_secret` |
| `aws_db_proxy` | **USES** | `aws_iam_role` |
| `aws_db_proxy` | **USES** | `aws_security_group` |
| `aws_db_proxy` | **HAS** | `aws_db_proxy_target_group` |
| `aws_db_proxy_target` | **CONNECTS** | `aws_db_instance` |
| `aws_db_proxy_target` | **CONNECTS** | `aws_rds_cluster` |
| `aws_db_proxy_target_group` | **HAS** | `aws_db_proxy_target` |
| `aws_db_snapshot` | **USES** | `aws_kms_key` |
| `aws_db_subnet_group` | **USES** | `aws_subnet` |
| `aws_detective` | **HAS** | `aws_detective_graph` |
| `aws_detective_graph` | **IDENTIFIED** | `aws_detective_investigation` |
| `aws_devops_guru` | **HAS** | `aws_devops_guru_notification_channel` |
| `aws_devops_guru` | **IDENTIFIED** | `aws_devops_guru_insight` |
| `aws_devops_guru_insight` | **HAS** | `aws_devops_guru_anomaly` |
| `aws_devops_guru_notification_channel` | **USES** | `aws_sns_topic` |
| `aws_directconnect` | **HAS** | `aws_directconnect_connection` |
| `aws_directconnect` | **HAS** | `aws_directconnect_virtual_interface` |
| `aws_directconnect` | **HAS** | `aws_directconnect_lag` |
| `aws_directconnect` | **HAS** | `aws_directconnect_gateway` |
| `aws_directconnect_lag` | **HAS** | `aws_direct_connect_virtual_interface` |
| `aws_directconnect_lag` | **USES** | `aws_direct_connect_connection` |
| `aws_directconnect_virtual_interface` | **HAS** | `aws_directconnect_bgp_peer` |
| `aws_directconnect_virtual_interface` | **USES** | `aws_directconnect_lag` |
| `aws_directconnect_virtual_interface` | **USES** | `aws_direct_connect_gateway` |
| `aws_dms` | **HAS** | `aws_dms_instance` |
| `aws_dms` | **HAS** | `aws_dms_endpoint` |
| `aws_ds` | **HAS** | `aws_ds_directory` |
| `aws_dynamodb` | **HAS** | `aws_dynamodb_table` |
| `aws_dynamodb` | **HAS** | `aws_dynamodb_global_table` |
| `aws_dynamodb_global_table` | **IS** | `aws_dynamodb_table` |
| `aws_dynamodb_table` | **USES** | `aws_kms_key` |
| `aws_ebs_snapshot` | **USES** | `aws_kms_key` |
| `aws_ebs_volume` | **USES** | `aws_ebs_snapshot` |
| `aws_ebs_volume` | **HAS** | `aws_ebs_snapshot` |
| `aws_ebs_volume` | **USES** | `aws_kms_key` |
| `aws_ec2` | **HAS** | `aws_ec2_settings` |
| `aws_ec2` | **USES** | `aws_kms_key` |
| `aws_ec2` | **HAS** | `aws_instance` |
| `aws_ec2` | **HAS** | `aws_internet_gateway` |
| `aws_ec2` | **HAS** | `aws_key_pair` |
| `aws_ec2` | **HAS** | `aws_launch_template` |
| `aws_ec2` | **HAS** | `aws_network_acl` |
| `aws_ec2` | **HAS** | `aws_prefix_list` |
| `aws_ec2` | **HAS** | `aws_security_group` |
| `aws_ec2` | **HAS** | `aws_subnet` |
| `aws_ec2` | **HAS** | `aws_ec2_transit_gateway` |
| `aws_ec2` | **HAS** | `aws_ebs_volume` |
| `aws_ec2` | **HAS** | `aws_vpc` |
| `aws_ec2` | **HAS** | `aws_vpc_endpoint_service` |
| `aws_ec2` | **HAS** | `aws_dedicated_host` |
| `aws_ec2_transit_gateway` | **HAS** | `aws_ec2_transit_gateway_vpc_attachment` |
| `aws_ec2_transit_gateway` | **HAS** | `aws_ec2_transit_gateway_route_table` |
| `aws_ec2_transit_gateway` | **HAS** | `aws_ec2_transit_gateway_attachment` |
| `aws_ec2_transit_gateway` | **CONNECTS** | `aws_vpn_connection` |
| `aws_ec2_transit_gateway_vpc_attachment` | **USES** | `aws_vpc` |
| `aws_ecr` | **HAS** | `aws_ecr_repository` |
| `aws_ecr_image` | **HAS** | `aws_ecr_image_scan_finding` |
| `aws_ecr_repository` | **HAS** | `aws_ecr_image` |
| `aws_ecs` | **HAS** | `aws_ecs_cluster` |
| `aws_ecs` | **HAS** | `aws_ecs_task_definition` |
| `aws_ecs_cluster` | **HAS** | `aws_ecs_service` |
| `aws_ecs_cluster` | **HAS** | `aws_ecs_container_instance` |
| `aws_ecs_cluster` | **RUNS** | `aws_ecs_task` |
| `aws_ecs_container_instance` | **RUNS** | `aws_ecs_task` |
| `aws_ecs_service` | **USES** | `aws_subnet` |
| `aws_ecs_service` | **HAS** | `aws_security_group` |
| `aws_ecs_task_container_definition` | **USES** | `aws_secret` |
| `aws_ecs_task_definition` | **DEFINES** | `aws_ecs_service` |
| `aws_ecs_task_definition` | **DEFINES** | `aws_ecs_task` |
| `aws_ecs_task_definition` | **USES** | `aws_iam_role` |
| `aws_ecs_task_definition` | **HAS** | `aws_ecs_task_container_definition` |
| `aws_efs` | **HAS** | `aws_efs_file_system` |
| `aws_efs_file_system` | **USES** | `aws_kms_key` |
| `aws_efs_file_system` | **HAS** | `aws_efs_mount_target` |
| `aws_efs_mount_target` | **USES** | `aws_eni` |
| `aws_efs_mount_target` | **HAS** | `aws_security_group` |
| `aws_eks` | **HAS** | `aws_eks_cluster` |
| `aws_eks_cluster` | **HAS** | `aws_eks_node_group` |
| `aws_eks_cluster` | **HAS** | `aws_security_group` |
| `aws_eks_cluster` | **USES** | `aws_kms_key` |
| `aws_eks_cluster` | **TRUSTS** | `aws_iam_oidc_provider` |
| `aws_eks_node_group` | **HAS** | `aws_instance` |
| `aws_eks_node_group` | **USES** | `aws_iam_role` |
| `aws_elasticache` | **HAS** | `aws_elasticache_memcached_cluster` |
| `aws_elasticache` | **HAS** | `aws_elasticache_redis_cluster` |
| `aws_elasticache_cluster_node` | **USES** | `aws_eni` |
| `aws_elasticache_cluster_node` | **HAS** | `aws_security_group` |
| `aws_elasticache_memcached_cluster` | **USES** | `aws_eni` |
| `aws_elasticache_memcached_cluster` | **HAS** | `aws_security_group` |
| `aws_elasticache_memcached_cluster` | **HAS** | `aws_elasticache_snapshot` |
| `aws_elasticache_redis_cluster` | **HAS** | `aws_elasticache_cluster_node` |
| `aws_elasticache_redis_cluster` | **USES** | `aws_kms_key` |
| `aws_elasticache_snapshot` | **USES** | `aws_kms_key` |
| `aws_elasticloadbalancing` | **HAS** | `aws_alb` |
| `aws_elasticloadbalancing` | **HAS** | `aws_elb` |
| `aws_elasticloadbalancing` | **HAS** | `aws_nlb` |
| `aws_elasticmapreduce` | **HAS** | `aws_elasticmapreduce_cluster` |
| `aws_elasticmapreduce` | **HAS** | `aws_emr_security_configuration` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_kms_key` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_iam_role` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_iam_instance_profile` |
| `aws_elasticmapreduce_cluster` | **HAS** | `aws_instance` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_emr_security_configuration` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_vpc_endpoint` |
| `aws_elasticsearch_domain` | **USES** | `aws_eni` |
| `aws_elasticsearch_domain` | **HAS** | `aws_security_group` |
| `aws_elb` | **USES** | `aws_eni` |
| `aws_elb` | **CONNECTS** | `aws_instance` |
| `aws_elb` | **HAS** | `aws_security_group` |
| `aws_elb` | **HAS** | `aws_lb_listener` |
| `aws_elb` | **CONNECTS** | `aws_lb_target_group` |
| `aws_emr_serverless` | **HAS** | `aws_emr_serverless_application` |
| `aws_emr_serverless_application` | **USES** | `aws_kms_key` |
| `aws_eni` | **USES** | `aws_eip` |
| `aws_eni` | **HAS** | `aws_security_group` |
| `aws_es` | **HAS** | `aws_elasticsearch_domain` |
| `aws_eventbridge_api_destination` | **USES** | `aws_eventbridge_connection` |
| `aws_eventbridge_endpoint` | **USES** | `aws_eventbridge_event_bus` |
| `aws_eventbridge_event_bus` | **USES** | `aws_kms_key` |
| `aws_eventbridge_event_bus` | **HAS** | `aws_eventbridge_archive` |
| `aws_firehose` | **HAS** | `aws_firehose_delivery_stream` |
| `aws_firehose_delivery_stream` | **USES** | `aws_kms_key` |
| `aws_firehose_delivery_stream` | **USES** | `aws_kinesis_stream` |
| `aws_firehose_delivery_stream` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_firehose_delivery_stream` | **USES** | `aws_vpc_endpoint` |
| `aws_firehose_delivery_stream` | **CONNECTS** | `aws_vpc_endpoint_service` |
| `aws_firehose_delivery_stream` | **USES** | `aws_vpc` |
| `aws_firehose_delivery_stream` | **USES** | `aws_subnet` |
| `aws_firehose_delivery_stream` | **USES** | `aws_security_group` |
| `aws_firewall` | **HAS** | `aws_firewall_policy` |
| `aws_firewall` | **PROTECTS** | `aws_vpc` |
| `aws_firewall_policy` | **HAS** | `aws_firewall_rule_group` |
| `aws_firewall_rule_group` | **USES** | `aws_prefix_list` |
| `aws_fms` | **HAS** | `aws_fms_policy` |
| `aws_fms` | **HAS** | `aws_fms_resource_set` |
| `aws_fms` | **HAS** | `aws_fms_application_list` |
| `aws_fms` | **HAS** | `aws_fms_protocols_list` |
| `aws_fms_resource_set` | **HAS** | `aws_resource` |
| `aws_fsx` | **HAS** | `aws_fsx_file_system` |
| `aws_glacier` | **HAS** | `aws_glacier_vault` |
| `aws_global_accelerator` | **HAS** | `aws_global_accelerator_accelerator` |
| `aws_global_accelerator_accelerator` | **HAS** | `aws_global_accelerator_listener` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_alb` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_elb` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_nlb` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_eip` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_instance` |
| `aws_global_accelerator_listener` | **HAS** | `aws_global_accelerator_endpoint_group` |
| `aws_glue` | **HAS** | `aws_glue_job` |
| `aws_glue` | **HAS** | `aws_glue_catalog_database` |
| `aws_glue` | **HAS** | `aws_glue_data_catalog_encryption_settings` |
| `aws_glue` | **HAS** | `aws_glue_security_configuration` |
| `aws_glue` | **HAS** | `aws_glue_connection` |
| `aws_glue` | **HAS** | `aws_glue_session` |
| `aws_glue_connection` | **USES** | `aws_subnet` |
| `aws_glue_data_catalog_encryption_settings` | **USES** | `aws_kms_key` |
| `aws_glue_job` | **USES** | `aws_glue_connection` |
| `aws_glue_security_configuration` | **USES** | `aws_kms_key` |
| `aws_grafana` | **HAS** | `aws_grafana_workspace` |
| `aws_grafana_workspace` | **USES** | `aws_iam_role` |
| `aws_guardduty` | **HAS** | `aws_guardduty_detector` |
| `aws_guardduty_detector` | **IDENTIFIED** | `aws_guardduty_finding` |
| `aws_guardduty_detector` | **HAS** | `aws_guardduty_publishing_destination` |
| `aws_guardduty_publishing_destination` | **USES** | `aws_s3_bucket` |
| `aws_guardduty_publishing_destination` | **USES** | `aws_kms_key` |
| `aws_health` | **HAS** | `aws_health_event` |
| `aws_iam` | **HAS** | `aws_organization_policy` |
| `aws_iam` | **HAS** | `aws_organization_tag_policy` |
| `aws_iam` | **HAS** | `aws_iam_account_password_policy` |
| `aws_iam` | **HAS** | `aws_iam_group` |
| `aws_iam` | **HAS** | `aws_iam_group_policy` |
| `aws_iam` | **HAS** | `aws_iam_policy` |
| `aws_iam` | **HAS** | `aws_iam_role` |
| `aws_iam` | **HAS** | `aws_iam_role_policy` |
| `aws_iam` | **HAS** | `aws_iam_oidc_provider` |
| `aws_iam` | **HAS** | `aws_iam_saml_provider` |
| `aws_iam` | **HAS** | `aws_iam_user` |
| `aws_iam` | **HAS** | `aws_iam_access_key` |
| `aws_iam` | **HAS** | `aws_iam_user_policy` |
| `aws_iam` | **HAS** | `aws_iam_server_certificate` |
| `aws_iam` | **HAS** | `aws_iam_instance_profile` |
| `aws_iam_group` | **ASSIGNED** | `aws_iam_group_policy` |
| `aws_iam_group` | **HAS** | `aws_iam_user` |
| `aws_iam_group` | **ASSIGNED** | `aws_iam_policy` |
| `aws_iam_group_policy` | **ALLOWS** | `aws_resource` |
| `aws_iam_group_policy` | **DENIES** | `aws_resource` |
| `aws_iam_instance_profile` | **USES** | `aws_role` |
| `aws_iam_policy` | **ALLOWS** | `aws_resource` |
| `aws_iam_policy` | **DENIES** | `aws_resource` |
| `aws_iam_policy` | **RESTRICTS** | `aws_iam_role` |
| `aws_iam_policy` | **RESTRICTS** | `aws_iam_user` |
| `aws_iam_role` | **ASSIGNED** | `aws_batch_compute_environment` |
| `aws_iam_role` | **ASSIGNED** | `aws_datasync_location` |
| `aws_iam_role` | **ASSIGNED** | `aws_ecs_task_definition` |
| `aws_iam_role` | **ASSIGNED** | `aws_iam_policy` |
| `aws_iam_role` | **ASSIGNED** | `aws_iam_role_policy` |
| `aws_iam_role` | **ASSIGNED** | `aws_transfer_server` |
| `aws_iam_role` | **ASSIGNED** | `aws_transfer_user` |
| `aws_iam_role_policy` | **ALLOWS** | `aws_resource` |
| `aws_iam_role_policy` | **DENIES** | `aws_resource` |
| `aws_iam_roles_anywhere` | **HAS** | `aws_iam_roles_anywhere_trust_anchor` |
| `aws_iam_roles_anywhere` | **HAS** | `aws_iam_roles_anywhere_profile` |
| `aws_iam_roles_anywhere_profile` | **ALLOWS** | `aws_iam_role` |
| `aws_iam_roles_anywhere_profile` | **ASSIGNED** | `aws_iam_policy` |
| `aws_iam_roles_anywhere_trust_anchor` | **USES** | `aws_acm_pca_certificate_authority` |
| `aws_iam_user` | **HAS** | `aws_bedrock_api_key` |
| `aws_iam_user` | **ASSIGNED** | `aws_iam_policy` |
| `aws_iam_user` | **HAS** | `aws_iam_access_key` |
| `aws_iam_user` | **ASSIGNED** | `mfa_device` |
| `aws_iam_user` | **ASSIGNED** | `aws_iam_user_policy` |
| `aws_iam_user_policy` | **ALLOWS** | `aws_resource` |
| `aws_iam_user_policy` | **DENIES** | `aws_resource` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_component` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_image_pipeline` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_infrastructure_configuration` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_lifecycle_policy` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_container_recipe` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_distribution_configuration` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_workflow` |
| `aws_imagebuilder_image_pipeline` | **USES** | `aws_imagebuilder_infrastructure_configuration` |
| `aws_imagebuilder_image_pipeline` | **USES** | `aws_imagebuilder_distribution_configuration` |
| `aws_imagebuilder_image_pipeline` | **USES** | `aws_imagebuilder_container_recipe` |
| `aws_imagebuilder_image_pipeline` | **CREATED** | `aws_imagebuilder_image` |
| `aws_imagebuilder_image_pipeline` | **USES** | `aws_iam_role` |
| `aws_imagebuilder_lifecycle_policy` | **USES** | `aws_iam_role` |
| `aws_inspector` | **HAS** | `aws_inspector_assessment` |
| `aws_inspector_assessment` | **IDENTIFIED** | `aws_inspector_finding` |
| `aws_inspectorv2` | **SCANS** | `aws_instance` |
| `aws_inspectorv2` | **SCANS** | `aws_ecr_repository` |
| `aws_inspectorv2` | **SCANS** | `aws_ecr_image` |
| `aws_inspectorv2` | **IDENTIFIED** | `aws_inspectorv2_finding` |
| `aws_inspectorv2` | **HAS** | `aws_inspectorv2_filter` |
| `aws_inspectorv2` | **HAS** | `aws_inspectorv2_configuration` |
| `aws_inspectorv2` | **USES** | `aws_vpc_endpoint` |
| `aws_inspectorv2_configuration` | **USES** | `aws_kms_key` |
| `aws_instance` | **USES** | `aws_eip` |
| `aws_instance` | **USES** | `aws_key_pair` |
| `aws_instance` | **USES** | `aws_ami` |
| `aws_instance` | **HAS** | `aws_security_group` |
| `aws_instance` | **USES** | `aws_iam_instance_profile` |
| `aws_instance` | **USES** | `aws_eni` |
| `aws_instance` | **USES** | `aws_ebs_volume` |
| `aws_instance` | **USES** | `aws_dedicated_host` |
| `aws_instance` | **HAS** | `aws_instance_inventory` |
| `aws_instance` | **INSTALLED** | `aws_instance_application` |
| `aws_instance` | **LOGS** | `aws_instance_patch_state` |
| `aws_instance` | **HAS** | `aws_ssm_compliance_summary` |
| `aws_instance` | **HAS** | `aws_ssm_associations` |
| `aws_kinesis` | **HAS** | `aws_kinesis_stream` |
| `aws_kinesis_consumer` | **USES** | `aws_kinesis_stream` |
| `aws_kinesis_stream` | **USES** | `aws_kms_key` |
| `aws_kms` | **HAS** | `aws_kms_key` |
| `aws_lambda` | **HAS** | `aws_lambda_function` |
| `aws_lambda_function` | **HAS** | `aws_security_group` |
| `aws_lambda_function` | **ASSIGNED** | `aws_iam_role` |
| `aws_lambda_function` | **USES** | `aws_signer_signing_profile` |
| `aws_lambda_function` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_launch_template` | **HAS** | `aws_launch_template_version` |
| `aws_launch_template_version` | **USES** | `aws_ami` |
| `aws_lb_listener` | **HAS** | `aws_lb_listener_rule` |
| `aws_lb_listener` | **USES** | `aws_acm_certificate` |
| `aws_lb_listener` | **USES** | `aws_iam_server_certificate` |
| `aws_lb_target_group` | **HAS** | `aws_instance` |
| `aws_lb_target_group` | **HAS** | `aws_lambda_function` |
| `aws_lb_target_group` | **HAS** | `aws_eni` |
| `aws_lexv2` | **HAS** | `aws_lexv2_bot` |
| `aws_lexv2_bot` | **HAS** | `aws_lexv2_bot_alias` |
| `aws_license_manager` | **HAS** | `aws_license_manager_license` |
| `aws_license_manager` | **HAS** | `aws_license_manager_received_license` |
| `aws_marketplace` | **HAS** | `aws_marketplace_entity` |
| `aws_marketplace` | **HAS** | `aws_marketplace_entitlement` |
| `aws_marketplace_entitlement` | **ASSIGNED** | `aws_account` |
| `aws_marketplace_entitlement` | **USES** | `aws_license_manager_received_license` |
| `aws_mq` | **HAS** | `aws_mq_broker` |
| `aws_mq_broker` | **USES** | `aws_kms_key` |
| `aws_mq_broker` | **USES** | `aws_subnet` |
| `aws_mq_broker` | **USES** | `aws_security_group` |
| `aws_msk` | **HAS** | `aws_msk_cluster` |
| `aws_mwaa` | **HAS** | `aws_mwaa_environment` |
| `aws_nat_gateway` | **USES** | `aws_eni` |
| `aws_neptune` | **HAS** | `aws_neptune_database_cluster` |
| `aws_neptune` | **HAS** | `aws_neptune_database_instance` |
| `aws_neptune` | **HAS** | `aws_neptune_analytics_graph` |
| `aws_neptune_analytics_graph` | **USES** | `aws_kms_key` |
| `aws_neptune_analytics_graph` | **CONNECTS** | `aws_vpc_endpoint` |
| `aws_neptune_analytics_graph` | **HAS** | `aws_neptune_analytics_graph_snapshot` |
| `aws_neptune_analytics_graph` | **HAS** | `aws_neptune_analytics_graph_export_task` |
| `aws_neptune_analytics_graph` | **HAS** | `aws_neptune_analytics_graph_import_task` |
| `aws_neptune_analytics_graph_export_task` | **USES** | `aws_kms_key` |
| `aws_neptune_analytics_graph_export_task` | **USES** | `aws_iam_role` |
| `aws_neptune_analytics_graph_import_task` | **USES** | `aws_kms_key` |
| `aws_neptune_analytics_graph_import_task` | **USES** | `aws_iam_role` |
| `aws_neptune_analytics_graph_snapshot` | **USES** | `aws_kms_key` |
| `aws_neptune_database_cluster` | **HAS** | `aws_security_group` |
| `aws_neptune_database_cluster` | **USES** | `aws_kms_key` |
| `aws_neptune_database_cluster` | **USES** | `aws_iam_role` |
| `aws_neptune_database_cluster` | **CONTAINS** | `aws_neptune_database_instance` |
| `aws_neptune_database_instance` | **HAS** | `aws_security_group` |
| `aws_neptune_database_instance` | **USES** | `aws_kms_key` |
| `aws_network_acl` | **PROTECTS** | `aws_subnet` |
| `aws_network_acl` | **ALLOWS** | `aws_resource` |
| `aws_network_acl` | **DENIES** | `aws_resource` |
| `aws_networkfirewall` | **HAS** | `aws_firewall` |
| `aws_networkfirewall` | **HAS** | `aws_firewall_policy` |
| `aws_networkfirewall` | **HAS** | `aws_firewall_rule_group` |
| `aws_networkmanager` | **HAS** | `aws_networkmanager_core_network` |
| `aws_networkmanager_attachment` | **HAS** | `aws_networkmanager_connect_peer` |
| `aws_networkmanager_attachment` | **USES** | `aws_vpc` |
| `aws_networkmanager_attachment` | **USES** | `aws_vpn_connection` |
| `aws_networkmanager_attachment` | **USES** | `aws_directconnect_gateway` |
| `aws_networkmanager_attachment` | **USES** | `aws_ec2_transit_gateway_route_table` |
| `aws_networkmanager_connect_peer` | **USES** | `aws_subnet` |
| `aws_networkmanager_core_network` | **HAS** | `aws_networkmanager_core_network_policy` |
| `aws_networkmanager_core_network` | **HAS** | `aws_networkmanager_attachment` |
| `aws_nlb` | **USES** | `aws_eni` |
| `aws_nlb` | **HAS** | `aws_security_group` |
| `aws_nlb` | **HAS** | `aws_lb_listener` |
| `aws_nlb` | **CONNECTS** | `aws_lb_target_group` |
| `aws_opensearch` | **HAS** | `aws_opensearch_domain` |
| `aws_opensearch_domain` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_organization` | **HAS** | `aws_organization_root` |
| `aws_organization_root` | **HAS** | `aws_organizational_unit` |
| `aws_organizational_unit` | **HAS** | `aws_organizational_unit` |
| `aws_patch_baseline` | **GENERATED** | `aws_instance_patch_state` |
| `aws_patch_group` | **USES** | `aws_patch_baseline` |
| `aws_patch_group` | **HAS** | `aws_instance` |
| `aws_prometheus` | **HAS** | `aws_prometheus_workspace` |
| `aws_prometheus` | **HAS** | `aws_prometheus_scraper` |
| `aws_prometheus_scraper` | **SCANS** | `aws_eks_cluster` |
| `aws_prometheus_scraper` | **USES** | `aws_subnet` |
| `aws_prometheus_scraper` | **USES** | `aws_security_group` |
| `aws_prometheus_scraper` | **USES** | `aws_iam_role` |
| `aws_prometheus_scraper` | **SENDS** | `aws_prometheus_workspace` |
| `aws_prometheus_workspace` | **USES** | `aws_kms_key` |
| `aws_prometheus_workspace` | **HAS** | `aws_cloudwatch_log_group` |
| `aws_quicksight` | **HAS** | `aws_quicksight_data_set` |
| `aws_quicksight` | **HAS** | `aws_quicksight_vpc_connection` |
| `aws_quicksight` | **HAS** | `aws_quicksight_user` |
| `aws_quicksight` | **HAS** | `aws_quicksight_group` |
| `aws_quicksight` | **HAS** | `aws_quicksight_custom_permissions` |
| `aws_quicksight_dashboard` | **USES** | `aws_quicksight_data_set` |
| `aws_quicksight_data_set` | **USES** | `aws_quicksight_data_source` |
| `aws_quicksight_data_source` | **CONNECTS** | `aws_quicksight_vpc_connection` |
| `aws_quicksight_group` | **HAS** | `aws_quicksight_user` |
| `aws_quicksight_user` | **ASSIGNED** | `aws_quicksight_custom_permissions` |
| `aws_ram_principal` | **USES** | `aws_ram_shared_resource` |
| `aws_ram_resource_share` | **GENERATED** | `aws_ram_resource_share_invitation` |
| `aws_ram_resource_share` | **CONTAINS** | `aws_ram_shared_resource` |
| `aws_ram_resource_share` | **ALLOWS** | `aws_ram_principal` |
| `aws_ram_service` | **HAS** | `aws_ram_resource_share` |
| `aws_rds` | **HAS** | `aws_rds_cluster` |
| `aws_rds` | **HAS** | `aws_db_instance` |
| `aws_rds` | **HAS** | `aws_db_subnet_group` |
| `aws_rds` | **HAS** | `aws_db_proxy` |
| `aws_rds_cluster` | **HAS** | `aws_security_group` |
| `aws_rds_cluster` | **USES** | `aws_kms_key` |
| `aws_rds_cluster` | **USES** | `aws_secret` |
| `aws_rds_cluster` | **CONTAINS** | `aws_db_instance` |
| `aws_rds_cluster` | **USES** | `aws_rds_cluster_parameter_group` |
| `aws_rds_cluster` | **HAS** | `aws_db_cluster_snapshot` |
| `aws_redshift` | **HAS** | `aws_redshift_cluster` |
| `aws_redshift_cluster` | **USES** | `aws_kms_key` |
| `aws_redshift_cluster` | **HAS** | `aws_security_group` |
| `aws_redshift_cluster` | **USES** | `aws_redshift_cluster_parameter_group` |
| `aws_redshift_cluster` | **HAS** | `aws_redshift_datashare` |
| `aws_redshift_cluster` | **ASSIGNED** | `aws_iam_role` |
| `aws_redshift_datashare_authorization` | **ALLOWS** | `aws_redshift_datashare` |
| `aws_redshift_serverless` | **HAS** | `aws_redshift_serverless_workgroup` |
| `aws_redshift_serverless` | **HAS** | `aws_redshift_serverless_namespace` |
| `aws_redshift_serverless` | **HAS** | `aws_redshift_serverless_usage_limit` |
| `aws_redshift_serverless_namespace` | **HAS** | `aws_redshift_datashare` |
| `aws_resource` | **USES** | `aws_acm_certificate` |
| `aws_resource` | **VIOLATES** | `aws_config_rule_finding` |
| `aws_resource` | **ALLOWS** | `aws_security_group` |
| `aws_resource` | **HAS** | `aws_inspectorv2_finding` |
| `aws_resource` | **HAS** | `aws_securityhub_finding` |
| `aws_resource_explorer` | **HAS** | `aws_resource_explorer_index` |
| `aws_resource_explorer` | **HAS** | `aws_resource_explorer_view` |
| `aws_resource_explorer` | **USES** | `aws_vpc_endpoint` |
| `aws_route_table` | **USES** | `aws_prefix_list` |
| `aws_route53` | **HAS** | `aws_route53_domain` |
| `aws_route53` | **HAS** | `aws_route53_resolver_rule` |
| `aws_route53` | **HAS** | `aws_route53_zone` |
| `aws_route53_resolver_rule` | **USES** | `aws_vpc` |
| `aws_route53_zone` | **HAS** | `aws_route53_record` |
| `aws_s3` | **HAS** | `aws_s3_bucket` |
| `aws_s3_bucket` | **HAS** | `aws_macie_finding` |
| `aws_s3_bucket` | **HAS** | `aws_s3_access_point` |
| `aws_s3_bucket` | **USES** | `aws_kms_key` |
| `aws_s3_bucket` | **HAS** | `aws_s3_bucket_policy` |
| `aws_s3_bucket` | **NOTIFIES** | `aws_lambda_function` |
| `aws_s3_bucket` | **NOTIFIES** | `aws_sqs_queue` |
| `aws_s3_bucket` | **NOTIFIES** | `aws_sns_topic` |
| `aws_s3_bucket` | **ALLOWS** | `aws_account` |
| `aws_s3_bucket` | **ALLOWS** | `aws_s3` |
| `aws_s3_bucket` | **ALLOWS** | `aws_resource` |
| `aws_s3_bucket` | **DENIES** | `aws_resource` |
| `aws_s3_bucket` | **HAS** | `aws_s3_website_config` |
| `aws_s3_bucket` | **HAS** | `aws_s3_bucket_lifecycle_rule` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_notebook_instance` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_model` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_endpoint` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_domain` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_training_job` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_processing_job` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_transform_job` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_feature_group` |
| `aws_sagemaker_domain` | **USES** | `aws_iam_role` |
| `aws_sagemaker_domain` | **USES** | `aws_kms_key` |
| `aws_sagemaker_domain` | **CONNECTS** | `aws_subnet` |
| `aws_sagemaker_domain` | **CONNECTS** | `aws_vpc` |
| `aws_sagemaker_domain` | **USES** | `aws_efs_file_system` |
| `aws_sagemaker_endpoint` | **USES** | `aws_iam_role` |
| `aws_sagemaker_endpoint` | **USES** | `aws_kms_key` |
| `aws_sagemaker_endpoint` | **USES** | `aws_sagemaker_model` |
| `aws_sagemaker_endpoint` | **CONNECTS** | `aws_subnet` |
| `aws_sagemaker_endpoint` | **USES** | `aws_s3_bucket` |
| `aws_sagemaker_feature_group` | **USES** | `aws_iam_role` |
| `aws_sagemaker_feature_group` | **USES** | `aws_kms_key` |
| `aws_sagemaker_feature_group` | **USES** | `aws_s3_bucket` |
| `aws_sagemaker_processing_job` | **USES** | `aws_iam_role` |
| `aws_sagemaker_processing_job` | **USES** | `aws_kms_key` |
| `aws_sagemaker_processing_job` | **CONNECTS** | `aws_subnet` |
| `aws_sagemaker_processing_job` | **USES** | `aws_s3_bucket` |
| `aws_sagemaker_training_job` | **USES** | `aws_iam_role` |
| `aws_sagemaker_training_job` | **USES** | `aws_kms_key` |
| `aws_sagemaker_training_job` | **CONNECTS** | `aws_subnet` |
| `aws_sagemaker_training_job` | **USES** | `aws_s3_bucket` |
| `aws_sagemaker_transform_job` | **USES** | `aws_sagemaker_model` |
| `aws_sagemaker_transform_job` | **USES** | `aws_kms_key` |
| `aws_sagemaker_transform_job` | **USES** | `aws_s3_bucket` |
| `aws_secret` | **HAS** | `aws_secret_version` |
| `aws_secret` | **USES** | `aws_kms_key` |
| `aws_secretsmanager` | **HAS** | `aws_secret` |
| `aws_security_group` | **PROTECTS** | `aws_batch_compute_environment` |
| `aws_security_group` | **PROTECTS** | `aws_cloudhsm_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_cloudhsm_instance` |
| `aws_security_group` | **PROTECTS** | `aws_instance` |
| `aws_security_group` | **ALLOWS** | `aws_resource` |
| `aws_security_group` | **PROTECTS** | `aws_eni` |
| `aws_security_group` | **USES** | `aws_prefix_list` |
| `aws_security_group` | **ALLOWS** | `aws_prefix_list` |
| `aws_security_group` | **PROTECTS** | `aws_vpc_endpoint` |
| `aws_security_group` | **PROTECTS** | `aws_ecs_service` |
| `aws_security_group` | **PROTECTS** | `aws_efs_mount_target` |
| `aws_security_group` | **PROTECTS** | `aws_eks_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_elasticache_memcached_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_elasticache_cluster_node` |
| `aws_security_group` | **PROTECTS** | `aws_elb` |
| `aws_security_group` | **PROTECTS** | `aws_alb` |
| `aws_security_group` | **PROTECTS** | `aws_nlb` |
| `aws_security_group` | **PROTECTS** | `aws_elasticsearch_domain` |
| `aws_security_group` | **PROTECTS** | `aws_lambda_function` |
| `aws_security_group` | **PROTECTS** | `aws_neptune_database_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_neptune_database_instance` |
| `aws_security_group` | **PROTECTS** | `aws_rds_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_db_instance` |
| `aws_security_group` | **PROTECTS** | `aws_redshift_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_sagemaker_endpoint` |
| `aws_security_group` | **PROTECTS** | `aws_sagemaker_domain` |
| `aws_security_group` | **PROTECTS** | `aws_sagemaker_training_job` |
| `aws_security_group` | **PROTECTS** | `aws_sagemaker_processing_job` |
| `aws_securityhub` | **HAS** | `aws_securityhub_account` |
| `aws_securityhub` | **HAS** | `aws_securityhub_standard` |
| `aws_securityhub_control` | **IDENTIFIED** | `aws_securityhub_finding` |
| `aws_securityhub_finding` | **CONNECTS** | `aws_securityhub_finding` |
| `aws_securityhub_standard` | **HAS** | `aws_securityhub_control` |
| `aws_securityhub_standard` | **IDENTIFIED** | `aws_securityhub_finding` |
| `aws_servicecatalog` | **HAS** | `aws_servicecatalog_portfolio` |
| `aws_servicecatalog` | **HAS** | `aws_servicecatalog_product` |
| `aws_servicecatalog` | **HAS** | `aws_servicecatalog_tag_option` |
| `aws_servicecatalog_portfolio` | **HAS** | `aws_servicecatalog_product` |
| `aws_servicecatalog_portfolio` | **HAS** | `aws_servicecatalog_constraint` |
| `aws_servicecatalog_portfolio` | **HAS** | `aws_servicecatalog_tag_option` |
| `aws_servicecatalog_product` | **HAS** | `aws_servicecatalog_provisioning_artifact` |
| `aws_servicecatalog_product` | **HAS** | `aws_servicecatalog_launch_path` |
| `aws_servicecatalog_product` | **HAS** | `aws_servicecatalog_tag_option` |
| `aws_ses` | **HAS** | `aws_ses_identity` |
| `aws_ses` | **HAS** | `aws_ses_configuration_set` |
| `aws_ses` | **HAS** | `aws_ses_receipt_filter` |
| `aws_ses_identity` | **USES** | `aws_ses_configuration_set` |
| `aws_session_document` | **USES** | `aws_s3_bucket` |
| `aws_session_document` | **USES** | `aws_cloudwatch_log_group` |
| `aws_session_document` | **USES** | `aws_kms_key` |
| `aws_shield` | **HAS** | `aws_shield_subscription` |
| `aws_shield` | **HAS** | `aws_shield_protection_group` |
| `aws_shield` | **HAS** | `aws_shield_protection` |
| `aws_shield_protection` | **PROTECTS** | `aws_resource` |
| `aws_shield_protection_group` | **PROTECTS** | `aws_resource` |
| `aws_shield_protection_group` | **HAS** | `aws_resource` |
| `aws_signer` | **HAS** | `aws_signer_signing_profile` |
| `aws_signer_signing_profile` | **HAS** | `aws_signer_signing_job` |
| `aws_sns` | **HAS** | `aws_sns_topic` |
| `aws_sns_topic` | **HAS** | `aws_sns_subscription` |
| `aws_sns_topic` | **USES** | `aws_kms_key` |
| `aws_sqs` | **HAS** | `aws_sqs_queue` |
| `aws_sqs_queue` | **SENDS** | `aws_sqs_queue` |
| `aws_sqs_queue` | **USES** | `aws_kms_key` |
| `aws_ssm` | **MANAGES** | `aws_instance` |
| `aws_ssm` | **HAS** | `aws_patch_baseline` |
| `aws_ssm` | **HAS** | `aws_patch_group` |
| `aws_ssm` | **MANAGES** | `aws_secure_string_parameter` |
| `aws_ssm` | **HAS** | `aws_session_document` |
| `aws_ssm` | **HAS** | `aws_ssm_document` |
| `aws_ssm` | **HAS** | `aws_ssm_compliance_summary` |
| `aws_ssm` | **HAS** | `aws_ssm_associations` |
| `aws_ssm_service_setting` | **MANAGES** | `aws_ssm` |
| `aws_sso` | **HAS** | `aws_sso_instance` |
| `aws_sso_group` | **ASSIGNED** | `aws_sso_permission_set` |
| `aws_sso_group` | **HAS** | `aws_sso_user` |
| `aws_sso_instance` | **HAS** | `aws_sso_application` |
| `aws_sso_instance` | **HAS** | `aws_sso_permission_set` |
| `aws_sso_instance` | **HAS** | `aws_sso_user` |
| `aws_sso_instance` | **HAS** | `aws_sso_group` |
| `aws_sso_user` | **ASSIGNED** | `aws_sso_permission_set` |
| `aws_states` | **HAS** | `aws_states_state_machine` |
| `aws_states_state_machine` | **USES** | `aws_iam_role` |
| `aws_states_state_machine` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_storage_gateway` | **HAS** | `aws_storage_gateway_gateway` |
| `aws_storage_gateway_file_share` | **USES** | `aws_iam_role` |
| `aws_storage_gateway_file_share` | **USES** | `aws_s3_bucket` |
| `aws_storage_gateway_file_share` | **USES** | `aws_kms_key` |
| `aws_storage_gateway_gateway` | **USES** | `aws_vpc_endpoint` |
| `aws_storage_gateway_gateway` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_storage_gateway_gateway` | **HAS** | `aws_storage_gateway_file_share` |
| `aws_storage_gateway_gateway` | **HAS** | `aws_storage_gateway_volume` |
| `aws_storage_gateway_gateway` | **HAS** | `aws_storage_gateway_tape` |
| `aws_storage_gateway_tape` | **USES** | `aws_kms_key` |
| `aws_storage_gateway_tape_pool` | **CONTAINS** | `aws_storage_gateway_tape` |
| `aws_storage_gateway_volume` | **USES** | `aws_kms_key` |
| `aws_subnet` | **HAS** | `aws_cloudhsm_instance` |
| `aws_subnet` | **HAS** | `aws_instance` |
| `aws_subnet` | **HAS** | `aws_nat_gateway` |
| `aws_subnet` | **USES** | `aws_route_table` |
| `aws_subnet` | **CONNECTS** | `aws_eni` |
| `aws_subnet` | **HAS** | `aws_efs_mount_target` |
| `aws_subnet` | **HAS** | `aws_elasticsearch_domain` |
| `aws_subnet` | **HAS** | `aws_lambda_function` |
| `aws_subnet` | **USES** | `aws_msk_cluster` |
| `aws_subnet` | **HAS** | `aws_workspace` |
| `aws_transfer` | **HAS** | `aws_transfer_server` |
| `aws_transfer_server` | **USES** | `aws_eip` |
| `aws_transfer_server` | **USES** | `aws_api_gateway_rest_api` |
| `aws_transfer_server` | **HAS** | `aws_transfer_user` |
| `aws_transfer_user` | **ALLOWS** | `aws_s3_bucket` |
| `aws_vpc` | **HAS** | `aws_cloudhsm_cluster` |
| `aws_vpc` | **HAS** | `aws_codebuild_project` |
| `aws_vpc` | **HAS** | `aws_vpn_gateway` |
| `aws_vpc` | **HAS** | `aws_internet_gateway` |
| `aws_vpc` | **HAS** | `aws_nat_gateway` |
| `aws_vpc` | **HAS** | `aws_network_acl` |
| `aws_vpc` | **HAS** | `aws_route_table` |
| `aws_vpc` | **HAS** | `aws_security_group` |
| `aws_vpc` | **CONTAINS** | `aws_subnet` |
| `aws_vpc` | **HAS** | `aws_vpc_endpoint` |
| `aws_vpc` | **HAS** | `aws_eks_cluster` |
| `aws_vpc` | **HAS** | `aws_elasticache_memcached_cluster` |
| `aws_vpc` | **HAS** | `aws_elasticache_cluster_node` |
| `aws_vpc` | **HAS** | `aws_elb` |
| `aws_vpc` | **HAS** | `aws_alb` |
| `aws_vpc` | **HAS** | `aws_nlb` |
| `aws_vpc` | **HAS** | `aws_glue_dev_endpoint` |
| `aws_vpc` | **HAS** | `aws_grafana_workspace` |
| `aws_vpc` | **HAS** | `aws_neptune_database_instance` |
| `aws_vpc` | **HAS** | `aws_db_instance` |
| `aws_vpc` | **HAS** | `aws_db_subnet_group` |
| `aws_vpc` | **HAS** | `aws_redshift_serverless_workgroup` |
| `aws_vpc` | **HAS** | `aws_redshift_cluster` |
| `aws_vpc` | **HAS** | `aws_s3_access_point` |
| `aws_vpc` | **HAS** | `aws_transfer_server` |
| `aws_vpc` | **CONNECTS** | `aws_vpc_lattice_service_network` |
| `aws_vpc` | **HAS** | `aws_opensearch_domain` |
| `aws_vpc_endpoint` | **HAS** | `aws_security_group` |
| `aws_vpc_endpoint` | **USES** | `aws_subnet` |
| `aws_vpc_endpoint` | **USES** | `aws_eni` |
| `aws_vpc_endpoint` | **CONNECTS** | `aws_auditmanager` |
| `aws_vpc_endpoint` | **CONNECTS** | `aws_vpc_lattice_service_network` |
| `aws_vpc_endpoint_service` | **ALLOWS** | `aws_resource` |
| `aws_vpc_endpoint_service` | **CONNECTS** | `aws_nlb` |
| `aws_vpc_endpoint_service` | **CONNECTS** | `aws_elb` |
| `aws_vpc_endpoint_service` | **CONNECTS** | `aws_vpc_endpoint` |
| `aws_vpc_lattice` | **HAS** | `aws_vpc_lattice_service` |
| `aws_vpc_lattice` | **HAS** | `aws_vpc_lattice_service_network` |
| `aws_vpc_lattice` | **HAS** | `aws_vpc_lattice_target_group` |
| `aws_vpc_lattice_listener_rule` | **DEFINES** | `aws_vpc_lattice_listener` |
| `aws_vpc_lattice_listener_rule` | **TRIGGERS** | `aws_vpc_lattice_target_group` |
| `aws_vpc_lattice_service` | **CONNECTS** | `aws_vpc_lattice_listener` |
| `aws_vpc_lattice_service_network` | **CONNECTS** | `aws_vpc_lattice_service` |
| `aws_vpc_lattice_target_group` | **HAS** | `aws_lambda_function` |
| `aws_vpc_lattice_target_group` | **HAS** | `aws_alb` |
| `aws_vpn_connection` | **CONNECTS** | `aws_customer_gateway` |
| `aws_vpn_gateway` | **CONNECTS** | `aws_vpn_connection` |
| `aws_waf` | **HAS** | `aws_waf_web_acl` |
| `aws_waf_v2_rule_group` | **HAS** | `aws_waf_v2_web_acl_rule` |
| `aws_waf_v2_web_acl` | **PROTECTS** | `aws_api_gateway_stage` |
| `aws_waf_v2_web_acl` | **PROTECTS** | `aws_cognito_user_pool` |
| `aws_waf_v2_web_acl` | **PROTECTS** | `aws_cloudfront_distribution` |
| `aws_waf_v2_web_acl` | **PROTECTS** | `aws_alb` |
| `aws_waf_v2_web_acl` | **HAS** | `aws_waf_v2_web_acl_rule` |
| `aws_waf_v2_web_acl` | **HAS** | `aws_waf_v2_web_acl_firewall_manager_rule_group` |
| `aws_waf_v2_web_acl` | **LOGS** | `aws_s3_bucket` |
| `aws_waf_v2_web_acl` | **LOGS** | `aws_firehose_delivery_stream` |
| `aws_waf_v2_web_acl` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_waf_v2_web_acl_rule` | **USES** | `aws_waf_v2_ip_set` |
| `aws_waf_v2_web_acl_rule` | **USES** | `aws_waf_v2_rule_group` |
| `aws_waf_web_acl` | **PROTECTS** | `aws_api_gateway_stage` |
| `aws_waf_web_acl` | **PROTECTS** | `aws_cloudfront_distribution` |
| `aws_wafv2` | **HAS** | `aws_waf_v2_web_acl` |
| `aws_wafv2` | **HAS** | `aws_waf_v2_ip_set` |
| `aws_wafv2` | **HAS** | `aws_waf_v2_rule_group` |
| `aws_workspace` | **USES** | `aws_workspaces_bundle` |
| `aws_workspaces` | **HAS** | `aws_workspace` |
| `aws_xray` | **HAS** | `aws_xray_group` |
| `aws_xray` | **HAS** | `aws_xray_encryption_config` |
| `aws_xray` | **HAS** | `aws_xray_resource_policy` |
| `aws_xray_encryption_config` | **USES** | `aws_kms_key` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `aws_accessanalyzer_finding` | **IDENTIFIED** | `aws_resource` | FORWARD |
| `aws_account` | **HAS** | `aws_account` | FORWARD |
| `aws_account` | **ALLOWS** | `aws_ami` | FORWARD |
| `aws_account` | **DENIES** | `aws_ami` | FORWARD |
| `aws_account` | **SHARED** | `aws_db_snapshot` | REVERSE |
| `aws_account` | **SHARED** | `aws_db_cluster_snapshot` | REVERSE |
| `aws_account` | **OWNS** | `aws_sso_instance` | REVERSE |
| `aws_acm_certificate` | **CONNECTS** | `aws_route53_record` | FORWARD |
| `aws_api_gateway_domain_name` | **HAS** | `aws_acm_certificate` | FORWARD |
| `aws_api_gateway_rest_api` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_api_gateway_rest_api` | **DENIES** | `aws_resource` | FORWARD |
| `aws_autoscaling_launch_configuration` | **USES** | `aws_ami` | FORWARD |
| `aws_backup_vault` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_backup_vault` | **DENIES** | `aws_resource` | FORWARD |
| `aws_batch_compute_environment` | **USES** | `aws_ami` | FORWARD |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_s3_bucket` | FORWARD |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_api_gateway_rest_api` | FORWARD |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_api_gateway_domain_name` | FORWARD |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_resource` | FORWARD |
| `aws_cloudtrail` | **LOGS** | `aws_s3_bucket` | FORWARD |
| `aws_cloudtrail` | **LOGS** | `aws_cloudwatch_log_group` | FORWARD |
| `aws_cloudtrail` | **SENDS** | `aws_s3` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_lambda` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_dynamodb` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_s3_bucket` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_lambda_function` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_dynamodb_table` | REVERSE |
| `aws_cloudwatch_event_rule` | **TRIGGERS** | `aws_resource` | FORWARD |
| `aws_codeartifact_domain` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_codeartifact_domain` | **DENIES** | `aws_resource` | FORWARD |
| `aws_codeartifact_repository` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_codeartifact_repository` | **DENIES** | `aws_resource` | FORWARD |
| `aws_datasync_location` | **CONNECTS** | `aws_s3_bucket` | FORWARD |
| `aws_datasync_location` | **CONNECTS** | `aws_efs_file_system` | FORWARD |
| `aws_datasync_location` | **CONNECTS** | `aws_fsx_file_system` | FORWARD |
| `aws_datasync_task` | **USES** | `aws_cloudwatch_log_group` | FORWARD |
| `aws_dynamodb_table` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_dynamodb_table` | **DENIES** | `aws_resource` | FORWARD |
| `aws_ec2` | **HAS** | `aws_ec2_transit_gateway` | FORWARD |
| `aws_ec2_transit_gateway_vpc_attachment` | **USES** | `aws_vpc` | FORWARD |
| `aws_ecr_repository` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_ecr_repository` | **DENIES** | `aws_resource` | REVERSE |
| `aws_ecs_task` | **USES** | `aws_eni` | FORWARD |
| `aws_efs_file_system` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_efs_file_system` | **DENIES** | `aws_resource` | FORWARD |
| `aws_elasticsearch_domain` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_elasticsearch_domain` | **DENIES** | `aws_resource` | REVERSE |
| `aws_firewall_rule_group` | **USES** | `aws_prefix_list` | FORWARD |
| `aws_fms_resource_set` | **HAS** | `aws_resource` | FORWARD |
| `aws_glacier_vault` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_glacier_vault` | **DENIES** | `aws_resource` | FORWARD |
| `aws_glue_catalog_database` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_glue_catalog_database` | **DENIES** | `aws_resource` | FORWARD |
| `aws_iam_group_policy` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_iam_group_policy` | **DENIES** | `aws_resource` | FORWARD |
| `aws_iam_policy` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_iam_policy` | **DENIES** | `aws_resource` | FORWARD |
| `aws_iam_role` | **ASSIGNED** | `aws_auditmanager_setting` | REVERSE |
| `aws_iam_role` | **ASSIGNED** | `aws_auditmanager_delegation` | REVERSE |
| `aws_iam_role` | **ASSIGNED** | `aws_datasync_location` | FORWARD |
| `aws_iam_role` | **TRUSTS** | `aws_resource` | FORWARD |
| `aws_iam_role` | **TRUSTS** | `external_resource` | FORWARD |
| `aws_iam_role` | **USES** | `aws_neptune_analytics_graph_export_task` | REVERSE |
| `aws_iam_role` | **USES** | `aws_neptune_analytics_graph_import_task` | REVERSE |
| `aws_iam_role_policy` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_iam_role_policy` | **DENIES** | `aws_resource` | FORWARD |
| `aws_iam_saml_provider` | **IS** | `external_resource` | FORWARD |
| `aws_iam_user_policy` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_iam_user_policy` | **DENIES** | `aws_resource` | FORWARD |
| `aws_inspectorv2_finding` | **IS** | `cve` | FORWARD |
| `aws_instance` | **USES** | `aws_ami` | FORWARD |
| `aws_instance_patch_state` | **GENERATED** | `aws_patch_baseline` | REVERSE |
| `aws_kinesis_stream` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_kinesis_stream` | **DENIES** | `aws_resource` | FORWARD |
| `aws_kms_key` | **USES** | `aws_auditmanager_setting` | REVERSE |
| `aws_kms_key` | **USES** | `aws_eventbridge_event_bus` | REVERSE |
| `aws_kms_key` | **USES** | `aws_cloudwatch_log_group` | REVERSE |
| `aws_kms_key` | **USES** | `aws_dynamodb_table` | REVERSE |
| `aws_kms_key` | **USES** | `aws_ebs_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_ebs_volume` | REVERSE |
| `aws_kms_key` | **USES** | `aws_efs_file_system` | REVERSE |
| `aws_kms_key` | **USES** | `aws_elasticache_redis_cluster` | REVERSE |
| `aws_kms_key` | **USES** | `aws_elasticache_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_glue_security_configuration` | REVERSE |
| `aws_kms_key` | **USES** | `aws_guardduty_publishing_destination` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_database_cluster` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_database_instance` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_analytics_graph` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_analytics_graph_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_analytics_graph_export_task` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_analytics_graph_import_task` | REVERSE |
| `aws_kms_key` | **USES** | `aws_rds_cluster` | REVERSE |
| `aws_kms_key` | **USES** | `aws_db_instance` | REVERSE |
| `aws_kms_key` | **USES** | `aws_db_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_db_cluster_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_redshift_cluster` | REVERSE |
| `aws_kms_key` | **USES** | `aws_s3_bucket` | REVERSE |
| `aws_kms_key` | **USES** | `aws_sns_topic` | REVERSE |
| `aws_kms_key` | **USES** | `aws_xray_encryption_config` | REVERSE |
| `aws_kms_key` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_kms_key` | **DENIES** | `aws_resource` | FORWARD |
| `aws_lambda_function` | **USES** | `aws_lambda_layer` | FORWARD |
| `aws_lambda_function` | **USES** | `aws_signer_signing_profile` | FORWARD |
| `aws_lambda_function` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_lambda_function` | **DENIES** | `aws_resource` | FORWARD |
| `aws_launch_template_version` | **USES** | `aws_ami` | FORWARD |
| `aws_lb_target_group` | **HAS** | `aws_eip` | FORWARD |
| `aws_lexv2_bot` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_lexv2_bot` | **DENIES** | `aws_resource` | FORWARD |
| `aws_lexv2_bot_alias` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_lexv2_bot_alias` | **DENIES** | `aws_resource` | FORWARD |
| `aws_nat_gateway` | **USES** | `aws_eip` | FORWARD |
| `aws_network_acl` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_network_acl` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_network_acl` | **DENIES** | `aws_resource` | FORWARD |
| `aws_network_acl` | **DENIES** | `aws_resource` | REVERSE |
| `aws_opensearch_domain` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_opensearch_domain` | **DENIES** | `aws_resource` | REVERSE |
| `aws_organization_policy` | **ENFORCES** | `aws_organization_root` | FORWARD |
| `aws_organization_policy` | **ENFORCES** | `aws_account` | FORWARD |
| `aws_organization_policy` | **ENFORCES** | `aws_organizational_unit` | FORWARD |
| `aws_organization_root` | **HAS** | `aws_account` | FORWARD |
| `aws_organizational_unit` | **HAS** | `aws_account` | FORWARD |
| `aws_patch_group` | **USES** | `aws_patch_baseline` | FORWARD |
| `aws_prometheus_scraper` | **SCANS** | `aws_eks_cluster` | FORWARD |
| `aws_prometheus_scraper` | **USES** | `aws_subnet` | FORWARD |
| `aws_prometheus_scraper` | **USES** | `aws_security_group` | FORWARD |
| `aws_prometheus_scraper` | **USES** | `aws_iam_role` | FORWARD |
| `aws_prometheus_scraper` | **SENDS** | `aws_prometheus_workspace` | FORWARD |
| `aws_prometheus_workspace` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_prometheus_workspace` | **DENIES** | `aws_resource` | FORWARD |
| `aws_ram_shared_resource` | **IS** | `aws_resource` | FORWARD |
| `aws_resource` | **USES** | `aws_acm_certificate` | REVERSE |
| `aws_route_table` | **USES** | `aws_prefix_list` | FORWARD |
| `aws_route53_record` | **CONNECTS** | `aws_acm_certificate` | REVERSE |
| `aws_route53_record` | **CONNECTS** | `aws_ses` | FORWARD |
| `aws_route53_record` | **CONNECTS** | `aws_resource` | FORWARD |
| `aws_s3_bucket` | **USES** | `aws_auditmanager_setting` | REVERSE |
| `aws_s3_bucket` | **HAS** | `aws_s3_access_point` | REVERSE |
| `aws_s3_bucket` | **PUBLISHES** | `aws_s3_bucket` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `aws_account` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `aws_account` | REVERSE |
| `aws_s3_bucket` | **ALLOWS** | `everyone` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `everyone` | REVERSE |
| `aws_s3_bucket` | **ALLOWS** | `aws_authenticated_users` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `aws_authenticated_users` | REVERSE |
| `aws_s3_bucket` | **ALLOWS** | `aws_s3` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `aws_s3` | REVERSE |
| `aws_s3_bucket` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_s3_bucket` | **DENIES** | `aws_resource` | REVERSE |
| `aws_secret` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_secret` | **DENIES** | `aws_resource` | FORWARD |
| `aws_security_group` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_security_group` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_security_group` | **USES** | `aws_prefix_list` | FORWARD |
| `aws_security_group` | **ALLOWS** | `aws_prefix_list` | FORWARD |
| `aws_servicecatalog_portfolio` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_ses_identity` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_ses_identity` | **DENIES** | `aws_resource` | FORWARD |
| `aws_sns_subscription` | **HAS** | `aws_resource` | FORWARD |
| `aws_sns_topic` | **USES** | `aws_auditmanager_setting` | REVERSE |
| `aws_sns_topic` | **NOTIFIES** | `aws_resource` | FORWARD |
| `aws_sns_topic` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_sns_topic` | **DENIES** | `aws_resource` | REVERSE |
| `aws_sqs_queue` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_sqs_queue` | **DENIES** | `aws_resource` | REVERSE |
| `aws_sso_group` | **ASSIGNED** | `aws_account` | FORWARD |
| `aws_sso_permission_set` | **ASSIGNED** | `aws_iam_policy` | FORWARD |
| `aws_sso_permission_set` | **ASSIGNED** | `aws_account` | FORWARD |
| `aws_sso_user` | **ASSIGNED** | `aws_account` | FORWARD |
| `aws_vpc` | **LOGS** | `aws_cloudwatch_log_group` | FORWARD |
| `aws_vpc` | **LOGS** | `aws_s3_bucket` | FORWARD |
| `aws_vpc` | **CONNECTS** | `aws_vpc` | FORWARD |
| `aws_vpc` | **CONNECTS** | `aws_vpc` | REVERSE |
| `aws_vpc_endpoint` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_vpc_endpoint` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_vpc_endpoint` | **DENIES** | `aws_resource` | FORWARD |
| `aws_vpc_endpoint` | **DENIES** | `aws_resource` | REVERSE |

### Aws Api Gateway Stage Method Setting

`aws_api_gateway_stage_method_setting` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cacheTtlInSeconds` | `number` |  |  |
| `isAuthorizationForCacheControlRequired` | `boolean` |  |  |
| `isCacheDataEncrypted` | `boolean` |  |  |
| `isCachingEnabled` | `boolean` |  |  |
| `isDataTraceEnabled` | `boolean` |  |  |
| `isMetricsEnabled` | `boolean` |  |  |
| `loggingLevel` | `string` |  |  |
| `methodPath` | `string` |  |  |
| `throttlingBurstLimit` | `number` |  |  |
| `throttlingRateLimit` | `number` |  |  |
| `unauthorizedCacheControlHeaderStrategy` | `string` |  |  |

---

### Aws Appconfig Account Settings

`aws_appconfig_account_settings` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns these settings. |  |
| 

`deletionProtectionPeriodInMinutes` \*

 | `number` **|** `null` | The interval, in minutes, during which AppConfig monitors for configuration retrieval before allowing deletion of a configuration profile or environment. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | Whether deletion protection is enabled for the account in this region, preventing deletion of actively-used environments and configuration profiles. |  |
| 

`isVendedMetricsEnabled` \*

 | `boolean` **|** `null` | Whether AppConfig publishes vended CloudWatch metrics for the account in this region. |  |
| 

`region` \*

 | `string` | AWS region these account settings apply to. |  |

---

### Aws Appconfig Application

`aws_appconfig_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the application. |  |
| 

`arn` \*

 | `string` | The ARN of the AppConfig application. |  |
| 

`region` \*

 | `string` | AWS region where the application is deployed. |  |

---

### Aws Appconfig Configuration Profile

`aws_appconfig_configuration_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationId` \*

 | `string` | The ID of the parent AppConfig application. |  |
| 

`arn` \*

 | `string` | The ARN of the AppConfig configuration profile. |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key used to encrypt configuration data at rest. |  |
| 

`kmsKeyIdentifier` \*

 | `string` **|** `null` | KMS key identifier (alias or key ID) used for encryption. |  |
| 

`locationUri` \*

 | `string` **|** `null` | URI pointing to the source of configuration data (S3 URI, SSM parameter, or hosted). |  |
| 

`region` \*

 | `string` | AWS region where the profile is deployed. |  |
| 

`retrievalRoleArn` \*

 | `string` **|** `null` | IAM role ARN that AppConfig uses to retrieve configuration from the location URI. |  |
| 

`type` \*

 | `string` **|** `null` | The type of the configuration profile (AWS.AppConfig.FeatureFlags or AWS.Freeform). |  |
| 

`validatorTypes` \*

 | `array` **|** `null` | List of validator types attached to this profile (JSON\_SCHEMA, LAMBDA). |  |

---

### Aws Appconfig Deployment

`aws_appconfig_deployment` inherits from [Deployment](/data-model/schemas/Deployment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationId` \*

 | `string` | The ID of the parent AppConfig application. |  |
| 

`arn` \*

 | `string` | The ARN of the AppConfig deployment. |  |
| 

`configurationLocationUri` \*

 | `string` **|** `null` | URI of the configuration source used in this deployment. |  |
| 

`configurationName` \*

 | `string` **|** `null` | Name of the configuration profile used in this deployment. |  |
| 

`deploymentNumber` \*

 | `number` | The sequence number of this deployment within the environment. |  |
| 

`deploymentStrategyId` \*

 | `string` **|** `null` | ID of the deployment strategy used for this deployment. |  |
| 

`environmentId` \*

 | `string` | The ID of the environment to which the configuration was deployed. |  |
| 

`extensionId` \*

 | `string` **|** `null` | ID of the AppConfig extension associated with this deployment. |  |
| 

`finalBakeTimeInMinutes` \*

 | `number` **|** `null` | Bake time in minutes applied during this deployment. |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key used to encrypt configuration data for this deployment. |  |
| 

`kmsKeyIdentifier` \*

 | `string` **|** `null` | KMS key identifier used during this deployment. |  |
| 

`region` \*

 | `string` | AWS region where the deployment was executed. |  |
| 

`versionLabel` \*

 | `string` **|** `null` | Customer-defined version label for the configuration version deployed. |  |

---

### Aws Appconfig Deployment Strategy

`aws_appconfig_deployment_strategy` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the AppConfig deployment strategy. |  |
| 

`finalBakeTimeInMinutes` \*

 | `number` **|** `null` | Additional time in minutes to monitor after a deployment completes before it is considered successful. |  |
| 

`region` \*

 | `string` | AWS region where the deployment strategy is defined. |  |
| 

`replicateTo` \*

 | `string` **|** `null` | Whether to replicate the deployment strategy to AWS Systems Manager (SSM\_DOCUMENT) or not (NONE). |  |

---

### Aws Appconfig Environment

`aws_appconfig_environment` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alarmArn` \*

 | `string` **|** `null` | ARN of the CloudWatch alarm monitoring this environment. |  |
| 

`alarmRoleArn` \*

 | `string` **|** `null` | IAM role ARN used by AppConfig to evaluate CloudWatch alarms for this environment. |  |
| 

`applicationId` \*

 | `string` | The ID of the parent AppConfig application. |  |
| 

`arn` \*

 | `string` | The ARN of the AppConfig environment. |  |
| 

`region` \*

 | `string` | AWS region where the environment is deployed. |  |
| 

`state` \*

 | `string` **|** `null` | The current state of the environment (e.g. READY\_FOR\_DEPLOYMENT, DEPLOYING, ROLLED\_BACK). |  |

---

### Aws Appconfig Hosted Configuration Version

`aws_appconfig_hosted_configuration_version` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationId` \*

 | `string` | The ID of the parent AppConfig application. |  |
| 

`arn` \*

 | `string` | The ARN of the hosted configuration version. |  |
| 

`configurationProfileId` \*

 | `string` | The ID of the configuration profile this version belongs to. |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key used to encrypt this hosted configuration version. |  |
| 

`region` \*

 | `string` | AWS region where the hosted configuration version is stored. |  |
| 

`versionNumber` \*

 | `number` | The version number of this hosted configuration version. |  |

---

### Aws Athena Work Group

`aws_athena_work_group` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`additionalConfiguration` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`bytesScannedCutoffPerQuery` \*

 | `number` **|** `null` |  |  |
| 

`customerContentEncryptionKmsKey` \*

 | `string` **|** `null` |  |  |
| 

`encrypted` \*

 | `boolean` |  |  |
| 

`encryptionKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`engineVersionEffective` \*

 | `string` **|** `null` |  |  |
| 

`engineVersionSelected` \*

 | `string` **|** `null` |  |  |
| 

`executionRole` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterApplicationArn` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isEnforceWorkGroupConfiguration` \*

 | `boolean` **|** `null` |  |  |
| 

`isIdentityCenterEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isMinimumEncryptionEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isPublishCloudWatchMetricsEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isRequesterPaysEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resultAclConfiguration` \*

 | `string` **|** `null` |  |  |
| 

`resultEncryptionKmsKey` \*

 | `string` **|** `null` |  |  |
| 

`resultEncryptionOption` \*

 | `string` **|** `null` |  |  |
| 

`resultExpectedBucketOwner` \*

 | `string` **|** `null` |  |  |
| 

`resultOutputLocation` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`webLink` \*

 | `string` |  |  |

---

### Aws Auditmanager Assessment

`aws_auditmanager_assessment` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`assessmentReportDestination` \*

 | `string` **|** `null` |  |  |
| 

`awsAccountEmailAddress` \*

 | `string` **|** `null` |  |  |
| 

`awsAccountId` \*

 | `string` **|** `null` |  |  |
| 

`awsAccountName` \*

 | `string` **|** `null` |  |  |
| 

`complianceType` \*

 | `string` **|** `null` |  |  |
| 

`delegationsCount` \*

 | `number` |  |  |
| 

`frameworkArn` \*

 | `string` **|** `null` |  |  |
| 

`frameworkDescription` \*

 | `string` **|** `null` |  |  |
| 

`frameworkId` \*

 | `string` **|** `null` |  |  |
| 

`frameworkName` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`rolesCount` \*

 | `number` |  |  |
| 

`scopeAwsAccounts` \*

 | `array` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |

---

### Aws Auditmanager Control

`aws_auditmanager_control` inherits from [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`actionPlanInstructions` \*

 | `string` **|** `null` |  |  |
| 

`actionPlanTitle` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`controlMappingSourcesCount` \*

 | `number` |  |  |
| 

`controlSources` \*

 | `string` **|** `null` |  |  |
| 

`createdBy` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lastUpdatedBy` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`testingInformation` \*

 | `string` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Aws Auditmanager Delegation

`aws_auditmanager_delegation` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`assessmentId` \*

 | `string` **|** `null` |  |  |
| 

`assessmentName` \*

 | `string` **|** `null` |  |  |
| 

`controlSetName` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Auditmanager Evidence Folder

`aws_auditmanager_evidence_folder` inherits from [DataObject](/data-model/schemas/DataObject.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assessmentId` \*

 | `string` |  |  |
| 

`assessmentReportSelectionCount` \*

 | `number` |  |  |
| 

`author` \*

 | `string` **|** `null` |  |  |
| 

`controlId` \*

 | `string` |  |  |
| 

`controlName` \*

 | `string` **|** `null` |  |  |
| 

`controlSetId` \*

 | `string` |  |  |
| 

`dataSource` \*

 | `string` **|** `null` |  |  |
| 

`evidenceAwsServiceSourceCount` \*

 | `number` |  |  |
| 

`evidenceByTypeComplianceCheckCount` \*

 | `number` |  |  |
| 

`evidenceByTypeComplianceCheckIssuesCount` \*

 | `number` |  |  |
| 

`evidenceByTypeConfigurationDataCount` \*

 | `number` |  |  |
| 

`evidenceByTypeManualCount` \*

 | `number` |  |  |
| 

`evidenceByTypeUserActivityCount` \*

 | `number` |  |  |
| 

`evidenceResourcesIncludedCount` \*

 | `number` |  |  |
| 

`firstEvidenceAddedOn` \*

 | `number` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`totalEvidence` \*

 | `number` |  |  |

---

### Aws Auditmanager Framework

`aws_auditmanager_framework` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`complianceType` \*

 | `string` **|** `null` |  |  |
| 

`controlsCount` \*

 | `number` |  |  |
| 

`controlSetIds` \*

 | `array` **|** `null` |  |  |
| 

`controlSetsCount` \*

 | `number` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`logo` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Auditmanager Setting

`aws_auditmanager_setting` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`defaultAssessmentReportsDestination` \*

 | `string` **|** `null` |  |  |
| 

`defaultAssessmentReportsDestinationBucketName` \*

 | `string` **|** `null` |  |  |
| 

`defaultAssessmentReportsDestinationType` \*

 | `string` **|** `null` |  |  |
| 

`defaultExportDestination` \*

 | `string` **|** `null` |  |  |
| 

`defaultExportDestinationBucketName` \*

 | `string` **|** `null` |  |  |
| 

`defaultExportDestinationType` \*

 | `string` **|** `null` |  |  |
| 

`defaultProcessOwnerRoleArns` \*

 | `array` **|** `null` |  |  |
| 

`deregistrationDeleteResources` \*

 | `string` **|** `null` |  |  |
| 

`evidenceFinderBackfillStatus` \*

 | `string` **|** `null` |  |  |
| 

`evidenceFinderEnablementStatus` \*

 | `string` **|** `null` |  |  |
| 

`evidenceFinderError` \*

 | `string` **|** `null` |  |  |
| 

`evidenceFinderEventDataStoreArn` \*

 | `string` **|** `null` |  |  |
| 

`isAwsOrgEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isDefaultKmsKey` \*

 | `boolean` **|** `null` |  |  |
| 

`isEvidenceFinderEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`snsTopicArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Bedrock Agent

`aws_bedrock_agent` inherits from [Function](/data-model/schemas/Function.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentCollaboration` \*

 | `string` **|** `null` | Multi-agent collaboration mode (e.g., DISABLED, SUPERVISOR) |  |
| `agentId` | `string` | Unique identifier for the Bedrock agent |  |
| `arn` | `string` | ARN of the Bedrock agent |  |
| 

`customerEncryptionKeyArn` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt agent resources |  |
| 

`displayName` \*

 | `string` | Display name of the Bedrock agent |  |
| 

`foundationModel` \*

 | `string` **|** `null` | Foundation model identifier used by the agent |  |
| 

`guardrailId` \*

 | `string` **|** `null` | ID of the Bedrock guardrail associated with this agent |  |
| 

`hasInstruction` \*

 | `boolean` **|** `null` | Whether the agent has a system instruction configured; true if instruction text is present |  |
| 

`idleSessionTTLInSeconds` \*

 | `number` **|** `null` | Time in seconds before an idle session expires |  |
| 

`instruction` \*

 | `string` **|** `null` | System instruction prompt given to the agent |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the agent is encrypted with a customer-managed KMS key; false means AWS-managed encryption |  |
| 

`isGuardrailAssociated` \*

 | `boolean` **|** `null` | Whether a guardrail is associated with this agent; true means content filtering is active |  |
| 

`isMemoryEnabled` \*

 | `boolean` **|** `null` | Whether the agent retains memory across sessions |  |
| 

`name` \*

 | `string` | Name of the Bedrock agent |  |
| 

`orchestrationType` \*

 | `string` **|** `null` | Orchestration strategy used by the agent (e.g., DEFAULT, CUSTOM\_ORCHESTRATION) |  |
| `preparedOn` | `number` | Timestamp (epoch ms) when the agent was last prepared |  |
| 

`region` \*

 | `string` | AWS region where the agent is deployed |  |
| 

`roleArn` \*

 | `string` **|** `null` | ARN of the IAM role assumed by the agent for API calls |  |

---

### Aws Bedrock Agent Action Group

`aws_bedrock_agent_action_group` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`actionGroupExecutor` \*

 | `string` **|** `null` | Type of executor for the action group (e.g., LAMBDA, RETURN\_CONTROL) |  |
| `actionGroupId` | `string` | Unique identifier for the action group |  |
| `agentId` | `string` | ID of the parent Bedrock agent that owns this action group |  |
| 

`apiSchemaS3Uri` \*

 | `string` **|** `null` | S3 URI of the OpenAPI schema defining the action group API |  |
| 

`apiSchemaType` \*

 | `string` **|** `null` | Type of API schema used (e.g., S3, INLINE) |  |
| 

`displayName` \*

 | `string` | Display name of the action group |  |
| 

`functionCount` \*

 | `number` **|** `null` | Number of functions defined in the action group |  |
| 

`functionNames` \*

 | `array` **|** `null` | Names of functions defined in the action group function schema |  |
| 

`isLambdaBacked` \*

 | `boolean` **|** `null` | Whether this action group executes via a Lambda function; true means external code execution |  |
| 

`isReturnControl` \*

 | `boolean` **|** `null` | Whether the action group returns control to the caller instead of executing directly |  |
| 

`lambdaFunctionArn` \*

 | `string` **|** `null` | ARN of the Lambda function invoked by this action group |  |
| 

`name` \*

 | `string` | Name of the action group |  |
| 

`parentActionGroupSignature` \*

 | `string` **|** `null` | Signature of a built-in parent action group (e.g., AMAZON.UserInput, AMAZON.CodeInterpreter) |  |
| 

`region` \*

 | `string` | AWS region where the action group is defined |  |

---

### Aws Bedrock Agent Runtime

`aws_bedrock_agent_runtime` inherits from [Workload](/data-model/schemas/Workload.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentRuntimeId` \*

 | `string` **|** `null` |  |  |
| 

`agentRuntimeVersion` \*

 | `string` **|** `null` |  |  |
| `arn` | `string` |  |  |
| 

`failureReason` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isPublicNetwork` \*

 | `boolean` **|** `null` |  |  |
| 

`isVpcConfigured` \*

 | `boolean` **|** `null` |  |  |
| 

`networkMode` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`serverProtocol` \*

 | `string` **|** `null` |  |  |
| 

`subnetIds` \*

 | `array` **|** `null` |  |  |

---

### Aws Bedrock Api Key

`aws_bedrock_api_key` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`apiKeyId` \*

 | `string` | IAM ServiceSpecificCredentialId — unique identifier for the API key |  |
| 

`isAutoCreatedUser` \*

 | `boolean` **|** `null` | True when the owning IAM user was auto-created by AWS for this key (UserName starts with "BedrockAPIKey-") |  |
| 

`isExpired` \*

 | `boolean` **|** `null` | True when the API key has reached its expiration date |  |
| 

`isNeverExpiring` \*

 | `boolean` **|** `null` | True when the API key was created without an expiration date — long-lived credential risk |  |
| 

`region` \*

 | `string` | Region label - API keys are global; set to "global" for the entity |  |
| 

`serviceCredentialAlias` \*

 | `string` **|** `null` | Public, non-secret prefix of the bearer token; safe to display |  |
| 

`serviceName` \*

 | `string` | AWS service the credential is scoped to (always bedrock.amazonaws.com) |  |
| 

`serviceUserName` \*

 | `string` **|** `null` | Service-side username generated by IAM for the key |  |
| `status` | `string` | Lifecycle status — Active, Inactive, or Expired |  |
| 

`userName` \*

 | `string` | IAM user that owns the API key |  |

---

### Aws Bedrock Code Interpreter

`aws_bedrock_code_interpreter` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`codeInterpreterId` \*

 | `string` **|** `null` |  |  |
| 

`failureReason` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isPublicNetwork` \*

 | `boolean` **|** `null` |  |  |
| 

`isSandboxed` \*

 | `boolean` **|** `null` |  |  |
| 

`isVpcConfigured` \*

 | `boolean` **|** `null` |  |  |
| 

`networkMode` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`subnetIds` \*

 | `array` **|** `null` |  |  |

---

### Aws Bedrock Custom Model

`aws_bedrock_custom_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the custom model |  |
| 
`baseModelArn` \*

 | `string` **|** `null` | ARN of the foundation model used as the base for customization |  |
| 

`customizationType` \*

 | `string` **|** `null` | Type of customization applied (e.g., FINE\_TUNING, CONTINUED\_PRE\_TRAINING) |  |
| 

`displayName` \*

 | `string` | Display name of the custom model |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the custom model is encrypted with a customer-managed KMS key; false means AWS-managed encryption |  |
| 

`jobArn` \*

 | `string` **|** `null` | ARN of the model customization job that produced this model |  |
| `modelId` | `string` | Unique identifier for the custom model |  |
| 

`modelKmsKeyArn` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt the custom model |  |
| 

`name` \*

 | `string` | Name of the custom model |  |
| 

`outputDataConfigS3Uri` \*

 | `string` **|** `null` | S3 URI where training output artifacts are stored |  |
| 

`region` \*

 | `string` | AWS region where the custom model is stored |  |
| 

`trainingDataConfigS3Uri` \*

 | `string` **|** `null` | S3 URI of the training dataset used to create the custom model |  |

---

### Aws Bedrock Evaluation Job

`aws_bedrock_evaluation_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationType` \*

 | `string` **|** `null` |  |  |
| `arn` | `string` |  |  |
| 

`customerEncryptionKeyId` \*

 | `string` **|** `null` |  |  |
| 

`evaluationDatasets` \*

 | `array` **|** `null` |  |  |
| 

`evaluationMetrics` \*

 | `array` **|** `null` |  |  |
| 

`failureMessages` \*

 | `array` **|** `null` |  |  |
| 

`isAutomatedEvaluation` \*

 | `boolean` **|** `null` |  |  |
| 

`isHumanEvaluation` \*

 | `boolean` **|** `null` |  |  |
| 

`isModelInference` \*

 | `boolean` **|** `null` |  |  |
| 

`isRagInference` \*

 | `boolean` **|** `null` |  |  |
| 

`jobDescription` \*

 | `string` **|** `null` |  |  |
| 

`jobName` \*

 | `string` **|** `null` |  |  |
| 

`jobType` \*

 | `string` **|** `null` |  |  |
| `lastModifiedOn` | `number` | Timestamp (epoch ms) when the evaluation job was last modified |  |
| 

`modelIdentifiers` \*

 | `array` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`outputDataConfigS3Uri` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`taskType` \*

 | `string` **|** `null` |  |  |

---

### Aws Bedrock Flow

`aws_bedrock_flow` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the Bedrock flow |  |
| 
`connectionCount` \*

 | `number` **|** `null` | Number of connections between nodes in the flow |  |
| 

`customerEncryptionKeyArn` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt flow resources |  |
| 

`displayName` \*

 | `string` | Display name of the flow |  |
| `flowId` | `string` | Unique identifier for the flow |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the flow is encrypted with a customer-managed KMS key; false means AWS-managed encryption |  |
| 

`name` \*

 | `string` | Name of the flow |  |
| 

`nodeCount` \*

 | `number` **|** `null` | Number of nodes in the flow definition |  |
| 

`region` \*

 | `string` | AWS region where the flow is deployed |  |
| 

`roleArn` \*

 | `string` **|** `null` | ARN of the IAM role assumed by the flow during execution |  |
| 

`version` \*

 | `string` **|** `null` | Version identifier of the flow |  |

---

### Aws Bedrock Foundation Model

`aws_bedrock_foundation_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the foundation model |  |
| 
`customizationsSupported` \*

 | `array` **|** `null` | Customization types supported (e.g., FINE\_TUNING, CONTINUED\_PRE\_TRAINING) |  |
| 

`displayName` \*

 | `string` | Display name of the foundation model |  |
| 

`inferenceTypesSupported` \*

 | `array` **|** `null` | Inference types the model supports (e.g., ON\_DEMAND, PROVISIONED) |  |
| 

`inputModalities` \*

 | `array` **|** `null` | Input modalities supported by the model (e.g., TEXT, IMAGE, EMBEDDING) |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether the model lifecycle status is ACTIVE and available for use |  |
| 

`isFineTuneable` \*

 | `boolean` **|** `null` | Whether the model can be fine-tuned with custom training data |  |
| 

`isStreamingSupported` \*

 | `boolean` **|** `null` | Whether the model supports streaming inference responses |  |
| `modelId` | `string` | Unique model identifier (e.g., anthropic.claude-3-sonnet-20240229-v1:0) |  |
| 

`modelLifecycleStatus` \*

 | `string` **|** `null` | Lifecycle status of the model (e.g., ACTIVE, LEGACY) |  |
| 

`modelName` \*

 | `string` **|** `null` | Human-readable name of the model (e.g., Claude 3 Sonnet) |  |
| 

`name` \*

 | `string` | Name of the foundation model |  |
| 

`outputModalities` \*

 | `array` **|** `null` | Output modalities supported by the model (e.g., TEXT, IMAGE, EMBEDDING) |  |
| 

`providerName` \*

 | `string` **|** `null` | Name of the model provider (e.g., Anthropic, Amazon, Meta) |  |
| 

`region` \*

 | `string` | AWS region where the model is available |  |

---

### Aws Bedrock Guardrail

`aws_bedrock_guardrail` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the Bedrock guardrail |  |
| 
`blockedInputMessaging` \*

 | `string` **|** `null` | Message returned to users when their input is blocked by the guardrail |  |
| 

`blockedOutputsMessaging` \*

 | `string` **|** `null` | Message returned to users when model output is blocked by the guardrail |  |
| 

`blockedTopicCount` \*

 | `number` **|** `null` | Number of topics configured as blocked in the topic policy |  |
| 

`contentFilterTypes` \*

 | `array` **|** `null` | Types of content filters enabled (e.g., SEXUAL, VIOLENCE, HATE, INSULTS) |  |
| 

`displayName` \*

 | `string` | Display name of the guardrail |  |
| 

`failureRecommendations` \*

 | `array` **|** `null` | Recommendations for resolving guardrail creation or update failures |  |
| 

`groundingThreshold` \*

 | `number` **|** `null` | Minimum grounding score (0-1) required for responses to pass the grounding filter |  |
| `guardrailId` | `string` | Unique identifier for the guardrail |  |
| 

`guardrailProfileArn` \*

 | `string` **|** `null` | ARN of the cross-region guardrail profile for multi-region deployments |  |
| 

`isContentFilterEnabled` \*

 | `boolean` **|** `null` | Whether content filtering is enabled to block harmful content categories |  |
| 

`isContextualGroundingEnabled` \*

 | `boolean` **|** `null` | Whether contextual grounding checks are enabled to reduce hallucination |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the guardrail is encrypted with a customer-managed KMS key; false means AWS-managed encryption |  |
| 

`isPiiDetectionEnabled` \*

 | `boolean` **|** `null` | Whether PII detection is enabled to identify or block personally identifiable information |  |
| 

`isPromptAttackDetectionEnabled` \*

 | `boolean` **|** `null` | Whether prompt attack (injection) detection is enabled to protect against adversarial inputs |  |
| 

`isSensitiveInfoFilterEnabled` \*

 | `boolean` **|** `null` | Whether sensitive information filtering (PII/regex) is enabled |  |
| 

`isTopicPolicyEnabled` \*

 | `boolean` **|** `null` | Whether topic-based blocking policies are configured |  |
| 

`isWordFilterEnabled` \*

 | `boolean` **|** `null` | Whether word-based filtering is enabled to block specific terms |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt guardrail data |  |
| 

`managedWordListTypes` \*

 | `array` **|** `null` | Types of managed word lists applied (e.g., PROFANITY) |  |
| 

`name` \*

 | `string` | Name of the guardrail |  |
| 

`piiEntityTypes` \*

 | `array` **|** `null` | PII entity types detected or blocked (e.g., EMAIL, PHONE, SSN) |  |
| 

`regexPatternCount` \*

 | `number` **|** `null` | Number of custom regex patterns configured for sensitive data detection |  |
| 

`region` \*

 | `string` | AWS region where the guardrail is deployed |  |
| 

`relevanceThreshold` \*

 | `number` **|** `null` | Minimum relevance score (0-1) required for responses to pass the relevance filter |  |
| 

`statusReasons` \*

 | `array` **|** `null` | Reasons explaining the current guardrail status |  |
| `version` | `string` | Version of the guardrail (e.g., DRAFT or a numeric version) |  |

---

### Aws Bedrock Inference Profile

`aws_bedrock_inference_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the inference profile |  |
| 
`displayName` \*

 | `string` | Display name of the inference profile |  |
| `inferenceProfileId` | `string` | Unique identifier for the inference profile |  |
| 

`modelArns` \*

 | `array` **|** `null` | ARNs of the models routed to by this inference profile |  |
| 

`name` \*

 | `string` | Name of the inference profile |  |
| 

`region` \*

 | `string` | AWS region where the inference profile is configured |  |
| 

`type` \*

 | `string` **|** `null` | Type of inference profile (e.g., SYSTEM\_DEFINED, APPLICATION) |  |

---

### Aws Bedrock Knowledge Base

`aws_bedrock_knowledge_base` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the Bedrock knowledge base |  |
| 
`displayName` \*

 | `string` | Display name of the knowledge base |  |
| 

`embeddingModelArn` \*

 | `string` **|** `null` | ARN of the embedding model used to vectorize documents |  |
| 

`failureReasons` \*

 | `array` **|** `null` | Reasons why the knowledge base failed to create or update |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether the knowledge base is in an active and usable state |  |
| 

`isOpenSearchBacked` \*

 | `boolean` **|** `null` | Whether the knowledge base uses OpenSearch Serverless as its vector store |  |
| `knowledgeBaseId` | `string` | Unique identifier for the knowledge base |  |
| 

`knowledgeBaseType` \*

 | `string` **|** `null` | Type of the knowledge base (e.g., VECTOR, KENDRA) |  |
| 

`name` \*

 | `string` | Name of the knowledge base |  |
| 

`region` \*

 | `string` | AWS region where the knowledge base is deployed |  |
| 

`roleArn` \*

 | `string` **|** `null` | ARN of the IAM role used by the knowledge base to access data sources |  |
| 

`storageConfigurationArn` \*

 | `string` **|** `null` | ARN of the vector store resource used for storage |  |
| 

`storageType` \*

 | `string` **|** `null` | Type of vector store backing the knowledge base (e.g., OPENSEARCH\_SERVERLESS, PINECONE, RDS) |  |

---

### Aws Bedrock Knowledge Base Data Source

`aws_bedrock_knowledge_base_data_source` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`chunkingStrategy` \*

 | `string` **|** `null` | Strategy used to chunk documents (e.g., FIXED\_SIZE, NONE, HIERARCHICAL) |  |
| `dataSourceId` | `string` | Unique identifier for the data source |  |
| 

`dataSourceType` \*

 | `string` **|** `null` | Type of data source (e.g., S3, WEB, CONFLUENCE) |  |
| 

`displayName` \*

 | `string` | Display name of the data source |  |
| 

`failureReason` \*

 | `string` **|** `null` | Reason why the data source failed to sync or create |  |
| 

`isS3Backed` \*

 | `boolean` **|** `null` | Whether the data source reads from an S3 bucket |  |
| 

`isWebCrawler` \*

 | `boolean` **|** `null` | Whether the data source crawls web content |  |
| `knowledgeBaseId` | `string` | ID of the parent knowledge base this data source belongs to |  |
| 

`name` \*

 | `string` | Name of the data source |  |
| 

`region` \*

 | `string` | AWS region where the data source is configured |  |
| 

`s3BucketArn` \*

 | `string` **|** `null` | ARN of the S3 bucket used as the data source |  |
| 

`s3InclusionPrefixes` \*

 | `array` **|** `null` | S3 key prefixes that scope which objects are included in the data source |  |

---

### Aws Bedrock Model Customization Job

`aws_bedrock_model_customization_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`baseModelArn` \*

 | `string` **|** `null` |  |  |
| 

`customizationType` \*

 | `string` **|** `null` |  |  |
| `endTime` | `number` |  |  |
| 

`failureMessage` \*

 | `string` **|** `null` |  |  |
| 

`jobName` \*

 | `string` **|** `null` |  |  |
| `lastModifiedOn` | `number` | Timestamp (epoch ms) when the customization job was last modified |  |
| 

`name` \*

 | `string` |  |  |
| 

`outputDataConfigS3Uri` \*

 | `string` **|** `null` |  |  |
| 

`outputModelArn` \*

 | `string` **|** `null` |  |  |
| 

`outputModelName` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`trainingDataConfigS3Uri` \*

 | `string` **|** `null` |  |  |
| 

`validationDataConfigS3Uris` \*

 | `array` **|** `null` |  |  |

---

### Aws Bedrock Model Invocation Logging

`aws_bedrock_model_invocation_logging` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cloudWatchLogGroupName` \*

 | `string` **|** `null` | Name of the CloudWatch log group receiving invocation logs |  |
| 

`isCloudWatchLoggingEnabled` \*

 | `boolean` **|** `null` | Whether model invocation logs are delivered to CloudWatch Logs |  |
| 

`isEmbeddingDataLogged` \*

 | `boolean` **|** `null` | Whether embedding data is included in invocation logs |  |
| 

`isImageDataLogged` \*

 | `boolean` **|** `null` | Whether image input and output data is included in invocation logs |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` | Whether any model invocation logging is enabled; false means no invocation data is captured |  |
| 

`isS3LoggingEnabled` \*

 | `boolean` **|** `null` | Whether model invocation logs are delivered to an S3 bucket |  |
| 

`isTextDataLogged` \*

 | `boolean` **|** `null` | Whether text input and output data is included in invocation logs |  |
| 

`region` \*

 | `string` | AWS region where logging is configured |  |
| 

`s3BucketName` \*

 | `string` **|** `null` | Name of the S3 bucket where invocation logs are stored |  |
| 

`s3KeyPrefix` \*

 | `string` **|** `null` | S3 key prefix for organizing invocation log files |  |

---

### Aws Bedrock Provisioned Throughput

`aws_bedrock_provisioned_throughput` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the provisioned throughput |  |
| 
`commitmentDuration` \*

 | `string` **|** `null` | Commitment duration for the provisioned throughput (e.g., OneMonth, SixMonths) |  |
| `commitmentExpirationTime` | `number` | Timestamp (epoch ms) when the commitment period expires |  |
| 

`desiredModelUnits` \*

 | `number` **|** `null` | Desired number of model units for the provisioned throughput |  |
| 

`displayName` \*

 | `string` | Display name of the provisioned throughput |  |
| 

`failureMessage` \*

 | `string` **|** `null` | Error message if the provisioned throughput failed to create or update |  |
| 

`foundationModelArn` \*

 | `string` **|** `null` | ARN of the underlying foundation model |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether the provisioned throughput is currently in service and accepting requests |  |
| `lastModifiedOn` | `number` | Timestamp (epoch ms) when the provisioned throughput was last modified |  |
| 

`modelArn` \*

 | `string` **|** `null` | ARN of the model associated with this provisioned throughput |  |
| 

`modelUnits` \*

 | `number` **|** `null` | Number of model units currently provisioned |  |
| 

`name` \*

 | `string` | Name of the provisioned throughput |  |
| `provisionedModelId` | `string` | Unique identifier for the provisioned model throughput |  |
| 

`region` \*

 | `string` | AWS region where the provisioned throughput is deployed |  |

---

### Aws Cloudmap Namespace

`aws_cloudmap_namespace` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`creatorRequestId` \*

 | `string` **|** `null` |  |  |
| 

`hostedZoneId` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isHttpNamespace` \*

 | `boolean` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceCount` \*

 | `number` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Aws Cloudmap Service

`aws_cloudmap_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`creatorRequestId` \*

 | `string` **|** `null` |  |  |
| 

`dnsRecordTtl` \*

 | `number` **|** `null` |  |  |
| 

`dnsRecordType` \*

 | `string` **|** `null` |  |  |
| 

`healthCheckFailureThreshold` \*

 | `number` **|** `null` |  |  |
| 

`healthCheckResourcePath` \*

 | `string` **|** `null` |  |  |
| 

`healthCheckType` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`instanceCount` \*

 | `number` **|** `null` |  |  |
| 

`isHealthCheckEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`namespaceId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`routingPolicy` \*

 | `string` **|** `null` |  |  |

---

### Aws Cloudmap Service Instance

`aws_cloudmap_service_instance` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`creatorRequestId` \*

 | `string` **|** `null` |  |  |
| 

`customAttributesCount` \*

 | `number` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`instanceId` \*

 | `string` **|** `null` |  |  |
| 

`port` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceId` \*

 | `string` |  |  |

---

### Aws Cloudwatch Log Group Metrics

`aws_cloudwatch_log_group_metrics` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`collectedOn` \*

 | `number` |  |  |
| 

`dailyDeliveryErrors` \*

 | `number` **|** `null` |  |  |
| 

`dailyDeliveryThrottling` \*

 | `number` **|** `null` |  |  |
| 

`dailyEMFParsingErrors` \*

 | `number` **|** `null` |  |  |
| 

`dailyEMFValidationErrors` \*

 | `number` **|** `null` |  |  |
| 

`dailyForwardedBytes` \*

 | `number` **|** `null` |  |  |
| 

`dailyForwardedLogEvents` \*

 | `number` **|** `null` |  |  |
| 

`dailyIncomingBytes` \*

 | `number` **|** `null` |  |  |
| 

`dailyIncomingLogEvents` \*

 | `number` **|** `null` |  |  |
| 

`dailyLogEventsWithFindings` \*

 | `number` **|** `null` |  |  |
| 

`dailyTransformationErrors` \*

 | `number` **|** `null` |  |  |
| 

`dailyTransformedBytes` \*

 | `number` **|** `null` |  |  |
| 

`dailyTransformedLogEvents` \*

 | `number` **|** `null` |  |  |
| 

`endedOn` \*

 | `number` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`logGroupName` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`period` \*

 | `number` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`startedOn` \*

 | `number` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Cloudwatch Log Metric Filter

`aws_cloudwatch_log_metric_filter` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`defaultValue` \*

 | `number` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`filterName` \*

 | `string` |  |  |
| 

`filterPattern` \*

 | `string` **|** `null` |  |  |
| 

`isApplyOnTransformedLogs` \*

 | `boolean` **|** `null` |  |  |
| 

`logGroupName` \*

 | `string` |  |  |
| 

`metricName` \*

 | `string` **|** `null` |  |  |
| 

`metricNamespace` \*

 | `string` **|** `null` |  |  |
| 

`metricTransformationCount` \*

 | `number` **|** `null` |  |  |
| 

`metricValue` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`pattern` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`unit` \*

 | `string` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Codeartifact Domain

`aws_codeartifact_domain` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The AWS account id ingesting the domain. |  |
| 

`arn` \*

 | `string` | The ARN of the domain. |  |
| 

`assetSizeBytes` \*

 | `number` **|** `null` | The total size, in bytes, of all assets in the domain. |  |
| 

`domainOwner` \*

 | `string` **|** `null` | The 12-digit account number of the AWS account that owns the domain. |  |
| 

`encryptionKeyArn` \*

 | `string` **|** `null` | The ARN of the KMS key used to encrypt assets in the domain. |  |
| 

`hasResourcePolicy` \*

 | `boolean` **|** `null` | True when a domain permissions policy is attached, false when none is attached, and null when the policy could not be read. |  |
| 

`isCrossAccountAccessAllowed` \*

 | `boolean` **|** `null` | True when the domain permissions policy grants access to a principal outside the ingesting account; false when it does not (including when no policy is attached); null when the policy could not be read. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | True when the domain permissions policy grants access to any principal; false when it does not (including when no policy is attached); null when the policy could not be read. |  |
| 

`region` \*

 | `string` | The AWS region the domain resides in. |  |
| 

`repositoryCount` \*

 | `number` **|** `null` | The number of repositories in the domain. |  |
| 

`resourcePolicyPrincipalAccountIds` \*

 | `array` **|** `null` | Distinct external account ids referenced as principals in the domain permissions policy. |  |
| 

`resourcePolicyRevision` \*

 | `string` **|** `null` | The current revision of the domain permissions policy. |  |
| 

`s3BucketArn` \*

 | `string` **|** `null` | The ARN of the S3 bucket that stores the package assets in the domain. |  |

---

### Aws Codeartifact Package

`aws_codeartifact_package` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The AWS account id ingesting the package. |  |
| 

`domainName` \*

 | `string` **|** `null` | The name of the domain that contains the package. |  |
| 

`format` \*

 | `string` | The package format (e.g. npm, pypi, maven, nuget, generic). |  |
| 

`isUpstreamAllowed` \*

 | `boolean` **|** `null` | True when package versions may be pulled from an upstream source. |  |
| 

`namespace` \*

 | `string` **|** `null` | The namespace of the package (e.g. Maven groupId or npm scope). |  |
| 

`packageName` \*

 | `string` | The name of the package. |  |
| 

`publishRestriction` \*

 | `string` **|** `null` | Whether publishing new package versions is ALLOW or BLOCK. |  |
| 

`region` \*

 | `string` | The AWS region the package resides in. |  |
| 

`repositoryName` \*

 | `string` **|** `null` | The name of the repository that contains the package. |  |
| 

`upstreamRestriction` \*

 | `string` **|** `null` | Whether pulling package versions from upstream is ALLOW or BLOCK. |  |

---

### Aws Codeartifact Package Group

`aws_codeartifact_package_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The AWS account id ingesting the package group. |  |
| 

`arn` \*

 | `string` | The ARN of the package group. |  |
| 

`contactInfo` \*

 | `string` **|** `null` | The contact information of the package group. |  |
| 

`domainName` \*

 | `string` **|** `null` | The name of the domain that contains the package group. |  |
| 

`domainOwner` \*

 | `string` **|** `null` | The 12-digit account number that owns the domain. |  |
| 

`externalUpstreamRestrictionMode` \*

 | `string` **|** `null` | The origin restriction mode (ALLOW, BLOCK, or INHERIT) for retaining package versions from external, public repositories. |  |
| 

`internalUpstreamRestrictionMode` \*

 | `string` **|** `null` | The origin restriction mode (ALLOW, BLOCK, or INHERIT) for retaining package versions from internal upstream repositories. |  |
| 

`parentPattern` \*

 | `string` **|** `null` | The pattern of the parent package group. |  |
| 

`pattern` \*

 | `string` | The pattern the package group matches. |  |
| 

`publishRestrictionMode` \*

 | `string` **|** `null` | The origin restriction mode (ALLOW, BLOCK, or INHERIT) for publishing package versions to the group. |  |
| 

`region` \*

 | `string` | The AWS region the package group resides in. |  |

---

### Aws Codeartifact Repository

`aws_codeartifact_repository` inherits from [Repository](/data-model/schemas/Repository.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The AWS account id ingesting the repository. |  |
| 

`administratorAccount` \*

 | `string` **|** `null` | The account that manages the repository. |  |
| 

`arn` \*

 | `string` | The ARN of the repository. |  |
| 

`domainName` \*

 | `string` **|** `null` | The name of the domain that contains the repository. |  |
| 

`domainOwner` \*

 | `string` **|** `null` | The 12-digit account number that owns the domain. |  |
| 

`endpointGeneric` \*

 | `string` **|** `null` | The generic endpoint URL of the repository. |  |
| 

`endpointMaven` \*

 | `string` **|** `null` | The Maven endpoint URL of the repository. |  |
| 

`endpointNpm` \*

 | `string` **|** `null` | The npm endpoint URL of the repository. |  |
| 

`endpointNuget` \*

 | `string` **|** `null` | The NuGet endpoint URL of the repository. |  |
| 

`endpointPypi` \*

 | `string` **|** `null` | The PyPI endpoint URL of the repository. |  |
| 

`externalConnectionNames` \*

 | `array` **|** `null` | The names of the external connections (e.g. public:npmjs) the repository proxies. |  |
| 

`externalConnectionStatus` \*

 | `string` **|** `null` | The status of the external connection when a single connection is configured. |  |
| 

`hasExternalConnections` \*

 | `boolean` **|** `null` | True when the repository has at least one external connection. |  |
| 

`hasResourcePolicy` \*

 | `boolean` **|** `null` | True when a repository permissions policy is attached, false when none is attached, and null when the policy could not be read. |  |
| 

`isCrossAccountAccessAllowed` \*

 | `boolean` **|** `null` | True when the repository permissions policy grants access to a principal outside the ingesting account; false when it does not (including when no policy is attached); null when the policy could not be read. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | True when the repository permissions policy grants access to any principal; false when it does not (including when no policy is attached); null when the policy could not be read. |  |
| 

`region` \*

 | `string` | The AWS region the repository resides in. |  |
| 

`resourcePolicyPrincipalAccountIds` \*

 | `array` **|** `null` | Distinct external account ids referenced as principals in the repository permissions policy. |  |
| 

`resourcePolicyRevision` \*

 | `string` **|** `null` | The current revision of the repository permissions policy. |  |
| 

`upstreamRepositoryNames` \*

 | `array` **|** `null` | The names of the upstream repositories. |  |

---

### Aws Codedeploy Application

`aws_codedeploy_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`applicationId` \*

 | `string` **|** `null` |  |  |
| 

`applicationName` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`computePlatform` \*

 | `string` **|** `null` |  |  |
| 

`gitHubAccountName` \*

 | `string` **|** `null` |  |  |
| 

`isLinkedToGitHub` \*

 | `boolean` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Codedeploy Deployment Config

`aws_codedeploy_deployment_config` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`canaryInterval` \*

 | `number` **|** `null` |  |  |
| 

`canaryPercentage` \*

 | `number` **|** `null` |  |  |
| 

`computePlatform` \*

 | `string` **|** `null` |  |  |
| 

`deploymentConfigId` \*

 | `string` **|** `null` |  |  |
| 

`deploymentConfigName` \*

 | `string` |  |  |
| 

`firstZoneMonitorDurationInSeconds` \*

 | `number` **|** `null` |  |  |
| 

`isBuiltIn` \*

 | `boolean` |  |  |
| 

`linearInterval` \*

 | `number` **|** `null` |  |  |
| 

`linearPercentage` \*

 | `number` **|** `null` |  |  |
| 

`minimumHealthyHostsPerZoneType` \*

 | `string` **|** `null` |  |  |
| 

`minimumHealthyHostsPerZoneValue` \*

 | `number` **|** `null` |  |  |
| 

`minimumHealthyHostsType` \*

 | `string` **|** `null` |  |  |
| 

`minimumHealthyHostsValue` \*

 | `number` **|** `null` |  |  |
| 

`monitorDurationInSeconds` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`trafficRoutingType` \*

 | `string` **|** `null` |  |  |

---

### Aws Codedeploy Deployment Group

`aws_codedeploy_deployment_group` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`alarmNames` \*

 | `array` **|** `null` |  |  |
| 

`applicationKey` \*

 | `string` |  |  |
| 

`applicationName` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`autoRollbackEvents` \*

 | `array` **|** `null` |  |  |
| 

`autoScalingGroups` \*

 | `array` **|** `null` |  |  |
| 

`blueGreenTerminateAction` \*

 | `string` **|** `null` |  |  |
| 

`blueGreenTerminationWaitTime` \*

 | `number` **|** `null` |  |  |
| 

`computePlatform` \*

 | `string` **|** `null` |  |  |
| 

`deploymentConfigName` \*

 | `string` **|** `null` |  |  |
| 

`deploymentGroupId` \*

 | `string` **|** `null` |  |  |
| 

`deploymentGroupName` \*

 | `string` |  |  |
| 

`deploymentOption` \*

 | `string` **|** `null` |  |  |
| 

`deploymentType` \*

 | `string` **|** `null` |  |  |
| 

`ecsClusterName` \*

 | `string` **|** `null` |  |  |
| 

`ecsServiceName` \*

 | `string` **|** `null` |  |  |
| 

`elbNames` \*

 | `array` **|** `null` |  |  |
| 

`greenFleetProvisioningAction` \*

 | `string` **|** `null` |  |  |
| 

`isAlarmsEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAutoRollbackEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isIgnorePollAlarmFailure` \*

 | `boolean` **|** `null` |  |  |
| 

`isTerminationHookEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`lastAttemptedDeploymentId` \*

 | `string` **|** `null` |  |  |
| 

`lastAttemptedDeploymentStatus` \*

 | `string` **|** `null` |  |  |
| 

`lastSuccessfulDeploymentId` \*

 | `string` **|** `null` |  |  |
| 

`lastSuccessfulDeploymentStatus` \*

 | `string` **|** `null` |  |  |
| 

`outdatedInstancesStrategy` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`targetGroupNames` \*

 | `array` **|** `null` |  |  |
| 

`triggerNames` \*

 | `array` **|** `null` |  |  |
| 

`triggerTargetArns` \*

 | `array` **|** `null` |  |  |

---

### Aws Codeguru Profiling Group

`aws_codeguru_profiling_group` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`computePlatform` \*

 | `string` **|** `null` |  |  |
| 

`isProfilingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`latestAgentPingOn` \*

 | `number` **|** `null` |  |  |
| 

`latestProfileReceivedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Codeguru Reviewer Repository Association

`aws_codeguru_reviewer_repository_association` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`associationId` \*

 | `string` **|** `null` |  |  |
| 

`connectionArn` \*

 | `string` **|** `null` |  |  |
| 

`encryptedKeyRef` \*

 | `string` **|** `null` |  |  |
| 

`encryptionOption` \*

 | `string` **|** `null` |  |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`providerType` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`s3BucketName` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`stateReason` \*

 | `string` **|** `null` |  |  |

---

### Aws Cognito Identity Pool

`aws_cognito_identity_pool` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`developerProviderName` \*

 | `null` **|** `string` |  |  |
| 

`identityPoolId` \*

 | `null` **|** `string` |  |  |
| 

`isClassicFlowAllowed` \*

 | `null` **|** `boolean` |  |  |
| 

`isUnauthenticatedIdentitiesAllowed` \*

 | `null` **|** `boolean` |  |  |
| 

`openIdConnectProviderArns` \*

 | `null` **|** `array` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`samlProviderArns` \*

 | `null` **|** `array` |  |  |

---

### Aws Cognito User Pool

`aws_cognito_user_pool` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountTakeoverHighActionEvent` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverHighActionNotify` \*

 | `null` **|** `boolean` |  |  |
| 

`accountTakeoverLowActionEvent` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverLowActionNotify` \*

 | `null` **|** `boolean` |  |  |
| 

`accountTakeoverMediumActionEvent` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverMediumActionNotify` \*

 | `null` **|** `boolean` |  |  |
| 

`accountTakeoverNotifyFrom` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverNotifyReplyTo` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverNotifySourceArn` \*

 | `null` **|** `string` |  |  |
| 

`adminCreateUserConfigAllowAdminCreateUserOnly` \*

 | `null` **|** `boolean` |  |  |
| 

`adminCreateUserConfigUnusedAccountValidityDays` \*

 | `null` **|** `number` |  |  |
| 

`arn` \*

 | `null` **|** `string` |  |  |
| 

`compromisedCredentialsEventAction` \*

 | `null` **|** `string` |  |  |
| 

`compromisedCredentialsEventFilter` \*

 | `null` **|** `array` |  |  |
| 

`customDomain` \*

 | `null` **|** `string` |  |  |
| 

`deletionProtection` \*

 | `null` **|** `string` |  |  |
| 

`deviceConfigurationChallengeRequiredOnNewDevice` \*

 | `null` **|** `boolean` |  |  |
| 

`deviceConfigurationDeviceOnlyRememberedOnUserPrompt` \*

 | `null` **|** `boolean` |  |  |
| 

`domain` \*

 | `null` **|** `string` |  |  |
| 

`emailConfigurationEmailSendingAccount` \*

 | `null` **|** `string` |  |  |
| 

`estimatedNumberOfUsers` \*

 | `null` **|** `number` |  |  |
| 

`mfaConfiguration` \*

 | `null` **|** `string` |  |  |
| 

`policiesPasswordPolicyMinimumLength` \*

 | `null` **|** `number` |  |  |
| 

`policiesPasswordPolicyRequireLowercase` \*

 | `null` **|** `boolean` |  |  |
| 

`policiesPasswordPolicyRequireNumbers` \*

 | `null` **|** `boolean` |  |  |
| 

`policiesPasswordPolicyRequireSymbols` \*

 | `null` **|** `boolean` |  |  |
| 

`policiesPasswordPolicyRequireUppercase` \*

 | `null` **|** `boolean` |  |  |
| 

`policiesPasswordPolicyTemporaryPasswordValidityDays` \*

 | `null` **|** `number` |  |  |
| 

`policiesSignInPolicyAllowedFirstAuthFactors` \*

 | `null` **|** `array` |  |  |
| 

`region` \*

 | `null` **|** `string` |  |  |
| 

`riskConfigurationLastModifiedOn` \*

 | `null` **|** `number` |  |  |
| 

`riskExceptionBlockedIPRangeList` \*

 | `null` **|** `array` |  |  |
| 

`riskExceptionSkippedIPRangeList` \*

 | `null` **|** `array` |  |  |
| 

`smsConfigurationExternalId` \*

 | `null` **|** `string` |  |  |
| 

`smsConfigurationFailure` \*

 | `null` **|** `string` |  |  |
| 

`smsConfigurationSnsCallerArn` \*

 | `null` **|** `string` |  |  |
| 

`smsConfigurationSnsRegion` \*

 | `null` **|** `string` |  |  |
| 

`userAttributeUpdateSettingsAttributesRequireVerificationBeforeUpdate` \*

 | `null` **|** `array` |  |  |
| 

`usernameConfigurationCaseSensitive` \*

 | `null` **|** `boolean` |  |  |
| 

`userPoolAddOnsAdvancedSecurityAdditionalFlowsTypeCustomAuthMode` \*

 | `null` **|** `string` |  |  |
| 

`userPoolAddOnsAdvancedSecurityMode` \*

 | `null` **|** `string` |  |  |
| 

`verificationMessageTemplateDefaultEmailOption` \*

 | `null` **|** `string` |  |  |

---

### Aws Cognito User Pool Client

`aws_cognito_user_pool_client` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessTokenValidity` | `number` |  |  |
| `accountId` | `string` |  |  |
| `allowedOAuthFlows` | `array` of `string`s |  |  |
| `allowedOAuthScopes` | `array` of `string`s |  |  |
| `analyticsConfigurationApplicationId` | `string` |  |  |
| `analyticsConfigurationExternalId` | `string` |  |  |
| `analyticsConfigurationRoleArn` | `string` |  |  |
| `authSessionValidity` | `number` |  |  |
| `callbackURLs` | `array` of `string`s |  |  |
| `clientSecret` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `defaultRedirectURI` | `string` |  |  |
| `explicitAuthFlows` | `array` of `string`s |  |  |
| 
`id` \*

 | `string` |  |  |
| `idTokenValidity` | `number` |  |  |
| `isAnalyticsConfigurationUserDataShared` | `boolean` |  |  |
| `isOAuthFlowsUserPoolClientAllowed` | `boolean` |  |  |
| `isPropagateAdditionalUserContextDataEnabled` | `boolean` |  |  |
| `isTokenRevocationEnabled` | `boolean` |  |  |
| `lastModifiedOn` | `number` |  |  |
| `logoutURLs` | `array` of `string`s |  |  |
| `preventUserExistenceErrors` | `string` |  |  |
| `readAttributes` | `array` of `string`s |  |  |
| `refreshTokenValidity` | `number` |  |  |
| 

`region` \*

 | `string` |  |  |
| `supportedIdentityProviders` | `array` of `string`s |  |  |
| `tokenValidityUnitsAccessToken` | `string` |  |  |
| `tokenValidityUnitsIdToken` | `string` |  |  |
| `tokenValidityUnitsRefreshToken` | `string` |  |  |
| `userPoolId` | `string` |  |  |
| `writeAttributes` | `array` of `string`s |  |  |

---

### Aws Cognito User Pool User

`aws_cognito_user_pool_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdOn` | `number` |  |  |
| `isEnabled` | `boolean` |  |  |
| `lastModifiedOn` | `number` |  |  |
| `mfaDeilveryMediums` | `array` of `string`s |  |  |
| `mfaDeliveryAttributes` | `array` of `string`s |  |  |
| 
`region` \*

 | `string` |  |  |
| `userStatus` | `string` |  |  |

---

### Aws Config Rule Finding

`aws_config_rule_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`annotation` \*

 | `string` **|** `null` |  |  |
| 

`configRuleArn` \*

 | `string` **|** `null` |  |  |
| 

`configRuleInvokedOn` \*

 | `number` **|** `null` |  |  |
| 

`configRuleName` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceArn` \*

 | `string` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceType` \*

 | `string` |  |  |
| 

`resultRecordedOn` \*

 | `number` **|** `null` |  |  |

---

### Aws Datasync Location

`aws_datasync_location` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`efsFileSystemArn` \*

 | `null` **|** `string` |  |  |
| 

`fsxFileSystemArn` \*

 | `null` **|** `string` |  |  |
| 

`isEfsLocation` \*

 | `null` **|** `boolean` |  |  |
| 

`isFsxLocation` \*

 | `null` **|** `boolean` |  |  |
| 

`isOnPremisesLocation` \*

 | `null` **|** `boolean` |  |  |
| 

`isS3Location` \*

 | `null` **|** `boolean` |  |  |
| 

`locationType` \*

 | `string` |  |  |
| 

`locationUri` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`s3BucketAccessRoleArn` \*

 | `null` **|** `string` |  |  |

---

### Aws Datasync Task

`aws_datasync_task` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`cloudWatchLogGroupArn` \*

 | `null` **|** `string` |  |  |
| 

`createdOn` \*

 | `number` |  |  |
| 

`currentTaskExecutionArn` \*

 | `null` **|** `string` |  |  |
| 

`destinationLocationArn` \*

 | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isCloudWatchLoggingEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`isScheduled` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`overwriteMode` \*

 | `null` **|** `string` |  |  |
| 

`posixPermissions` \*

 | `null` **|** `string` |  |  |
| 

`preserveDeletedFiles` \*

 | `null` **|** `string` |  |  |
| 

`preserveDevices` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`securityDescriptorCopyFlags` \*

 | `null` **|** `array` |  |  |
| 

`sourceLocationArn` \*

 | `string` |  |  |
| 

`transferMode` \*

 | `null` **|** `string` |  |  |
| 

`verifyMode` \*

 | `null` **|** `string` |  |  |
| 

`webLink` \*

 | `string` |  |  |

---

### Aws Dedicated Host

`aws_dedicated_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allocatedOn` | `number` |  |  |
| `allowsMultipleInstanceTypes` | `string` |  | **Any of**:
-   `off`

-   `on`

 |
| `assetId` | `string` |  |  |
| `autoPlacement` | `string` |  | **Any of**:

-   `off`

-   `on`

 |
| `availabilityZone` | `string` |  |  |
| `cores` | `number` |  |  |
| `hostId` | `string` |  |  |
| `hostMaintenance` | `string` |  | **Any of**:

-   `off`

-   `on`

 |
| `hostRecovery` | `string` |  | **Any of**:

-   `off`

-   `on`

 |
| `hostReservationId` | `string` |  |  |
| `instanceFamily` | `string` |  |  |
| `instanceType` | `string` |  |  |
| `memberOfServiceLinkedResourceGroup` | `boolean` |  |  |
| `outpostArn` | `string` |  |  |
| `ownerId` | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| `releasedOn` | `number` |  |  |
| `sockets` | `number` |  |  |
| `state` | `string` |  | **Any of**:

-   `available`

-   `pending`

-   `permanent-failure`

-   `released`

-   `released-permanent-failure`

-   `under-assessment`

 |
| `totalVCpus` | `number` |  |  |

---

### Aws Devops Guru Anomaly

`aws_devops_guru_anomaly` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`anomalyEndedOn` \*

 | `number` **|** `null` |  |  |
| 

`anomalyId` \*

 | `string` |  |  |
| 

`anomalyReportedEndedOn` \*

 | `number` **|** `null` |  |  |
| 

`anomalyReportedStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`anomalyStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`anomalyType` \*

 | `string` **|** `null` |  |  |
| 

`associatedInsightId` \*

 | `string` **|** `null` |  |  |
| 

`limitValue` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`sourceResourceName` \*

 | `string` **|** `null` |  |  |
| 

`sourceResourceType` \*

 | `string` **|** `null` |  |  |
| 

`sourceService` \*

 | `string` **|** `null` |  |  |
| 

`stackNames` \*

 | `array` **|** `null` |  |  |

---

### Aws Devops Guru Insight

`aws_devops_guru_insight` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`associatedResourceArns` \*

 | `array` **|** `null` |  |  |
| 

`insightEndedOn` \*

 | `number` **|** `null` |  |  |
| 

`insightId` \*

 | `string` |  |  |
| 

`insightStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`insightType` \*

 | `string` **|** `null` |  |  |
| 

`predictionEndedOn` \*

 | `number` **|** `null` |  |  |
| 

`predictionStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceNames` \*

 | `array` **|** `null` |  |  |
| 

`stackNames` \*

 | `array` **|** `null` |  |  |

---

### Aws Devops Guru Notification Channel

`aws_devops_guru_notification_channel` inherits from [Channel](/data-model/schemas/Channel.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`channelId` \*

 | `string` |  |  |
| 

`messageTypes` \*

 | `array` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`severities` \*

 | `array` **|** `null` |  |  |
| 

`snsTopicArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Elasticsearch Domain

`aws_elasticsearch_domain` inherits from [Database](/data-model/schemas/Database.md), [DataStore](/data-model/schemas/DataStore.md), [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessPolicies` \*

 | `string` **|** `null` | Raw JSON string of the IAM resource-based access policy attached to the Elasticsearch domain. |  |
| 

`atRestEncryptionEnabled` \*

 | `boolean` **|** `null` | Deprecated. Whether encryption at rest is enabled. Use encryptedAtRest instead. | **deprecated**: true |
| 

`encryptionAtRestKmsKeyId` \*

 | `string` **|** `null` | Identifier of the AWS KMS key used to encrypt data at rest in the Elasticsearch domain. May be a key ID, alias, or ARN depending on how the domain was configured. |  |
| 

`isAppLoggingEnabled` \*

 | `boolean` **|** `null` | Whether application log (ES\_APPLICATION\_LOGS) publishing to CloudWatch Logs is enabled. |  |
| 

`isAuditLoggingEnabled` \*

 | `boolean` **|** `null` | Whether audit log (AUDIT\_LOGS) publishing to CloudWatch Logs is enabled for this domain. |  |
| 

`isSlowIndexLoggingEnabled` \*

 | `boolean` **|** `null` | Whether slow index log (INDEX\_SLOW\_LOGS) publishing to CloudWatch Logs is enabled. |  |
| 

`region` \*

 | `string` | The AWS region the Elasticsearch domain resides in. |  |
| 

`transitEncryptionEnabled` \*

 | `boolean` **|** `null` | Deprecated. Whether node-to-node (in-transit) encryption is enabled. Use encryptedInTransit instead. | **deprecated**: true |

---

### Aws Emr Security Configuration

`aws_emr_security_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | Synthesized ARN of the EMR security configuration (also the entity \_key). |  |
| 

`isAtRestEncryptionEnabled` \*

 | `boolean` | Whether at-rest encryption is enabled. |  |
| 

`isEncryptionConfigured` \*

 | `boolean` | Whether an encryption configuration block is present. |  |
| 

`isInTransitEncryptionEnabled` \*

 | `boolean` | Whether in-transit encryption is enabled. |  |
| 

`isKerberosConfigured` \*

 | `boolean` | Whether Kerberos authentication is configured. |  |
| 

`isKerberosCrossRealmTrustConfigured` \*

 | `boolean` | Whether a cross-realm trust is configured (presence only). |  |
| 

`isLocalDiskEbsEncryptionEnabled` \*

 | `boolean` | Whether EBS encryption is enabled for local disks. |  |
| 

`isLocalDiskEncryptionConfigured` \*

 | `boolean` | Whether a local-disk encryption block is present. |  |
| 

`isSecureNamespaceConfigured` \*

 | `boolean` | Whether Lake Formation secure-namespace info is present. |  |
| 

`isTlsCertificateConfigured` \*

 | `boolean` | Whether an in-transit TLS certificate configuration is present. |  |
| 

`kerberosADDomainJoinUser` \*

 | `string` **|** `null` | Active Directory domain-join user for Kerberos. |  |
| 

`kerberosProvider` \*

 | `string` **|** `null` | Kerberos provider (ClusterDedicatedKdc, ExternalKdc). |  |
| 

`kerberosRealm` \*

 | `string` **|** `null` | Kerberos realm. |  |
| 

`lakeFormationQueryEngineRoleArn` \*

 | `string` **|** `null` | IAM role ARN used by the Lake Formation query engine. |  |
| 

`localDiskEncryptionAwsKmsKeyArn` \*

 | `string` **|** `null` | KMS key ARN used for local-disk encryption, if any. |  |
| 

`localDiskEncryptionKeyProviderType` \*

 | `string` **|** `null` | Local-disk encryption key provider type. |  |
| 

`region` \*

 | `string` | AWS region the security configuration was ingested from. |  |
| 

`s3EncryptionAwsKmsKeyArn` \*

 | `string` **|** `null` | KMS key ARN used for S3 encryption, if any. |  |
| 

`s3EncryptionKeyProviderType` \*

 | `string` **|** `null` | S3 encryption key provider type (AWS\_KMS, SERVICE\_DEFAULT). |  |
| 

`s3EncryptionMode` \*

 | `string` **|** `null` | S3 encryption mode (SSE-S3, SSE-KMS, CSE-KMS, CSE-Custom). |  |
| 

`secureNamespaceClusterId` \*

 | `string` **|** `null` | ID of the EKS cluster backing the Lake Formation secure namespace (EMR on EKS). |  |
| 

`secureNamespaceName` \*

 | `string` **|** `null` | Lake Formation secure namespace name. |  |
| 

`tlsCertificateProviderType` \*

 | `string` **|** `null` | TLS certificate provider type (PEM, Custom). |  |
| 

`tlsPrivateCertificateSecretArn` \*

 | `string` **|** `null` | Secrets Manager ARN of the private TLS certificate. |  |
| 

`tlsPublicCertificateSecretArn` \*

 | `string` **|** `null` | Secrets Manager ARN of the public TLS certificate. |  |

---

### Aws Emr Serverless Application

`aws_emr_serverless_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationId` \*

 | `string` |  |  |
| 

`applicationType` \*

 | `string` |  |  |
| 

`architecture` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`autoStopIdleTimeoutMinutes` \*

 | `number` **|** `null` |  |  |
| 

`cloudWatchLoggingEncryptionKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`cloudWatchLogGroupName` \*

 | `string` **|** `null` |  |  |
| 

`encryptedKeyRef` \*

 | `string` **|** `null` |  |  |
| 

`isAutoStartEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAutoStopEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCloudWatchLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` |  |  |
| 

`isLivyEndpointEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isManagedPersistenceEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isStudioEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`managedPersistenceEncryptionKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`maximumCapacityCpu` \*

 | `string` **|** `null` |  |  |
| 

`maximumCapacityDisk` \*

 | `string` **|** `null` |  |  |
| 

`maximumCapacityMemory` \*

 | `string` **|** `null` |  |  |
| 

`networkSecurityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`networkSubnetIds` \*

 | `array` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`releaseLabel` \*

 | `string` |  |  |
| 

`s3MonitoringEncryptionKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`s3MonitoringLogUri` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` |  |  |
| 

`stateDetails` \*

 | `string` **|** `null` |  |  |

---

### Aws Fsx File System

`aws_fsx_file_system` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `null` **|** `string` |  |  |
| 

`createdOn` \*

 | `null` **|** `number` |  |  |
| 

`dnsName` \*

 | `null` **|** `string` |  |  |
| 

`fileSystemType` \*

 | `null` **|** `string` |  |  |
| 

`fileSystemTypeVersion` \*

 | `null` **|** `string` |  |  |
| 

`id` \*

 | `null` **|** `string` |  |  |
| 

`kmsKeyId` \*

 | `null` **|** `string` |  |  |
| 

`lifecycle` \*

 | `null` **|** `string` |  |  |
| 

`lustreAutomaticBackupRetentionDays` \*

 | `null` **|** `number` |  |  |
| 

`lustreDailyAutomaticBackupStartTime` \*

 | `null` **|** `string` |  |  |
| 

`lustreDataCompressionType` \*

 | `null` **|** `string` |  |  |
| 

`lustreDeploymentType` \*

 | `null` **|** `string` |  |  |
| 

`lustreDriveCacheType` \*

 | `null` **|** `string` |  |  |
| 

`lustreIsCopyingTagsToBackups` \*

 | `null` **|** `boolean` |  |  |
| 

`lustreIsEfaEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`lustreMountName` \*

 | `null` **|** `string` |  |  |
| 

`lustrePerUnitStorageThroughput` \*

 | `null` **|** `number` |  |  |
| 

`lustreWeeklyMaintenanceStartTime` \*

 | `null` **|** `string` |  |  |
| 

`networkInterfaceIds` \*

 | `null` **|** `array` |  |  |
| 

`ontapAutomaticBackupRetentionDays` \*

 | `null` **|** `number` |  |  |
| 

`ontapDailyAutomaticBackupStartTime` \*

 | `null` **|** `string` |  |  |
| 

`ontapDeploymentType` \*

 | `null` **|** `string` |  |  |
| 

`ontapEndpointIpAddressRange` \*

 | `null` **|** `string` |  |  |
| 

`ontapHAPairs` \*

 | `null` **|** `number` |  |  |
| 

`ontapPreferredSubnetId` \*

 | `null` **|** `string` |  |  |
| 

`ontapRouteTableIds` \*

 | `null` **|** `array` |  |  |
| 

`ontapThroughputCapacity` \*

 | `null` **|** `number` |  |  |
| 

`ontapThroughputCapacityPerHAPair` \*

 | `null` **|** `number` |  |  |
| 

`ontapWeeklyMaintenanceStartTime` \*

 | `null` **|** `string` |  |  |
| 

`openzfsAutomaticBackupRetentionDays` \*

 | `null` **|** `number` |  |  |
| 

`openzfsDailyAutomaticBackupStartTime` \*

 | `null` **|** `string` |  |  |
| 

`openzfsDeploymentType` \*

 | `null` **|** `string` |  |  |
| 

`openzfsEndpointIpAddress` \*

 | `null` **|** `string` |  |  |
| 

`openzfsEndpointIpAddressRange` \*

 | `null` **|** `string` |  |  |
| 

`openzfsIsCopyingTagsToBackups` \*

 | `null` **|** `boolean` |  |  |
| 

`openzfsIsCopyingTagsToVolumes` \*

 | `null` **|** `boolean` |  |  |
| 

`openzfsPreferredSubnetId` \*

 | `null` **|** `string` |  |  |
| 

`openzfsRootVolumeId` \*

 | `null` **|** `string` |  |  |
| 

`openzfsRouteTableIds` \*

 | `null` **|** `array` |  |  |
| 

`openzfsThroughputCapacity` \*

 | `null` **|** `number` |  |  |
| 

`openzfsWeeklyMaintenanceStartTime` \*

 | `null` **|** `string` |  |  |
| 

`ownerId` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `null` **|** `string` |  |  |
| 

`storageCapacity` \*

 | `null` **|** `number` |  |  |
| 

`storageType` \*

 | `null` **|** `string` |  |  |
| 

`subnetIds` \*

 | `null` **|** `array` |  |  |
| 

`vpcId` \*

 | `null` **|** `string` |  |  |
| 

`windowsActiveDirectoryId` \*

 | `null` **|** `string` |  |  |
| 

`windowsAutomaticBackupRetentionDays` \*

 | `null` **|** `number` |  |  |
| 

`windowsDailyAutomaticBackupStartTime` \*

 | `null` **|** `string` |  |  |
| 

`windowsDeploymentType` \*

 | `null` **|** `string` |  |  |
| 

`windowsIsCopyingTagsToBackups` \*

 | `null` **|** `boolean` |  |  |
| 

`windowsPreferredFileServerIp` \*

 | `null` **|** `string` |  |  |
| 

`windowsPreferredSubnetId` \*

 | `null` **|** `string` |  |  |
| 

`windowsRemoteAdministrationEndpoint` \*

 | `null` **|** `string` |  |  |
| 

`windowsThroughputCapacity` \*

 | `null` **|** `number` |  |  |
| 

`windowsWeeklyMaintenanceStartTime` \*

 | `null` **|** `string` |  |  |

---

### Aws Grafana Workspace

`aws_grafana_workspace` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountAccessType` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`authenticationProviders` \*

 | `array` **|** `null` |  |  |
| 

`dataSources` \*

 | `array` **|** `null` |  |  |
| 

`endpoint` \*

 | `string` **|** `null` |  |  |
| 

`freeTrialExpirationOn` \*

 | `number` **|** `null` |  |  |
| 

`grafanaToken` \*

 | `string` **|** `null` |  |  |
| 

`grafanaVersion` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isEncrypted` \*

 | `boolean` |  |  |
| 

`isFreeTrialConsumed` \*

 | `boolean` **|** `null` |  |  |
| 

`isNetworkAccessRestricted` \*

 | `boolean` **|** `null` |  |  |
| 

`licenseExpirationOn` \*

 | `number` **|** `null` |  |  |
| 

`licenseType` \*

 | `string` **|** `null` |  |  |
| 

`modifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`networkAccessPrefixListIds` \*

 | `array` **|** `null` |  |  |
| 

`networkAccessVpceIds` \*

 | `array` **|** `null` |  |  |
| 

`notificationDestinations` \*

 | `array` **|** `null` |  |  |
| 

`organizationalUnits` \*

 | `array` **|** `null` |  |  |
| 

`organizationRoleName` \*

 | `string` **|** `null` |  |  |
| 

`permissionType` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`samlConfigurationStatus` \*

 | `string` **|** `null` |  |  |
| 

`stackSetName` \*

 | `string` **|** `null` |  |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`vpcSubnetIds` \*

 | `array` **|** `null` |  |  |
| 

`webLink` \*

 | `string` |  |  |
| 

`workspaceId` \*

 | `string` **|** `null` |  |  |
| 

`workspaceRoleArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Guardduty Publishing Destination

`aws_guardduty_publishing_destination` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`destinationArn` \*

 | `string` **|** `null` | ARN of the S3 bucket/folder receiving exported findings. |  |
| 

`destinationId` \*

 | `string` | Identifier of the export destination. |  |
| 

`destinationType` \*

 | `string` **|** `null` | Export target type (currently only S3). |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether exported findings are encrypted with a KMS key (KmsKeyArn present). |  |
| 

`isPublishing` \*

 | `boolean` **|** `null` | Whether the export is actively publishing (Status === PUBLISHING). |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key encrypting exported findings (kept as a flat property in addition to the USES relationship, an intentional ADR-005 exception mirroring inspectorv2 kmsKeyId). |  |
| 

`publishingFailureStartedOn` \*

 | `number` **|** `null` | Epoch ms at which GuardDuty first failed to publish to this destination; non-null indicates an active export failure. |  |
| 

`region` \*

 | `string` | AWS region of the publishing destination. |  |

---

### Aws Iam Roles Anywhere Profile

`aws_iam_roles_anywhere_profile` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`durationSeconds` \*

 | `number` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isInstancePropertiesRequired` \*

 | `boolean` **|** `null` |  |  |
| 

`isRoleSessionNameAccepted` \*

 | `boolean` **|** `null` |  |  |
| 

`managedPolicyArns` \*

 | `array` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArns` \*

 | `array` **|** `null` |  |  |
| 

`sessionPolicy` \*

 | `string` **|** `null` |  |  |
| 

`updatedOn` \*

 | `number` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Iam Roles Anywhere Trust Anchor

`aws_iam_roles_anywhere_trust_anchor` inherits from [Certificate](/data-model/schemas/Certificate.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`areNotificationsEnabled` \*

 | `boolean` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`notificationChannels` \*

 | `array` **|** `null` |  |  |
| 

`notificationEvents` \*

 | `array` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`sourceAcmPcaArn` \*

 | `string` **|** `null` |  |  |
| 

`sourceType` \*

 | `string` **|** `null` |  |  |
| 

`updatedOn` \*

 | `number` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Imagebuilder Component

`aws_imagebuilder_component` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the component. |  |
| 

`arn` \*

 | `string` | The ARN of the Image Builder component. |  |
| 

`changeDescription` \*

 | `string` **|** `null` | The change description of the component for this version. |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the component document is encrypted at rest using a customer-managed KMS key. |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | The KMS key ID used to encrypt the component. |  |
| 

`platform` \*

 | `string` **|** `null` | The platform the component supports (Windows or Linux). |  |
| 

`region` \*

 | `string` | AWS region where the component is defined. |  |
| 

`supportedOsVersions` \*

 | `array` **|** `null` | The operating system versions the component supports. |  |
| 

`type` \*

 | `string` **|** `null` | The type of the component (BUILD or TEST). |  |
| 

`version` \*

 | `string` **|** `null` | The version of the component. |  |

---

### Aws Imagebuilder Container Recipe

`aws_imagebuilder_container_recipe` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the recipe. |  |
| 

`arn` \*

 | `string` | The ARN of the container recipe. |  |
| 

`componentArns` \*

 | `array` **|** `null` | ARNs of the components included in the recipe. |  |
| 

`componentCount` \*

 | `number` **|** `null` | The number of components in the recipe. |  |
| 

`containerType` \*

 | `string` **|** `null` | The type of container produced by the recipe (DOCKER). |  |
| 

`isDockerfileTemplatePresent` \*

 | `boolean` **|** `null` | Whether a Dockerfile template is present in the recipe. |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | KMS key ID used to encrypt the container recipe. |  |
| 

`parentImage` \*

 | `string` **|** `null` | The base image used for the container recipe. |  |
| 

`platform` \*

 | `string` **|** `null` | The platform for the container recipe (Linux or Windows). |  |
| 

`region` \*

 | `string` | AWS region where the recipe is defined. |  |
| 

`targetRepositoryName` \*

 | `string` **|** `null` | The name of the target repository for the container image. |  |
| 

`targetRepositoryService` \*

 | `string` **|** `null` | The service for the target repository (ECR or other). |  |
| 

`version` \*

 | `string` **|** `null` | The version of the container recipe. |  |
| 

`workingDirectory` \*

 | `string` **|** `null` | The working directory used during container image builds. |  |

---

### Aws Imagebuilder Distribution Configuration

`aws_imagebuilder_distribution_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the configuration. |  |
| 

`amiDistributionKmsKeyIds` \*

 | `array` **|** `null` | KMS key IDs used to encrypt distributed AMIs, aggregated across all distributions. |  |
| 

`amiDistributionLaunchPermissionGroupNames` \*

 | `array` **|** `null` | Group names granted launch permission on distributed AMIs. |  |
| 

`amiDistributionLaunchPermissionOrganizationArns` \*

 | `array` **|** `null` | Organization ARNs granted launch permission on distributed AMIs. |  |
| 

`amiDistributionLaunchPermissionUserIds` \*

 | `array` **|** `null` | User IDs granted launch permission on distributed AMIs. |  |
| 

`amiDistributionTargetAccountIds` \*

 | `array` **|** `null` | Target AWS account IDs for AMI distribution. |  |
| 

`arn` \*

 | `string` | The ARN of the distribution configuration. |  |
| 

`containerDistributionTargetAccountIds` \*

 | `array` **|** `null` | Target account IDs for container image distribution. Always null — the SDK does not expose container cross-account sharing (governed by ECR repository policy). |  |
| 

`containerDistributionTargetRepositoryNames` \*

 | `array` **|** `null` | Target repository names for container image distribution, aggregated across all distributions. |  |
| 

`distributionRegions` \*

 | `array` **|** `null` | The AWS regions where images are distributed. |  |
| 

`isSharedCrossAccount` \*

 | `boolean` | Whether any distributed AMI is shared with specific AWS accounts, users, or organizations (distinct from public exposure). |  |
| 

`public` \*

 | `boolean` | Whether any distributed AMI is shared publicly (launchPermission grants the reserved `all` group). |  |
| 

`region` \*

 | `string` | AWS region where the configuration is defined. |  |

---

### Aws Imagebuilder Image

`aws_imagebuilder_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the image. |  |
| 

`arn` \*

 | `string` | The ARN of the Image Builder image build version. |  |
| 

`containerRecipeArn` \*

 | `string` **|** `null` | ARN of the container recipe used to build this image. |  |
| 

`distributionConfigurationArn` \*

 | `string` **|** `null` | ARN of the distribution configuration used for this image. |  |
| 

`ebsKmsKeyIds` \*

 | `array` **|** `null` | KMS key IDs used for EBS block device encryption, collected across every mapped device in the image recipe or container recipe instance configuration. Values may be a key ARN or an alias. Null when no mapped device names a key. |  |
| 

`imageRecipeArn` \*

 | `string` **|** `null` | ARN of the image recipe used to build this image. |  |
| 

`infrastructureConfigurationArn` \*

 | `string` **|** `null` | ARN of the infrastructure configuration used to build this image. |  |
| 

`isEbsEncrypted` \*

 | `boolean` **|** `null` | True when every EBS block device mapped by the build instance declares encryption. Collected from the image recipe (AMI images) or the container recipe instance configuration (container images). Null when the image maps no EBS devices. |  |
| 

`isImageScanningEnabled` \*

 | `boolean` **|** `null` | Whether image scanning was enabled for this build. |  |
| 

`isImageTestsEnabled` \*

 | `boolean` **|** `null` | Whether image tests were enabled for this build. |  |
| 

`osVersion` \*

 | `string` **|** `null` | The OS version of the image. |  |
| 

`outputResourcesAmiIds` \*

 | `array` **|** `null` | AMI IDs produced as output resources. |  |
| 

`outputResourcesContainerImages` \*

 | `array` **|** `null` | Container image URIs produced as output resources. |  |
| 

`platform` \*

 | `string` **|** `null` | The platform of the image (Windows or Linux). |  |
| 

`region` \*

 | `string` | AWS region where the image was built. |  |
| 

`sourcePipelineArn` \*

 | `string` **|** `null` | ARN of the pipeline that created this image, if pipeline-created. |  |
| 

`state` \*

 | `string` **|** `null` | The current build state of the image (from state.status). |  |
| 

`stateReason` \*

 | `string` **|** `null` | The reason for the current state. |  |
| 

`type` \*

 | `string` **|** `null` | The type of image output (AMI or DOCKER). |  |
| 

`version` \*

 | `string` **|** `null` | The semantic version of the image. |  |

---

### Aws Imagebuilder Image Pipeline

`aws_imagebuilder_image_pipeline` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the pipeline. |  |
| 

`arn` \*

 | `string` | The ARN of the image pipeline. |  |
| 

`containerRecipeArn` \*

 | `string` **|** `null` | ARN of the container recipe used by this pipeline (container pipelines). |  |
| 

`distributionConfigurationArn` \*

 | `string` **|** `null` | ARN of the distribution configuration used by this pipeline. |  |
| 

`executionRoleArn` \*

 | `string` **|** `null` | ARN of the IAM role used to execute the pipeline. |  |
| 

`imageRecipeArn` \*

 | `string` **|** `null` | ARN of the image recipe used by this pipeline (AMI pipelines). |  |
| 

`imageTestsConfigurationTimeoutMinutes` \*

 | `number` **|** `null` | The timeout in minutes for image tests. |  |
| 

`infrastructureConfigurationArn` \*

 | `string` **|** `null` | ARN of the infrastructure configuration used by this pipeline. |  |
| 

`isEnhancedImageMetadataEnabled` \*

 | `boolean` **|** `null` | Whether enhanced image metadata is enabled for the pipeline. |  |
| 

`isImageScanningConfigurationEnabled` \*

 | `boolean` **|** `null` | Whether image scanning is enabled for this pipeline. |  |
| 

`isImageTestsConfigurationEnabled` \*

 | `boolean` **|** `null` | Whether image tests are enabled for this pipeline. |  |
| 

`lastRunOn` \*

 | `number` **|** `null` | Timestamp of the last pipeline execution. |  |
| 

`nextRunOn` \*

 | `number` **|** `null` | Timestamp of the next scheduled pipeline execution. |  |
| 

`platform` \*

 | `string` **|** `null` | The platform of the pipeline (Windows or Linux). |  |
| 

`region` \*

 | `string` | AWS region where the pipeline is defined. |  |
| 

`scheduleExpression` \*

 | `string` **|** `null` | The cron expression for the pipeline schedule. |  |
| 

`schedulePipelineExecutionStartCondition` \*

 | `string` **|** `null` | The condition under which the scheduled pipeline runs. |  |
| 

`scheduleTimezone` \*

 | `string` **|** `null` | The timezone for the schedule. |  |

---

### Aws Imagebuilder Infrastructure Configuration

`aws_imagebuilder_infrastructure_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the configuration. |  |
| 

`arn` \*

 | `string` | The ARN of the infrastructure configuration. |  |
| 

`iamInstanceProfileName` \*

 | `string` **|** `null` | The IAM instance profile name attached to the build instance. |  |
| 

`instanceMetadataHttpPutResponseHopLimit` \*

 | `number` **|** `null` | The HTTP PUT response hop limit for IMDSv2. |  |
| 

`instanceMetadataHttpTokens` \*

 | `string` **|** `null` | IMDSv2 token requirement setting (required or optional). |  |
| 

`instanceTypes` \*

 | `array` **|** `null` | The instance types used for the build EC2 instance. |  |
| 

`isTerminateInstanceOnFailure` \*

 | `boolean` **|** `null` | Whether to terminate the build instance on failure. |  |
| 

`keyPair` \*

 | `string` **|** `null` | The EC2 key pair name used for the build instance. |  |
| 

`region` \*

 | `string` | AWS region where the configuration is defined. |  |
| 

`s3LogsBucketName` \*

 | `string` **|** `null` | S3 bucket name for storing build logs. |  |
| 

`s3LogsKeyPrefix` \*

 | `string` **|** `null` | S3 key prefix for build log files. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Security group IDs attached to the build EC2 instance. |  |
| 

`snsTopicArn` \*

 | `string` **|** `null` | ARN of the SNS topic for build notifications. |  |
| 

`subnetId` \*

 | `string` **|** `null` | The subnet ID where the build instance runs. |  |

---

### Aws Imagebuilder Lifecycle Policy

`aws_imagebuilder_lifecycle_policy` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the policy. |  |
| 

`arn` \*

 | `string` | The ARN of the lifecycle policy. |  |
| 

`executionRoleArn` \*

 | `string` **|** `null` | ARN of the IAM role used to execute lifecycle actions. |  |
| 

`lastRunOn` \*

 | `number` **|** `null` | Timestamp of the last policy execution. |  |
| 

`policyDetailActionType` \*

 | `string` **|** `null` | The action type from the first policy detail (DELETE, DEPRECATE, or DISABLE). |  |
| 

`policyDetailFilterType` \*

 | `string` **|** `null` | The filter type from the first policy detail (AGE or COUNT). |  |
| 

`policyDetailFilterUnit` \*

 | `string` **|** `null` | The filter unit from the first policy detail (DAYS, WEEKS, MONTHS, or YEARS). |  |
| 

`policyDetailFilterValue` \*

 | `number` **|** `null` | The filter threshold value from the first policy detail. |  |
| 

`policyDetailRetentionAtLeastCount` \*

 | `number` **|** `null` | The minimum number of images to retain per the first policy detail. |  |
| 

`region` \*

 | `string` | AWS region where the policy is defined. |  |
| 

`resourceType` \*

 | `string` **|** `null` | The type of resource the policy applies to (AMI\_IMAGE or CONTAINER\_IMAGE). |  |

---

### Aws Imagebuilder Workflow

`aws_imagebuilder_workflow` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the workflow. |  |
| 

`arn` \*

 | `string` | The ARN of the Image Builder workflow. |  |
| 

`changeDescription` \*

 | `string` **|** `null` | The change description for this workflow version. |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | KMS key ID used to encrypt the workflow. |  |
| 

`region` \*

 | `string` | AWS region where the workflow is defined. |  |
| 

`type` \*

 | `string` **|** `null` | The type of the workflow (BUILD, TEST, or DISTRIBUTION). |  |
| 

`version` \*

 | `string` **|** `null` | The version of the workflow. |  |
| 

`workflowState` \*

 | `string` **|** `null` | The current state status of the workflow (from state.status). |  |

---

### Aws Inspector Finding

`aws_inspector_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `id` | `string` |  |  |

---

### Aws Inspector Finding

`aws_inspector_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `id` | `string` |  |  |

---

### Aws Inspectorv2 Configuration

`aws_inspectorv2_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`ec2ScanMode` \*

 | `string` **|** `null` | EC2 automated scan mode (EC2\_HYBRID or EC2\_SSM\_AGENT\_BASED). |  |
| 

`ec2ScanModeStatus` \*

 | `string` **|** `null` | Status of the EC2 scan mode setting (PENDING/SUCCESS). |  |
| 

`ecrPullDateRescanDuration` \*

 | `string` **|** `null` | ECR re-scan duration measured from image pull date (e.g. DAYS\_30). |  |
| 

`ecrPullDateRescanMode` \*

 | `string` **|** `null` | ECR pull-date re-scan mode. |  |
| 

`ecrRescanDuration` \*

 | `string` **|** `null` | ECR automated re-scan duration (e.g. DAYS\_30, LIFETIME). |  |
| 

`ecrRescanDurationStatus` \*

 | `string` **|** `null` | Status of changes to the ECR re-scan duration (FAILED/PENDING/SUCCESS). |  |
| 

`ecrRescanDurationUpdatedOn` \*

 | `number` **|** `null` | When the ECR re-scan duration setting was last changed (epoch ms). |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt Inspector Lambda code scan data in this region (the only scan type that supports a customer-managed key; absent when using an AWS-owned key). |  |
| 

`region` \*

 | `string` | The AWS region this configuration applies to. |  |

---

### Aws Inspectorv2 Filter

`aws_inspectorv2_filter` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `string` **|** `null` | The action applied to findings that match the filter (NONE or SUPPRESS). |  |
| 

`arn` \*

 | `string` | The Amazon Resource Number (ARN) associated with this filter. |  |
| 

`criteriaFields` \*

 | `array` **|** `null` | The names of the FilterCriteria fields that are populated on this filter (e.g. "severity", "resourceType"). Only the field names are captured, not their matched values, so this indicates which dimensions the filter constrains but not the specific values it matches or suppresses. |  |
| 

`ownerId` \*

 | `string` **|** `null` | The AWS account ID of the account that created the filter. |  |
| 

`reason` \*

 | `string` **|** `null` | The reason for the filter. |  |
| 

`region` \*

 | `string` **|** `null` | The AWS region the filter was read from. |  |

---

### Aws Inspectorv2 Finding

`aws_inspectorv2_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `id` | `string` |  |  |

---

### Aws Inspectorv2 Finding

`aws_inspectorv2_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `id` | `string` |  |  |

---

### Aws License Manager License

`aws_license_manager_license` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`beneficiary` \*

 | `string` **|** `null` |  |  |
| 

`expiresOn` \*

 | `number` **|** `null` |  |  |
| 

`homeRegion` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`issuerKeyFingerprint` \*

 | `string` **|** `null` |  |  |
| 

`issuerName` \*

 | `string` **|** `null` |  |  |
| 

`productName` \*

 | `string` **|** `null` |  |  |
| 

`productSku` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`validityStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`version` \*

 | `string` **|** `null` |  |  |

---

### Aws License Manager Received License

`aws_license_manager_received_license` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`allowedOperations` \*

 | `array` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`beneficiary` \*

 | `string` **|** `null` |  |  |
| 

`borrowMaxTimeToLiveInMinutes` \*

 | `number` **|** `null` |  |  |
| 

`consumptionRenewType` \*

 | `string` **|** `null` |  |  |
| 

`expiresOn` \*

 | `number` **|** `null` |  |  |
| 

`homeRegion` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isBorrowAllowEarlyCheckIn` \*

 | `boolean` **|** `null` |  |  |
| 

`issuerKeyFingerprint` \*

 | `string` **|** `null` |  |  |
| 

`issuerName` \*

 | `string` **|** `null` |  |  |
| 

`issuerSignKey` \*

 | `string` **|** `null` |  |  |
| 

`productName` \*

 | `string` **|** `null` |  |  |
| 

`productSku` \*

 | `string` **|** `null` |  |  |
| 

`provisionalMaxTimeToLiveInMinutes` \*

 | `number` **|** `null` |  |  |
| 

`receivedStatus` \*

 | `string` **|** `null` |  |  |
| 

`receivedStatusReason` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`validityStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`version` \*

 | `string` **|** `null` |  |  |

---

### Aws Marketplace Entitlement

`aws_marketplace_entitlement` inherits from [Subscription](/data-model/schemas/Subscription.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`customerIdentifier` \*

 | `string` **|** `null` | Entitlement.CustomerIdentifier — opaque buyer handle from ResolveCustomer. |  |
| 

`dimension` \*

 | `string` **|** `null` | Entitlement.Dimension — the capacity dimension this entitlement covers (e.g. Users, DataGB). |  |
| 

`productCode` \*

 | `string` | Marketplace ProductCode used to query GetEntitlements. Equals AWS License Manager GrantedLicense.ProductSKU. |  |
| 

`region` \*

 | `string` | AWS region (always us-east-1 for the AWS Marketplace Entitlement Service). |  |
| 

`valueBoolean` \*

 | `boolean` **|** `null` | Entitlement.Value.BooleanValue when present. |  |
| 

`valueDouble` \*

 | `number` **|** `null` | Entitlement.Value.DoubleValue when present. |  |
| 

`valueInteger` \*

 | `number` **|** `null` | Entitlement.Value.IntegerValue when present. |  |
| 

`valueString` \*

 | `string` **|** `null` | Entitlement.Value.StringValue when present. |  |

---

### Aws Marketplace Entity

`aws_marketplace_entity` inherits from [Product](/data-model/schemas/Product.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | EntityArn from ListEntities, e.g. arn:aws:aws-marketplace:::AmiProduct/prod-xxxx. |  |
| 

`entityId` \*

 | `string` | Opaque catalog entity ID, e.g. prod-xxxx. |  |
| 

`entityType` \*

 | `string` | Marketplace entity discriminator: AmiProduct, ContainerProduct, SaaSProduct, DataProduct, Offer, or ResaleAuthorization. |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` | EntitySummary.LastModifiedDate parsed via parseTimePropertyValue (milliseconds since epoch). |  |
| 

`offerAvailableUntilOn` \*

 | `number` **|** `null` | OfferSummary.AvailabilityEndDate parsed via parseTimePropertyValue. |  |
| 

`offerBuyerAccountIds` \*

 | `array` **|** `null` | OfferSummary.BuyerAccounts — AWS account IDs targeted by a private offer. |  |
| 

`offerOfferSetId` \*

 | `string` **|** `null` | OfferSummary.OfferSetId. |  |
| 

`offerProductId` \*

 | `string` **|** `null` | OfferSummary.ProductId — references another aws\_marketplace\_entity EntityId. |  |
| 

`offerReleasedOn` \*

 | `number` **|** `null` | OfferSummary.ReleaseDate parsed via parseTimePropertyValue. |  |
| 

`offerResaleAuthorizationId` \*

 | `string` **|** `null` | OfferSummary.ResaleAuthorizationId — references a ResaleAuthorization entity EntityId. |  |
| 

`offerState` \*

 | `string` **|** `null` | OfferSummary.State. |  |
| 

`offerTargeting` \*

 | `array` **|** `null` | OfferSummary.Targeting — string targeting tokens (e.g. None, BuyerAccounts, CountryCodes). |  |
| 

`ownershipType` \*

 | `string` | Ownership filter under which the entity was discovered: SELF (owned by calling account) or SHARED (visible via private offer/RAM share). |  |
| 

`productTitle` \*

 | `string` **|** `null` | Product title from {AmiProduct|ContainerProduct|SaaSProduct|DataProduct}Summary.ProductTitle. |  |
| 

`productVisibility` \*

 | `string` **|** `null` | Per-product visibility from the type-specific product sub-summary. |  |
| 

`region` \*

 | `string` | AWS region (always us-east-1 for the AWS Marketplace Catalog Service). |  |
| 

`resaleAvailableUntilOn` \*

 | `number` **|** `null` | ResaleAuthorizationSummary.AvailabilityEndDate parsed via parseTimePropertyValue. |  |
| 

`resaleManufacturerAccountId` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ManufacturerAccountId — counterparty AWS account. |  |
| 

`resaleManufacturerLegalName` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ManufacturerLegalName. |  |
| 

`resaleOfferExtendedStatus` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.OfferExtendedStatus. |  |
| 

`resaleProductId` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ProductId. |  |
| 

`resaleProductName` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ProductName. |  |
| 

`resaleResellerAccountId` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ResellerAccountID — counterparty AWS account. |  |
| 

`resaleResellerLegalName` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ResellerLegalName. |  |
| 

`resaleStatus` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.Status. |  |
| 

`visibility` \*

 | `string` **|** `null` | Top-level entity visibility from ListEntities (e.g. Public, Limited, Restricted). |  |

---

### Aws Networkmanager Attachment

`aws_networkmanager_attachment` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The synthesized attachment ARN (arn:aws:networkmanager::{ownerAccountId}:attachment/{attachmentId}); entity \_key. |  |
| 

`attachmentId` \*

 | `string` | The CloudWAN attachment ID (attachment-…). |  |
| 

`attachmentPolicyRuleNumber` \*

 | `number` **|** `null` | Rule number from the attachment-policies\[\] that bound this attachment to its segment. |  |
| 

`attachmentType` \*

 | `string` **|** `null` | One of VPC | SITE\_TO\_SITE\_VPN | CONNECT | DIRECT\_CONNECT\_GATEWAY | TRANSIT\_GATEWAY\_ROUTE\_TABLE. |  |
| 

`coreNetworkArn` \*

 | `string` **|** `null` | ARN of the owning core network. |  |
| 

`coreNetworkId` \*

 | `string` | The owning core network ID. |  |
| 

`edgeLocation` \*

 | `string` **|** `null` | Edge location the attachment is bound to. |  |
| 

`edgeLocations` \*

 | `array` **|** `null` | Edge locations associated with the attachment — set on Direct Connect Gateway attachments that span multiple edges. |  |
| 

`hasLastModificationErrors` \*

 | `boolean` | True when LastModificationErrors\[\] has one or more entries. |  |
| 

`id` \*

 | `string` | The CloudWAN attachment ID (attachment-…). |  |
| 

`isPendingAcceptance` \*

 | `boolean` | True when the attachment is awaiting acceptance (PENDING\_ATTACHMENT\_ACCEPTANCE or PENDING\_TAG\_ACCEPTANCE). |  |
| 

`lastModificationErrorCodes` \*

 | `array` **|** `null` | Error codes from LastModificationErrors\[\].Code if any. |  |
| 

`networkFunctionGroupName` \*

 | `string` **|** `null` | Network function group binding for service-insertion attachments. |  |
| 

`ownerAccountId` \*

 | `string` **|** `null` | AWS account that owns this attachment — present even when the underlying resource is in a different account. |  |
| 

`proposedNetworkFunctionGroupName` \*

 | `string` **|** `null` | Proposed network-function-group binding from a pending change (drift detection). |  |
| 

`proposedSegmentName` \*

 | `string` **|** `null` | Proposed segment binding from a pending change (drift detection). |  |
| 

`region` \*

 | `string` **|** `null` | Edge location (AWS region) the attachment terminates in — alias of edgeLocation. |  |
| 

`resourceArn` \*

 | `string` **|** `null` | The underlying VPC/VPN/Direct-Connect-Gateway/Transit-Gateway-Route-Table ARN. Kept on the entity to support compliance queries against cross-account targets that may not be ingested. |  |
| 

`routingPolicyLabels` \*

 | `array` **|** `null` | Routing-policy labels associated with this attachment, sourced from ListAttachmentRoutingPolicyAssociations. |  |
| 

`segmentName` \*

 | `string` **|** `null` | Segment the attachment is bound to (compliance pivot). |  |
| 

`state` \*

 | `string` **|** `null` | Lifecycle state. |  |

---

### Aws Networkmanager Connect Peer

`aws_networkmanager_connect_peer` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` | The owning AWS account ID. |  |
| 

`arn` \*

 | `string` | The synthesized connect-peer ARN (arn:aws:networkmanager::{ownerAccountId}:connect-peer/{connectPeerId}); entity \_key. |  |
| 

`bgpPeerAsns` \*

 | `array` **|** `null` | BGP peer ASNs (one per Configuration.BgpConfigurations entry). |  |
| 

`connectAttachmentId` \*

 | `string` | The Connect attachment ID this peer is bound to (relationship pivot). |  |
| 

`connectPeerId` \*

 | `string` | The Connect Peer ID. |  |
| 

`coreNetworkAddress` \*

 | `string` **|** `null` | BGP local address on the core network side. |  |
| 

`coreNetworkId` \*

 | `string` | The owning core network ID. |  |
| 

`edgeLocation` \*

 | `string` **|** `null` | Edge location. |  |
| 

`hasLastModificationErrors` \*

 | `boolean` | True when LastModificationErrors\[\] has one or more entries. |  |
| 

`id` \*

 | `string` | The Connect Peer ID. |  |
| 

`insideCidrBlocks` \*

 | `array` **|** `null` | Inside CIDR blocks (GRE only). |  |
| 

`peerAddress` \*

 | `string` **|** `null` | BGP peer address (customer/appliance side). |  |
| 

`protocol` \*

 | `string` **|** `null` | Encapsulation protocol. | **Any of**:

-   `GRE`

-   `NO_ENCAP`

-   `undefined`

 |
| 

`region` \*

 | `string` **|** `null` | Edge location of this peer (alias of edgeLocation). |  |
| 

`state` \*

 | `string` **|** `null` | Lifecycle state. |  |
| 

`subnetArn` \*

 | `string` **|** `null` | Subnet ARN for NO\_ENCAP peers. Kept on the entity to support cross-account compliance queries. |  |

---

### Aws Networkmanager Core Network

`aws_networkmanager_core_network` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` | The owning AWS account ID derived from the ARN. |  |
| 

`arn` \*

 | `string` | The CloudWAN core network ARN; entity \_key. |  |
| 

`coreNetworkId` \*

 | `string` | The CloudWAN core network ID (e.g. core-network-…). |  |
| 

`edgeAsns` \*

 | `array` **|** `null` | Per-edge BGP ASNs assigned by the core network at each edge location. |  |
| 

`edgeLocations` \*

 | `array` **|** `null` | All edge locations (AWS regions) the core network is deployed to. |  |
| 

`globalNetworkId` \*

 | `string` | The parent NetworkManager global network ID. |  |
| 

`id` \*

 | `string` | The CloudWAN core network ID (e.g. core-network-…). |  |
| 

`latestPolicyVersionId` \*

 | `number` **|** `null` | Policy version ID currently aliased LATEST — used to detect drift versus LIVE. |  |
| 

`livePolicyVersionId` \*

 | `number` **|** `null` | Policy version ID currently aliased LIVE on the core network — the enforced policy. |  |
| 

`networkFunctionGroupNames` \*

 | `array` **|** `null` | Names of network function groups defined for service insertion on the core network. |  |
| 

`region` \*

 | `string` | The control-plane region for the core network (us-west-2 for commercial, us-gov-west-1 for GovCloud). |  |
| 

`segmentNames` \*

 | `array` **|** `null` | Names of segments (logical isolation domains) defined on the core network. |  |
| 

`state` \*

 | `string` **|** `null` | Lifecycle state (AVAILABLE, UPDATING, CREATING, DELETING, …). |  |

---

### Aws Networkmanager Core Network Policy

`aws_networkmanager_core_network_policy` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` | The owning AWS account ID derived from the ARN. |  |
| 

`alias` \*

 | `string` **|** `null` | Alias of this version (LIVE = enforced, LATEST = latest published). | **Any of**:

-   `LIVE`

-   `LATEST`

-   `undefined`

 |
| 

`asnRanges` \*

 | `array` **|** `null` | BGP ASN ranges available to the core network (from core-network-configuration.asn-ranges). |  |
| 

`attachmentPolicyRuleCount` \*

 | `number` **|** `null` | Number of attachment-policy rules — a quick gauge of policy complexity. |  |
| 

`changeSetState` \*

 | `string` **|** `null` | Change-set state (READY\_TO\_EXECUTE, EXECUTING, OUT\_OF\_DATE, FAILED, …). |  |
| 

`coreNetworkId` \*

 | `string` | The owning core network ID. |  |
| 

`hasPolicyErrors` \*

 | `boolean` | True when the policy has one or more PolicyErrors entries (compliance signal). |  |
| 

`id` \*

 | `string` | The policy version ID (string-coerced) — natural AWS resource identifier scoped to the parent core network. |  |
| 

`insideCidrBlocks` \*

 | `array` **|** `null` | Inside CIDR blocks reserved for Connect attachments (from core-network-configuration.inside-cidr-blocks). |  |
| 

`isLive` \*

 | `boolean` | True when this policy version is aliased LIVE. |  |
| 

`isVpnEcmpSupportEnabled` \*

 | `boolean` **|** `null` | Whether VPN ECMP support is enabled on the core network (from core-network-configuration.vpn-ecmp-support). |  |
| 

`networkFunctionGroupNames` \*

 | `array` **|** `null` | All network-function-group names declared in the policy. |  |
| 

`policyErrorCodes` \*

 | `array` **|** `null` | Error codes from PolicyErrors\[\].ErrorCode if any. |  |
| 

`policyVersionId` \*

 | `number` | The policy version (monotonically increasing). |  |
| 

`region` \*

 | `string` | Control-plane region the policy was retrieved from. |  |
| 

`segmentNames` \*

 | `array` **|** `null` | All segment names declared in the policy. |  |

---

### Aws Opensearch Domain

`aws_opensearch_domain` inherits from [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessPolicies` \*

 | `string` **|** `null` | Raw JSON string of the IAM resource-based access policy attached to the OpenSearch domain. |  |
| 

`anonymousAuthDisabledOn` \*

 | `number` **|** `null` |  |  |
| 

`appLoggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`auditLoggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`autoTuneErrorMessage` \*

 | `string` **|** `null` |  |  |
| 

`autoTuneStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`autoTuneState` \*

 | `string` **|** `null` |  |  |
| 

`autoTuneUseOffPeakWindow` \*

 | `boolean` **|** `null` |  |  |
| 

`availabilityZoneCount` \*

 | `number` **|** `null` |  |  |
| 

`availabilityZones` \*

 | `array` **|** `null` |  |  |
| 

`changeProgressDetails` \*

 | `string` **|** `null` |  |  |
| 

`cognitoIdentityPoolId` \*

 | `string` **|** `null` |  |  |
| 

`cognitoRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`cognitoUserPoolId` \*

 | `string` **|** `null` |  |  |
| 

`customEndpoint` \*

 | `string` **|** `null` |  |  |
| 

`customEndpointCertificateArn` \*

 | `string` **|** `null` |  |  |
| 

`domainEndpointV2HostedZoneId` \*

 | `string` **|** `null` |  |  |
| 

`domainId` \*

 | `string` **|** `null` |  |  |
| 

`domainName` \*

 | `string` **|** `null` |  |  |
| 

`domainProcessingStatus` \*

 | `string` **|** `null` |  |  |
| 

`encryptionAtRestKmsKeyId` \*

 | `string` **|** `null` |  |  |
| 

`endpoint` \*

 | `string` **|** `null` |  |  |
| 

`endpoints` \*

 | `string` **|** `null` |  |  |
| 

`endpointV2` \*

 | `string` **|** `null` |  |  |
| 

`engineVersion` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterApplicationArn` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterInstanceArn` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterRolesKey` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterSubjectKey` \*

 | `string` **|** `null` |  |  |
| 

`instanceCount` \*

 | `number` **|** `null` |  |  |
| 

`instanceType` \*

 | `string` **|** `null` |  |  |
| 

`iops` \*

 | `number` **|** `null` |  |  |
| 

`ipAddressType` \*

 | `string` **|** `null` |  |  |
| 

`isAdvancedSecurityEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAnonymousAuthEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAppLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAuditLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAutoSoftwareUpdateEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAutoTuneEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCognitoEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isColdStorageEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCreated` \*

 | `boolean` **|** `null` |  |  |
| 

`isCustomEndpointEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isDedicatedMasterEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isDeleted` \*

 | `boolean` **|** `null` |  |  |
| 

`isEbsEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isEncryptionAtRestEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isHttpsEnforced` \*

 | `boolean` **|** `null` |  |  |
| 

`isInternalUserDatabaseEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isInVpc` \*

 | `boolean` **|** `null` |  |  |
| 

`isJwtEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isMultiAzWithStandbyEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isNodeToNodeEncryptionEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isOffPeakWindowEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isProcessing` \*

 | `boolean` **|** `null` |  |  |
| 

`isSamlEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isSlowIndexLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isSlowSearchLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isUpgradeProcessing` \*

 | `boolean` **|** `null` |  |  |
| 

`isWarmEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isZoneAwarenessEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`jwtRolesKey` \*

 | `string` **|** `null` |  |  |
| 

`jwtSubjectKey` \*

 | `string` **|** `null` |  |  |
| 

`masterInstanceCount` \*

 | `number` **|** `null` |  |  |
| 

`masterInstanceType` \*

 | `string` **|** `null` |  |  |
| 

`modifyingProperties` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`naturalLanguageQueryGenerationCurrentState` \*

 | `string` **|** `null` |  |  |
| 

`naturalLanguageQueryGenerationDesiredState` \*

 | `string` **|** `null` |  |  |
| 

`offPeakWindowStartHours` \*

 | `number` **|** `null` |  |  |
| 

`offPeakWindowStartMinutes` \*

 | `number` **|** `null` |  |  |
| 

`opensearchVersion` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`samlRolesKey` \*

 | `string` **|** `null` |  |  |
| 

`samlSessionTimeoutMinutes` \*

 | `number` **|** `null` |  |  |
| 

`samlSubjectKey` \*

 | `string` **|** `null` |  |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`serviceSoftwareOptions` \*

 | `string` **|** `null` |  |  |
| 

`slowIndexLoggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`slowSearchLoggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`snapshotOptions` \*

 | `string` **|** `null` |  |  |
| 

`subnetIds` \*

 | `array` **|** `null` |  |  |
| 

`throughput` \*

 | `number` **|** `null` |  |  |
| 

`tlsSecurityPolicy` \*

 | `string` **|** `null` |  |  |
| 

`volumeSize` \*

 | `number` **|** `null` |  |  |
| 

`volumeType` \*

 | `string` **|** `null` |  |  |
| 

`vpcId` \*

 | `string` **|** `null` |  |  |
| 

`warmCount` \*

 | `number` **|** `null` |  |  |
| 

`warmType` \*

 | `string` **|** `null` |  |  |

---

### Aws Organization Root

`aws_organization_root` inherits from [Organization](/data-model/schemas/Organization.md), [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the organization root. |  |
| 

`enabledPolicyTypes` \*

 | `array` of `string`s | AWS Organizations policy types currently enabled for this organization root, as reported by ListRoots (for example SERVICE\_CONTROL\_POLICY, RESOURCE\_CONTROL\_POLICY, S3\_POLICY). Policy types absent from this list are not enabled for the root. |  |
| 

`isAiServicesOptOutPolicyEnabled` \*

 | `boolean` | Whether AI services opt-out policies are enabled for this organization root. These policies control whether AWS may store and use customer content submitted to AI services to improve those services. False when the policy type is disabled or is still being enabled. |  |
| 

`isBackupPolicyEnabled` \*

 | `boolean` | Whether backup policies are enabled for this organization root. Backup policies centrally define AWS Backup plans for the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isBedrockPolicyEnabled` \*

 | `boolean` | Whether Amazon Bedrock policies are enabled for this organization root. Bedrock policies centrally enforce Bedrock Guardrails on model inference calls made from the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isChatbotPolicyEnabled` \*

 | `boolean` | Whether chat applications policies are enabled for this organization root. These policies control which chat workspaces (Slack, Microsoft Teams) member accounts may connect to AWS. False when the policy type is disabled or is still being enabled. |  |
| 

`isDeclarativePolicyEc2Enabled` \*

 | `boolean` | Whether declarative policies for EC2 are enabled for this organization root. Declarative EC2 policies centrally enforce EC2 account attributes such as instance metadata defaults, serial console access, image block public access, and allowed AMI providers. False when the policy type is disabled or is still being enabled. |  |
| 

`isInspectorPolicyEnabled` \*

 | `boolean` | Whether Amazon Inspector policies are enabled for this organization root. Inspector policies centrally enable and configure Amazon Inspector scanning across the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isNetworkSecurityDirectorPolicyEnabled` \*

 | `boolean` | Whether AWS Shield network security director policies are enabled for this organization root. These policies centrally enable AWS Shield network security director, which discovers compute, networking, and network security resources and evaluates their configuration against network topology, AWS best practices, and threat intelligence, across the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isResourceControlPolicyEnabled` \*

 | `boolean` | Whether resource control policies (RCPs) are enabled for this organization root. RCPs set the maximum available permissions on resources in the member accounts, regardless of the calling principal's account. False when the policy type is disabled or is still being enabled. |  |
| 

`isS3PolicyEnabled` \*

 | `boolean` | Whether Amazon S3 policies are enabled for this organization root. S3 policies centrally enforce the four S3 Block Public Access settings across the member accounts, overriding account-level configuration. False when the policy type is disabled or is still being enabled. |  |
| 

`isSecurityHubPolicyEnabled` \*

 | `boolean` | Whether Security Hub policies are enabled for this organization root. Security Hub policies centrally configure Security Hub enablement, standards, and controls across the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isServiceControlPolicyEnabled` \*

 | `boolean` | Whether service control policies (SCPs) are enabled for this organization root. SCPs set the maximum available permissions for principals in the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isTagPolicyEnabled` \*

 | `boolean` | Whether tag policies are enabled for this organization root. Tag policies standardise tag keys and values on resources across the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isUpgradeRolloutPolicyEnabled` \*

 | `boolean` | Whether upgrade rollout policies are enabled for this organization root. Upgrade rollout policies centrally control how AWS service upgrades are staged across the member accounts. False when the policy type is disabled or is still being enabled. |  |

---

### Aws Organization Tag Policy

`aws_organization_tag_policy` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `awsManaged` | `boolean` |  |  |
| `content` | `string` |  |  |
| `type` | `string` |  |  |

---

### Aws Prometheus Scraper

`aws_prometheus_scraper` inherits from [Scanner](/data-model/schemas/Scanner.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alias` \*

 | `string` **|** `null` | Customer-assigned alias for the scraper (not unique). |  |
| 

`arn` \*

 | `string` | The full ARN of the scraper. |  |
| 

`destinationWorkspaceArn` \*

 | `string` **|** `null` | destination.ampConfiguration.workspaceArn — the AMP workspace the scraper writes metrics to. Used to build the SENDS relationship. |  |
| 

`eksClusterArn` \*

 | `string` **|** `null` | EKS cluster ARN the scraper collects from. Populated only when sourceType is EKS. |  |
| 

`isCrossAccountScrape` \*

 | `boolean` | True when DescribeScraper.roleConfiguration is present, indicating a cross-account scraping setup (source-account role + target-account role). |  |
| 

`region` \*

 | `string` | AWS region where the scraper runs. |  |
| 

`roleArn` \*

 | `string` | IAM role ARN the managed collector assumes to discover targets and write to the destination workspace. Required by the API. |  |
| 

`scraperId` \*

 | `string` | The AMP scraper identifier (e.g. s-abcd1234-...). |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Security group IDs applied to the scraper ENIs. Pulled from source.eksConfiguration.securityGroupIds or source.vpcConfiguration.securityGroupIds. May be null/empty for EKS (the field is optional on EksConfiguration). |  |
| 

`sourceAccountId` \*

 | `string` **|** `null` | AWS account ID parsed from `sourceRoleArn`. Used by the relationship-builder to construct subnet/security-group ARNs in the source account for cross-account scrapers, so mapped relationships resolve to the correct entities. Null when single-account. |  |
| 

`sourceRoleArn` \*

 | `string` **|** `null` | roleConfiguration.sourceRoleArn — IAM role in the source account used for cross-account scraping. Null when single-account. |  |
| 

`sourceType` \*

 | `string` **|** `null` | Discriminator for the source UNION. EKS when source.eksConfiguration is set, VPC when source.vpcConfiguration is set (MSK), null when neither (forward-compat). |  |
| 

`statusCode` \*

 | `string` **|** `null` | Scraper lifecycle status from DescribeScraper.status.statusCode (CREATING|ACTIVE|DELETING|CREATION\_FAILED|DELETION\_FAILED). |  |
| 

`statusReason` \*

 | `string` **|** `null` | Free-text reason for the current scraper status, populated when statusCode is a \*\_FAILED state. |  |
| 

`subnetIds` \*

 | `array` **|** `null` | Subnet IDs the scraper attaches its ENIs to. Pulled from source.eksConfiguration.subnetIds or source.vpcConfiguration.subnetIds. |  |
| 

`targetRoleArn` \*

 | `string` **|** `null` | roleConfiguration.targetRoleArn — IAM role in the target (workspace) account used for cross-account scraping. Null when single-account. |  |
| 

`webLink` \*

 | `string` **|** `null` | Link to the scraper in the AWS console. |  |

---

### Aws Prometheus Workspace

`aws_prometheus_workspace` inherits from [Logs](/data-model/schemas/Logs.md), [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alias` \*

 | `string` **|** `null` | Customer-assigned alias for the workspace (not unique). |  |
| 

`arn` \*

 | `string` | The full ARN of the workspace. |  |
| 

`configurationStatusCode` \*

 | `string` **|** `null` | Status code from DescribeWorkspaceConfiguration.status.statusCode (e.g. ACTIVE, UPDATING). |  |
| 

`displayName` \*

 | `string` | Human-readable name (alias when set, workspace ID otherwise). |  |
| 

`endpointStatusCode` \*

 | `string` **|** `null` | Workspace lifecycle status from DescribeWorkspace.status.statusCode (CREATING|ACTIVE|UPDATING|DELETING|CREATION\_FAILED). |  |
| 

`hasResourcePolicy` \*

 | `boolean` **|** `null` | True when DescribeResourcePolicy returned an attached policy (workspace is shared cross-account or cross-principal). False when no policy is attached. Null when the Describe call failed. |  |
| 

`isCustomerManagedEncryption` \*

 | `boolean` | True when the workspace is encrypted with a customer-managed KMS key; false when using an AWS-owned key. |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` | True when DescribeLoggingConfiguration returned a configuration with a logGroupArn. False when no configuration is attached. Null when the Describe call failed (e.g. AccessDenied or throttling) — distinguishes "feature off" from "could not determine". |  |
| 

`isQueryLoggingEnabled` \*

 | `boolean` **|** `null` | True when at least one CloudWatch Logs destination is configured for query logging. False when no configuration is attached. Null when the Describe call failed. |  |
| 

`loggingStatusCode` \*

 | `string` **|** `null` | Status code from DescribeLoggingConfiguration.status.statusCode. |  |
| 

`logGroupArn` \*

 | `string` **|** `null` | CloudWatch Logs log group ARN receiving rules/alerting logs; null when logging not configured. |  |
| 

`name` \*

 | `string` | The AMP workspace identifier (used as the entity name). |  |
| 

`policyDocument` \*

 | `string` **|** `null` | The raw JSON IAM policy document attached to the workspace via DescribeResourcePolicy. Used downstream to build IAM principal relationships. Null when no policy. |  |
| 

`prometheusEndpoint` \*

 | `string` **|** `null` | The Prometheus query API endpoint URL exposed by the workspace. |  |
| 

`queryLoggingQspThreshold` \*

 | `number` **|** `null` | Query samples processed (QSP) threshold filter for query logging — only queries above this threshold are logged. |  |
| 

`queryLoggingStatusCode` \*

 | `string` **|** `null` | Status code from DescribeQueryLoggingConfiguration.status.statusCode. |  |
| 

`queryLogGroupArn` \*

 | `string` **|** `null` | CloudWatch Logs log group ARN receiving query logs (first destination). Null when query logging not configured. |  |
| 

`queryLogGroupArns` \*

 | `array` **|** `null` | All CloudWatch Logs log group ARNs configured as query logging destinations (the API allows multiple even though current AWS console only supports one). |  |
| 

`region` \*

 | `string` | AWS region where the workspace lives. |  |
| 

`resourcePolicyStatusCode` \*

 | `string` **|** `null` | Lifecycle of the resource-based policy from DescribeResourcePolicy.policyStatus (CREATING|ACTIVE|UPDATING|DELETING). Null when no policy. |  |
| 

`retentionPeriodInDays` \*

 | `number` **|** `null` | Metric retention period in days from DescribeWorkspaceConfiguration. Null when DescribeWorkspaceConfiguration fails or is unavailable. |  |
| 

`webLink` \*

 | `string` **|** `null` | Link to the workspace in the AWS console. |  |
| 

`workspaceId` \*

 | `string` | The AMP workspace identifier (e.g. ws-abcd1234-...). |  |

---

### Aws Ram Principal

`aws_ram_principal` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`associatedResourceShares` \*

 | `array` **|** `null` |  |  |
| 

`associationStatus` \*

 | `string` **|** `null` |  |  |
| 

`associationStatusMessage` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isExternal` \*

 | `boolean` **|** `null` |  |  |
| 

`isOwnedBySelf` \*

 | `boolean` |  |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`organizationId` \*

 | `string` **|** `null` |  |  |
| 

`principalArn` \*

 | `string` |  |  |
| 

`principalType` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`sourceOwner` \*

 | `string` |  |  |
| 

`vendor` \*

 | `string` |  |  |

---

### Aws Ram Resource Share

`aws_ram_resource_share` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isAllowExternalPrincipals` \*

 | `boolean` **|** `null` |  |  |
| 

`isFeatureSet` \*

 | `string` **|** `null` |  |  |
| 

`isOwnedBySelf` \*

 | `boolean` |  |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`owningAccountId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resourceShareArn` \*

 | `string` **|** `null` |  |  |
| 

`sourceOwner` \*

 | `string` |  |  |
| 

`status` \*

 | `string` |  |  |
| 

`statusMessage` \*

 | `string` **|** `null` |  |  |

---

### Aws Ram Resource Share Invitation

`aws_ram_resource_share_invitation` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`invitationTimestamp` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`receiverAccountId` \*

 | `string` **|** `null` |  |  |
| 

`receiverArn` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resourceShareArn` \*

 | `string` **|** `null` |  |  |
| 

`resourceShareName` \*

 | `string` **|** `null` |  |  |
| 

`senderAccountId` \*

 | `string` **|** `null` |  |  |
| 

`status` \*

 | `string` |  |  |

---

### Aws Ram Shared Resource

`aws_ram_shared_resource` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isOwnedBySelf` \*

 | `boolean` |  |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resourceGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`resourceRegionScope` \*

 | `string` **|** `null` |  |  |
| 

`sourceOwner` \*

 | `string` |  |  |
| 

`status` \*

 | `string` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Aws Redshift Datashare

`aws_redshift_datashare` inherits from [DataCollection](/data-model/schemas/DataCollection.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` **|** `null` |  |  |
| 

`authorizationCount` \*

 | `number` **|** `null` |  |  |
| 

`datashareArn` \*

 | `string` **|** `null` |  |  |
| 

`datashareId` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`isProducerFromOtherAccount` \*

 | `boolean` **|** `null` |  |  |
| 

`isProducerFromOtherRegion` \*

 | `boolean` **|** `null` |  |  |
| 

`isPubliclyAccessibleByConsumers` \*

 | `boolean` **|** `null` |  |  |
| 

`managedBy` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`producerArn` \*

 | `string` **|** `null` |  |  |
| 

`producerType` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Redshift Datashare Authorization

`aws_redshift_datashare_authorization` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`consumerIdentifier` \*

 | `string` **|** `null` |  |  |
| 

`consumerRegion` \*

 | `string` **|** `null` |  |  |
| 

`datashareArn` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`producerAllowedWrites` \*

 | `boolean` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`statusChangedOn` \*

 | `number` **|** `null` |  |  |

---

### Aws Resource Explorer Index

`aws_resource_explorer_index` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the index. |  |
| 

`isAggregator` \*

 | `boolean` **|** `null` | True if this is the aggregator index. |  |
| 

`region` \*

 | `string` | AWS region. |  |
| 

`replicatingFrom` \*

 | `array` **|** `null` | For an AGGREGATOR index: the Regions that replicate their content into this index. |  |
| 

`replicatingTo` \*

 | `array` **|** `null` | For a LOCAL index: the Regions whose content this index replicates to (i.e. the aggregator region). |  |
| 

`state` \*

 | `string` **|** `null` | Index state. |  |
| 

`type` \*

 | `string` **|** `null` | Index type: LOCAL or AGGREGATOR. |  |

---

### Aws Resource Explorer View

`aws_resource_explorer_view` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the view. |  |
| 

`filtersString` \*

 | `string` **|** `null` | Filter expression string. |  |
| 

`includedProperties` \*

 | `array` **|** `null` | Additional resource property names included in results. |  |
| 

`isDefaultView` \*

 | `boolean` **|** `null` | True if this is the account default view. |  |
| 

`ownerAccountId` \*

 | `string` **|** `null` | AWS account ID that owns this view. |  |
| 

`region` \*

 | `string` | AWS region. |  |
| 

`scope` \*

 | `string` **|** `null` | Scope ARN of the view. |  |
| 

`viewName` \*

 | `string` **|** `null` | View name. |  |

---

### Aws S3 Bucket Lifecycle Rule

`aws_s3_bucket_lifecycle_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`abortIncompleteMultipartUploadDays` \*

 | `number` **|** `null` | Days after multipart-upload initiation before the upload is aborted and parts deleted (rule.AbortIncompleteMultipartUpload.DaysAfterInitiation). Storage-cost and security hygiene signal. |  |
| 

`appliesToAllObjects` \*

 | `boolean` | True iff the rule has no filter (no prefix, no tag, no size bounds, no And operator). Wide-scope rules are a key compliance review signal. |  |
| 

`expirationDate` \*

 | `number` **|** `null` | Absolute date (epoch ms) at which current versions expire (rule.Expiration.Date). Most rules use Days OR Date, not both. |  |
| 

`expirationDays` \*

 | `number` **|** `null` | Days after object creation when current versions are expired (rule.Expiration.Days). Maps directly to retention policy in NIST SI-12 / SOC 2 CC6.5 / HIPAA 164.310(d)(2)(i) / PCI DSS 3.1. |  |
| 

`filterAndTagKeys` \*

 | `array` **|** `null` | Tag keys used in the multi-tag conjunction filter (rule.Filter.And.Tags). Parallel-array to filterAndTagValues — same index = same tag. |  |
| 

`filterAndTagValues` \*

 | `array` **|** `null` | Tag values used in the multi-tag conjunction filter. Index-aligned with filterAndTagKeys. |  |
| 

`filterObjectSizeGreaterThan` \*

 | `number` **|** `null` | Minimum object size in bytes for the rule to apply (rule.Filter.ObjectSizeGreaterThan or rule.Filter.And.ObjectSizeGreaterThan). |  |
| 

`filterObjectSizeLessThan` \*

 | `number` **|** `null` | Maximum object size in bytes for the rule to apply (rule.Filter.ObjectSizeLessThan or rule.Filter.And.ObjectSizeLessThan). |  |
| 

`filterPrefix` \*

 | `string` **|** `null` | Object key prefix the rule applies to. Pulled from rule.Prefix (deprecated), rule.Filter.Prefix, or rule.Filter.And.Prefix in that order. Null when no prefix is configured — see appliesToAllObjects for the "applies to every object" signal. |  |
| 

`filterTagKey` \*

 | `string` **|** `null` | Key of the single object tag that scopes this rule (when rule.Filter.Tag is set). |  |
| 

`filterTagValue` \*

 | `string` **|** `null` | Value of the single object tag that scopes this rule (when rule.Filter.Tag is set). |  |
| 

`hasAnyAction` \*

 | `boolean` | True iff the rule has at least one action defined (expiration, transition, noncurrent-version action, or abort-incomplete-multipart-upload). False indicates a misconfiguration — a rule with no action does nothing. |  |
| 

`isAppliedToNoncurrentVersions` \*

 | `boolean` | True iff the rule has any NoncurrentVersion\* action defined. Combined with bucket-level versioningEnabled in J1QL to spot misconfigurations. |  |
| 

`isEnabled` \*

 | `boolean` | Whether the lifecycle rule is currently being enforced (true iff Status === "Enabled"). Disabled rules look like coverage but are not applied — a key compliance signal. |  |
| 

`isExpiredObjectDeleteMarkerEnabled` \*

 | `boolean` **|** `null` | Whether the rule cleans up expired-object delete markers (rule.Expiration.ExpiredObjectDeleteMarker). Used to keep versioned bucket listings tidy. |  |
| 

`noncurrentExpirationDays` \*

 | `number` **|** `null` | Days a version is retained after becoming noncurrent before expiration (rule.NoncurrentVersionExpiration.NoncurrentDays). Critical for compliance on versioned buckets. |  |
| 

`noncurrentExpirationNewerVersions` \*

 | `number` **|** `null` | Number of newer noncurrent versions to retain before expiring older ones (rule.NoncurrentVersionExpiration.NewerNoncurrentVersions). |  |
| 

`noncurrentTransitionCount` \*

 | `number` | Number of noncurrent-version transitions defined on this rule. |  |
| 

`noncurrentTransitionDays` \*

 | `array` **|** `null` | Days after object version becomes noncurrent for each transition (rule.NoncurrentVersionTransitions\[\].NoncurrentDays). Index-aligned with noncurrentTransitionStorageClasses and noncurrentTransitionNewerVersions. A value of -1 indicates NoncurrentDays was missing in the source response. |  |
| 

`noncurrentTransitionNewerVersions` \*

 | `array` **|** `null` | Number of newer noncurrent versions to retain before transitioning, for each noncurrent transition (rule.NoncurrentVersionTransitions\[\].NewerNoncurrentVersions, max 100). Index-aligned. A value of -1 means NewerNoncurrentVersions was not configured for that transition. |  |
| 

`noncurrentTransitionStorageClasses` \*

 | `array` **|** `null` | Destination storage class for each noncurrent-version transition (rule.NoncurrentVersionTransitions\[\].StorageClass). Index-aligned. Empty string indicates the source response omitted StorageClass. |  |
| 

`region` \*

 | `string` **|** `null` | AWS region of the parent S3 bucket. Null for legacy buckets without a recorded region. |  |
| 

`ruleId` \*

 | `string` **|** `null` | AWS-side rule identifier (rule.ID). May be absent on rules created without an explicit ID — in that case the entity key falls back to an index-based synthesis. |  |
| 

`transitionCount` \*

 | `number` | Number of current-version transitions defined on this rule (rule.Transitions?.length ?? 0). Convenience for J1QL. |  |
| 

`transitionDates` \*

 | `array` **|** `null` | Absolute transition dates (epoch ms) for each transition (rule.Transitions\[\].Date). Index-aligned with transitionDays / transitionStorageClasses. A value of 0 at index i indicates that transition i is Days-based rather than Date-based; consult transitionDays\[i\] in that case. Null when there are no transitions. |  |
| 

`transitionDays` \*

 | `array` **|** `null` | Days after object creation for each transition (rule.Transitions\[\].Days). Parallel-array, index-aligned with transitionDates and transitionStorageClasses. A value of -1 at index i indicates that transition i is Date-based rather than Days-based; consult transitionDates\[i\] in that case. Null when there are no transitions. |  |
| 

`transitionStorageClasses` \*

 | `array` **|** `null` | Destination storage class for each transition (rule.Transitions\[\].StorageClass): one of STANDARD\_IA, ONEZONE\_IA, INTELLIGENT\_TIERING, GLACIER, GLACIER\_IR, DEEP\_ARCHIVE. Index-aligned with transitionDays / transitionDates. Empty string indicates the source response omitted StorageClass. |  |

---

### Aws Sagemaker Domain

`aws_sagemaker_domain` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`appNetworkAccessType` \*

 | `string` **|** `null` | Network egress mode for Studio apps: 'PublicInternetOnly' (SageMaker-managed VPC with direct internet access) or 'VpcOnly' (all traffic through the customer VPC). |  |
| 

`appSecurityGroupManagement` \*

 | `string` **|** `null` | Who creates and manages inter-app security groups in VpcOnly mode: 'Service' or 'Customer'. |  |
| 

`arn` \*

 | `string` | The ARN of the SageMaker domain. |  |
| 

`authMode` \*

 | `string` **|** `null` | How users authenticate into Studio: 'SSO' (IAM Identity Center) or 'IAM'. |  |
| 

`defaultSpaceExecutionRoleArn` \*

 | `string` **|** `null` | The default IAM execution role assumed by shared spaces in the domain. |  |
| 

`defaultSpaceSecurityGroupIds` \*

 | `array` **|** `null` | Default security groups applied to shared spaces in the domain. |  |
| 

`defaultUserExecutionRoleArn` \*

 | `string` **|** `null` | The default IAM execution role assumed by user profiles that do not override it. |  |
| 

`defaultUserSecurityGroupIds` \*

 | `array` **|** `null` | Default security groups applied to user-profile apps. |  |
| 

`dockerTrustedAccountIds` \*

 | `array` **|** `null` | AWS account IDs trusted to serve Docker images to this domain in VpcOnly mode — a cross-account trust list. |  |
| 

`domainId` \*

 | `string` | The SageMaker-assigned domain identifier (e.g. d-abc123defghi). |  |
| 

`domainSecurityGroupIds` \*

 | `array` **|** `null` | Domain-level security groups governing traffic between domain-level apps and user apps. |  |
| 

`executionRoleIdentityConfig` \*

 | `string` **|** `null` | Whether the user profile name is stamped onto assumed-role sessions as sts:SourceIdentity ('USER\_PROFILE\_NAME') or not ('DISABLED'). When DISABLED, CloudTrail cannot attribute Studio actions to an individual user. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the domain failed to provision, when applicable. |  |
| 

`homeEfsFileSystemId` \*

 | `string` **|** `null` | The ID of the EFS file system managed by the domain, which stores all user notebooks and code. |  |
| 

`homeEfsFileSystemKmsKeyId` \*

 | `string` **|** `null` | Deprecated by AWS in favour of kmsKeyId; usually absent on modern domains. Absence does not mean unencrypted. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isDockerAccessEnabled` \*

 | `boolean` **|** `null` | Whether local Docker interaction is enabled for Studio apps in this domain, which expands the container-escape surface. |  |
| 

`isPublicInternetAccessEnabled` \*

 | `boolean` | Whether Studio apps in this domain reach the internet directly through the SageMaker-managed VPC rather than being confined to the customer VPC. Describes egress, not inbound reachability. Defaults to true when AppNetworkAccessType is absent, matching the AWS default of PublicInternetOnly. |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key used to encrypt the EFS volume attached to the domain. Absence means an AWS-managed key is used, not that the volume is unencrypted. |  |
| 

`region` \*

 | `string` | The AWS region hosting the domain. |  |
| 

`securityGroupIdForDomainBoundary` \*

 | `string` **|** `null` | The security group authorizing traffic between RSessionGateway apps and the RStudioServerPro app. |  |
| 

`subnetIds` \*

 | `array` **|** `null` | The VPC subnet IDs the domain uses for communication. |  |
| 

`url` \*

 | `string` **|** `null` | The Studio entry-point URL for the domain. |  |
| 

`vpcId` \*

 | `string` **|** `null` | The ID of the VPC the domain uses for communication. |  |

---

### Aws Sagemaker Endpoint

`aws_sagemaker_endpoint` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` |  |  |
| `createdOn` | `number` |  |  |
| `dataCaptureDestinationS3Uri` | `string` | The S3 URI where captured inference payloads are written. |  |
| `dataCaptureKmsKeyId` | `string` | The customer-managed KMS key used to encrypt captured inference data. May be a key ID, key ARN, alias, or alias ARN. Absence means an AWS-managed key is used, not that the data is unencrypted. |  |
| `dataCaptureModes` | `array` of `string`s | Which payloads are captured: 'Input', 'Output', or both. |  |
| `dataCaptureSamplingPercentage` | `number` | Percentage of live inference traffic persisted to S3, which may include sensitive payloads. |  |
| 

`displayName` \*

 | `string` |  |  |
| `endpointConfigName` | `string` |  |  |
| 

`endpointName` \*

 | `string` |  |  |
| `executionRoleArn` | `string` |  |  |
| `failureReason` | `string` |  |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| `isDataCaptureEnabled` | `boolean` | Whether inference request/response payloads are captured to S3. False when no DataCaptureConfig is configured on the endpoint config. |  |
| `kmsKeyId` | `string` |  |  |
| `modelNames` | `array` of `string`s |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| `updatedOn` | `number` |  |  |
| `vpcSecurityGroupIds` | `array` of `string`s |  |  |
| `vpcSubnets` | `array` of `string`s |  |  |
| 

`webLink` \*

 | `string` |  |  |

---

### Aws Sagemaker Feature Group

`aws_sagemaker_feature_group` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the feature group. |  |
| 

`eventTimeFeatureName` \*

 | `string` **|** `null` | The name of the feature holding the event time of each record. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the feature group failed to be created, when applicable. |  |
| 

`featureCount` \*

 | `number` | The number of feature definitions declared on the feature group. |  |
| 

`featureGroupName` \*

 | `string` | The name of the feature group. |  |
| 

`glueCatalog` \*

 | `string` **|** `null` | The Glue data catalog the offline store is registered in, which governs who can query the data through Athena. |  |
| 

`glueDatabase` \*

 | `string` **|** `null` | The Glue database containing the offline store table. |  |
| 

`glueTableName` \*

 | `string` **|** `null` | The Glue table exposing the offline store. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isCustomerManagedKeyEncrypted` \*

 | `boolean` | Whether at least one store is encrypted with a customer-managed KMS key. Both stores are always encrypted at rest with an AWS-managed key when this is false. |  |
| 

`isGlueTableCreationDisabled` \*

 | `boolean` | Whether automatic Glue table creation for the offline store is disabled. |  |
| 

`isOnlineStoreEnabled` \*

 | `boolean` | Whether a low-latency online serving store exists for this feature group. |  |
| 

`offlineStoreBlockedReason` \*

 | `string` **|** `null` | Why replication into the offline store is blocked, when applicable. |  |
| 

`offlineStoreKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the offline S3 store. Absence means an AWS-managed key is used, not that the store is unencrypted. |  |
| 

`offlineStoreResolvedS3Uri` \*

 | `string` **|** `null` | The resolved S3 prefix feature records physically land in. |  |
| 

`offlineStoreS3Uri` \*

 | `string` **|** `null` | The S3 URI the offline store writes feature records to. |  |
| 

`offlineStoreStatus` \*

 | `string` **|** `null` | Whether replication into the offline store is 'Active', 'Blocked' or 'Disabled'. A blocked store silently loses data. |  |
| 

`onlineStoreKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the online store. Absence means an AWS-managed key is used, not that the store is unencrypted. |  |
| 

`onlineStoreStorageType` \*

 | `string` **|** `null` | The storage backing the online store: 'Standard' or 'InMemory'. |  |
| 

`onlineStoreTotalSizeBytes` \*

 | `number` **|** `null` | The total size of the online store in bytes, i.e. the volume of data at risk. |  |
| 

`recordIdentifierFeatureName` \*

 | `string` **|** `null` | The name of the feature that uniquely identifies a record in the feature group. |  |
| 

`region` \*

 | `string` | The AWS region hosting the feature group. |  |
| 

`roleArn` \*

 | `string` **|** `null` | The IAM role Feature Store assumes to persist records into the offline S3 store. |  |
| 

`tableFormat` \*

 | `string` **|** `null` | The table format of the offline store: 'Default' (Glue) or 'Iceberg'. |  |
| 

`ttlDurationUnit` \*

 | `string` **|** `null` | The unit of the default online store record time-to-live: 'Seconds', 'Minutes', 'Hours', 'Days' or 'Weeks'. |  |
| 

`ttlDurationValue` \*

 | `number` **|** `null` | The value of the default online store record time-to-live, expressed in ttlDurationUnit. |  |

---

### Aws Sagemaker Model

`aws_sagemaker_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` |  |  |
| 

`containerCount` \*

 | `number` |  |  |
| 

`createdOn` \*

 | `number` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`executionRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`inferenceExecutionMode` \*

 | `string` **|** `null` |  |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isNetworkIsolationEnabled` \*

 | `boolean` |  |  |
| 

`modelName` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`primaryContainerHostname` \*

 | `string` **|** `null` |  |  |
| 

`primaryContainerImage` \*

 | `string` **|** `null` |  |  |
| 

`primaryContainerMode` \*

 | `string` **|** `null` |  |  |
| 

`primaryContainerModelDataUrl` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`vpcSubnets` \*

 | `array` **|** `null` |  |  |
| 

`webLink` \*

 | `string` |  |  |

---

### Aws Sagemaker Processing Job

`aws_sagemaker_processing_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the SageMaker processing job. |  |
| 

`endedOn` \*

 | `number` **|** `null` | The time processing ended, in milliseconds since the epoch. |  |
| 

`exitMessage` \*

 | `string` **|** `null` | An optional string the processing container wrote on exit, describing the outcome. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the processing job failed, when applicable. |  |
| 

`imageUri` \*

 | `string` **|** `null` | The container image registry path used to run the processing job. Custom or unvetted images are a supply-chain signal. |  |
| 

`instanceCount` \*

 | `number` **|** `null` | The number of ML compute instances used for processing. |  |
| 

`instanceType` \*

 | `string` **|** `null` | The ML compute instance type used for processing. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isInterContainerTrafficEncryptionEnabled` \*

 | `boolean` | Whether traffic between the nodes of a distributed processing job is encrypted in transit. |  |
| 

`isNetworkIsolationEnabled` \*

 | `boolean` | Whether the processing container is isolated from the network, preventing outbound calls from the container. |  |
| 

`outputKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the processing outputs written to S3. Absence means an AWS-managed key is used, not that the output is unencrypted. |  |
| 

`outputS3Uris` \*

 | `array` **|** `null` | The S3 URIs the processing job writes its outputs to. Processing jobs are a common bulk data egress path. |  |
| 

`processingJobName` \*

 | `string` | The name of the processing job. |  |
| 

`region` \*

 | `string` | The AWS region the processing job ran in. |  |
| 

`roleArn` \*

 | `string` **|** `null` | The IAM execution role assumed by the processing job to read input data and write results. |  |
| 

`startedOn` \*

 | `number` **|** `null` | The time processing started, in milliseconds since the epoch. |  |
| 

`volumeKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the ML storage volume attached to the processing instances. Absence means an AWS-managed key is used, not that the volume is unencrypted. |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` | The security group IDs applied to the processing containers inside the customer VPC. |  |
| 

`vpcSubnets` \*

 | `array` **|** `null` | The VPC subnet IDs the processing containers were attached to. Absent when the job ran outside a customer VPC. |  |

---

### Aws Sagemaker Training Job

`aws_sagemaker_training_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the SageMaker training job. |  |
| 

`checkpointS3Uri` \*

 | `string` **|** `null` | The S3 URI training checkpoints are written to — a second, frequently overlooked sink for training data. |  |
| 

`endedOn` \*

 | `number` **|** `null` | The time training ended, in milliseconds since the epoch. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the training job failed, when applicable. |  |
| 

`instanceCount` \*

 | `number` **|** `null` | The number of ML compute instances used for training. |  |
| 

`instanceType` \*

 | `string` **|** `null` | The ML compute instance type used for training. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isInterContainerTrafficEncryptionEnabled` \*

 | `boolean` | Whether traffic between the nodes of a distributed training job is encrypted in transit. |  |
| 

`isManagedSpotTrainingEnabled` \*

 | `boolean` | Whether the job used managed spot instances, which explains interruptions and availability gaps. |  |
| 

`isNetworkIsolationEnabled` \*

 | `boolean` | Whether the training container is isolated from the network, preventing outbound calls from the algorithm container. |  |
| 

`modelArtifactsS3Uri` \*

 | `string` **|** `null` | The S3 URI of the model artifacts actually produced by the training job. |  |
| 

`outputKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the model artifacts written to S3. Absence means an AWS-managed key is used, not that the output is unencrypted. |  |
| 

`outputS3Path` \*

 | `string` **|** `null` | The S3 path the training job writes its model artifacts to. |  |
| 

`region` \*

 | `string` | The AWS region the training job ran in. |  |
| 

`roleArn` \*

 | `string` **|** `null` | The IAM execution role assumed by the training job to read input data and write model artifacts. |  |
| 

`secondaryStatus` \*

 | `string` **|** `null` | The detailed job substatus, which distinguishes cases such as 'Interrupted' and 'MaxRuntimeExceeded'. |  |
| 

`startedOn` \*

 | `number` **|** `null` | The time training started, in milliseconds since the epoch. |  |
| 

`trainingImage` \*

 | `string` **|** `null` | The container image registry path used to train the model. Custom or unvetted images are a supply-chain signal. |  |
| 

`trainingJobName` \*

 | `string` | The name of the training job. |  |
| 

`volumeKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the ML storage volume attached to the training instances. Absence means an AWS-managed key is used, not that the volume is unencrypted. |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` | The security group IDs applied to the training containers inside the customer VPC. |  |
| 

`vpcSubnets` \*

 | `array` **|** `null` | The VPC subnet IDs the training containers were attached to. Absent when the job ran outside a customer VPC. |  |

---

### Aws Sagemaker Transform Job

`aws_sagemaker_transform_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the SageMaker batch transform job. |  |
| 

`dataCaptureDestinationS3Uri` \*

 | `string` **|** `null` | The S3 URI captured batch inference payloads are written to. |  |
| 

`dataCaptureKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting captured batch inference data. Absence means an AWS-managed key is used, not that the data is unencrypted. |  |
| 

`endedOn` \*

 | `number` **|** `null` | The time the transform job ended, in milliseconds since the epoch. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the transform job failed, when applicable. |  |
| 

`inputS3Uri` \*

 | `string` **|** `null` | The S3 URI of the dataset the transform job reads. |  |
| 

`instanceCount` \*

 | `number` **|** `null` | The number of ML compute instances used for the transform job. |  |
| 

`instanceType` \*

 | `string` **|** `null` | The ML compute instance type used for the transform job. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isDataCaptureEnabled` \*

 | `boolean` | Whether inference inputs and outputs are captured to S3. Batch data capture has no explicit enable flag — the presence of the capture configuration is the signal. |  |
| 

`modelName` \*

 | `string` | The name of the SageMaker model used for inference. The model carries the execution role, VPC and network isolation posture of the job. |  |
| 

`outputKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the inference results written to S3. Absence means an AWS-managed key is used, not that the output is unencrypted. |  |
| 

`outputS3Path` \*

 | `string` **|** `null` | The S3 path the transform job writes inference results to. |  |
| 

`region` \*

 | `string` | The AWS region the transform job ran in. |  |
| 

`startedOn` \*

 | `number` **|** `null` | The time the transform job started, in milliseconds since the epoch. |  |
| 

`transformJobName` \*

 | `string` | The name of the batch transform job. |  |
| 

`volumeKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the ML storage volume attached to the transform instances. Absence means an AWS-managed key is used, not that the volume is unencrypted. |  |

---

### Aws Secret

`aws_secret` inherits from [Secret](/data-model/schemas/Secret.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| `encryptionKeyRef` | `string` |  |  |
| `kmsKeyId` | `string` |  |  |
| `lastAccessedDate` | `number` |  |  |
| `lastChangedDate` | `number` |  |  |
| `lastRotatedDate` | `number` |  |  |
| `nextRotationDate` | `number` |  |  |
| `owningService` | `string` |  |  |
| `policyDocument` | `string` |  |  |
| `primaryRegion` | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| `replicationStatus` | `array` of `string`s |  |  |
| `rotateAutomaticallyAfterDays` | `number` |  |  |
| `rotationEnabled` | `boolean` |  |  |
| `rotationLambdaArn` | `string` |  |  |
| `rotationScheduleExpression` | `string` |  |  |
| `rotationWindow` | `string` |  |  |
| `versionIdsToStages` | `string` |  |  |

---

### Aws Secret Version

`aws_secret_version` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `lastAccessedDate` | `number` |  |  |
| 
`versionId` \*

 | `string` |  |  |
| `versionStages` | `array` of `string`s |  |  |

---

### Aws Securityhub Account

`aws_securityhub_account` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`controlFindingGenerator` \*

 | `string` **|** `null` |  |  |
| 

`isAutoEnableControlsEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isEnabled` \*

 | `boolean` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`subscribedOn` \*

 | `number` **|** `null` |  |  |

---

### Aws Securityhub Finding

`aws_securityhub_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `companyName` | `string` |  |  |
| `complianceStatus` | `string` |  |  |
| `confidence` | `number` |  |  |
| `criticality` | `number` |  |  |
| `generatorId` | `string` |  |  |
| `id` | `string` |  |  |
| `productArn` | `string` |  |  |
| `productName` | `string` |  |  |
| `recordState` | `string` |  |  |
| `region` | `string` |  |  |
| `remediationUrl` | `string` |  |  |
| `resourceIds` | `array` of `string`s |  |  |
| `resourceTypes` | `array` of `string`s |  |  |
| `sourceUrl` | `string` |  |  |
| `state` | `string` |  |  |
| `types` | `array` of `string`s |  |  |
| `workflowState` | `string` |  |  |
| `workflowStatus` | `string` |  |  |

---

### Aws Securityhub Finding

`aws_securityhub_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `companyName` | `string` |  |  |
| `complianceStatus` | `string` |  |  |
| `confidence` | `number` |  |  |
| `criticality` | `number` |  |  |
| `generatorId` | `string` |  |  |
| `id` | `string` |  |  |
| `productArn` | `string` |  |  |
| `productName` | `string` |  |  |
| `recordState` | `string` |  |  |
| `region` | `string` |  |  |
| `remediationUrl` | `string` |  |  |
| `resourceIds` | `array` of `string`s |  |  |
| `resourceTypes` | `array` of `string`s |  |  |
| `sourceUrl` | `string` |  |  |
| `state` | `string` |  |  |
| `types` | `array` of `string`s |  |  |
| `workflowState` | `string` |  |  |
| `workflowStatus` | `string` |  |  |

---

### Aws Servicecatalog Constraint

`aws_servicecatalog_constraint` inherits from [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`constraintId` \*

 | `string` | The ID of the Service Catalog constraint. |  |
| 

`constraintParameters` \*

 | `string` **|** `null` | The constraint parameters as a raw JSON string. Structure varies by constraint type. |  |
| 

`productId` \*

 | `string` **|** `null` | The ID of the product this constraint applies to, if product-specific. |  |
| 

`region` \*

 | `string` | AWS region where the constraint is defined. |  |
| 

`type` \*

 | `string` | The type of constraint (LAUNCH, NOTIFICATION, RESOURCE\_UPDATE, STACKSET, TEMPLATE, TAG). |  |

---

### Aws Servicecatalog Launch Path

`aws_servicecatalog_launch_path` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`constraintTypes` \*

 | `array` **|** `null` | The types of constraint applied along this launch path (e.g. LAUNCH, NOTIFICATION, TEMPLATE, STACKSET). The constraint descriptions are not duplicated here; they are carried on the corresponding aws\_servicecatalog\_constraint entities. |  |
| 

`pathId` \*

 | `string` | The ID of the launch path. |  |
| 

`region` \*

 | `string` | AWS region where the launch path is available. |  |

---

### Aws Servicecatalog Portfolio

`aws_servicecatalog_portfolio` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the Service Catalog portfolio. |  |
| 

`portfolioId` \*

 | `string` | The ID of the Service Catalog portfolio. |  |
| 

`providerName` \*

 | `string` **|** `null` | The name of the person or organization who owns the portfolio. |  |
| 

`region` \*

 | `string` | AWS region where the portfolio is defined. |  |

---

### Aws Servicecatalog Product

`aws_servicecatalog_product` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the Service Catalog product. |  |
| 

`distributor` \*

 | `string` **|** `null` | The distributor of the product. |  |
| 

`hasDefaultPath` \*

 | `boolean` **|** `null` | Whether the product has a default launch path. |  |
| 

`productId` \*

 | `string` | The ID of the Service Catalog product. |  |
| 

`region` \*

 | `string` | AWS region where the product is defined. |  |
| 

`supportDescription` \*

 | `string` **|** `null` | The support information about the product, as supplied by the administrator. |  |
| 

`supportEmail` \*

 | `string` **|** `null` | The email address of the support contact for the product. |  |
| 

`supportUrl` \*

 | `string` **|** `null` | The URL for product support. |  |
| 

`type` \*

 | `string` **|** `null` | The product type (e.g. CLOUD\_FORMATION\_TEMPLATE, TERRAFORM\_OPEN\_SOURCE). |  |

---

### Aws Servicecatalog Provisioning Artifact

`aws_servicecatalog_provisioning_artifact` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`artifactId` \*

 | `string` | The ID of the provisioning artifact. |  |
| 

`guidance` \*

 | `string` **|** `null` | The guidance for the provisioning artifact (DEFAULT or DEPRECATED). |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether this provisioning artifact is active. |  |
| 

`region` \*

 | `string` | AWS region where the provisioning artifact is defined. |  |
| 

`sourceRevision` \*

 | `string` **|** `null` | The source revision of the provisioning artifact. |  |
| 

`type` \*

 | `string` **|** `null` | The type of provisioning artifact (CLOUD\_FORMATION\_TEMPLATE, TERRAFORM\_OPEN\_SOURCE, etc.). |  |

---

### Aws Servicecatalog Tag Option

`aws_servicecatalog_tag_option` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isActive` \*

 | `boolean` **|** `null` | Whether this TagOption is active. |  |
| 

`key` \*

 | `string` | The TagOption key. |  |
| 

`region` \*

 | `string` | AWS region where the TagOption is defined. |  |
| 

`tagOptionId` \*

 | `string` | The ID of the TagOption. |  |
| 

`value` \*

 | `string` **|** `null` | The TagOption value. |  |

---

### Aws States State Machine

`aws_states_state_machine` inherits from [Function](/data-model/schemas/Function.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`availabilityZone` \*

 | `string` **|** `null` |  |  |
| 

`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`definition` \*

 | `string` **|** `null` |  |  |
| 

`description` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` **|** `null` |  |  |
| 

`encryptedkeyref` \*

 | `string` **|** `null` |  |  |
| 

`encryptionKmsDataKeyReusePeriodSeconds` \*

 | `number` **|** `null` |  |  |
| 

`encryptionKmsKeyId` \*

 | `string` **|** `null` |  |  |
| 

`encryptionType` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` |  |  |
| 

`isExecutionDataIncluded` \*

 | `boolean` **|** `null` |  |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isTracingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isVariableReferencesPresent` \*

 | `boolean` **|** `null` |  |  |
| 

`label` \*

 | `string` **|** `null` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`loggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`loggingLevel` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`revisionId` \*

 | `string` **|** `null` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`status` \*

 | `string` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |
| 

`variableReferencesCount` \*

 | `number` **|** `null` |  |  |

---

### Aws Storage Gateway File Share

`aws_storage_gateway_file_share` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`auditDestinationArn` \*

 | `null` **|** `string` |  |  |
| 

`authentication` \*

 | `null` **|** `string` |  |  |
| 

`clientList` \*

 | `null` **|** `array` |  |  |
| 

`defaultStorageClass` \*

 | `null` **|** `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`fileShareId` \*

 | `string` |  |  |
| 

`fileShareStatus` \*

 | `null` **|** `string` |  |  |
| 

`gatewayArn` \*

 | `string` |  |  |
| 

`isAccessBasedEnumeration` \*

 | `null` **|** `boolean` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isEncrypted` \*

 | `null` **|** `boolean` |  |  |
| 

`isLoggingEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`isReadOnly` \*

 | `null` **|** `boolean` |  |  |
| 

`isSmbAclEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`locationArn` \*

 | `null` **|** `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`protocol` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `null` **|** `string` |  |  |
| 

`squash` \*

 | `null` **|** `string` |  |  |

---

### Aws Storage Gateway Gateway

`aws_storage_gateway_gateway` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`availabilityZone` \*

 | `null` **|** `string` |  |  |
| 

`category` \*

 | `array` of `string`s |  |  |
| 

`cloudWatchLogGroupArn` \*

 | `null` **|** `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`ec2InstanceId` \*

 | `null` **|** `string` |  |  |
| 

`endpointType` \*

 | `null` **|** `string` |  |  |
| 

`function` \*

 | `array` of `string`s |  |  |
| 

`gatewayId` \*

 | `string` |  |  |
| 

`gatewayState` \*

 | `null` **|** `string` |  |  |
| 

`gatewayTimezone` \*

 | `null` **|** `string` |  |  |
| 

`gatewayType` \*

 | `string` |  |  |
| 

`hostEnvironment` \*

 | `null` **|** `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isLoggingEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`public` \*

 | `boolean` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`softwareVersion` \*

 | `null` **|** `string` |  |  |
| 

`vpcEndpoint` \*

 | `null` **|** `string` |  |  |
| 

`vpcId` \*

 | `null` **|** `string` |  |  |

---

### Aws Storage Gateway Tape

`aws_storage_gateway_tape` inherits from [DataStore](/data-model/schemas/DataStore.md), [Backup](/data-model/schemas/Backup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`completedOn` \*

 | `null` **|** `number` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`gatewayArn` \*

 | `null` **|** `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isArchived` \*

 | `null` **|** `boolean` |  |  |
| 

`isEncrypted` \*

 | `null` **|** `boolean` |  |  |
| 

`isWorm` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`poolId` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`tapeBarcode` \*

 | `string` |  |  |
| 

`tapeSizeInBytes` \*

 | `null` **|** `number` |  |  |
| 

`tapeStatus` \*

 | `string` |  |  |
| 

`tapeUsedInBytes` \*

 | `null` **|** `number` |  |  |

---

### Aws Storage Gateway Tape Pool

`aws_storage_gateway_tape_pool` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`poolId` \*

 | `string` |  |  |
| 

`poolStatus` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`retentionLockTimeInDays` \*

 | `null` **|** `number` |  |  |
| 

`retentionLockType` \*

 | `null` **|** `string` |  |  |
| 

`storageClass` \*

 | `null` **|** `string` |  |  |

---

### Aws Storage Gateway Volume

`aws_storage_gateway_volume` inherits from [DataStore](/data-model/schemas/DataStore.md), [Disk](/data-model/schemas/Disk.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`gatewayArn` \*

 | `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isChapEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`isEncrypted` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`targetArn` \*

 | `null` **|** `string` |  |  |
| 

`volumeDiskId` \*

 | `null` **|** `string` |  |  |
| 

`volumeId` \*

 | `string` |  |  |
| 

`volumeSizeInBytes` \*

 | `null` **|** `number` |  |  |
| 

`volumeStatus` \*

 | `null` **|** `string` |  |  |
| 

`volumeType` \*

 | `string` |  |  |
| 

`volumeUsedInBytes` \*

 | `null` **|** `number` |  |  |

---

### Aws Vpc Lattice Listener

`aws_vpc_lattice_listener` inherits from [NetworkEndpoint](/data-model/schemas/NetworkEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`createdAt` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lastUpdatedAt` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`port` \*

 | `number` **|** `null` |  |  |
| 

`protocol` \*

 | `string` **|** `null` |  | **Any of**:

-   `HTTP`

-   `HTTPS`

-   `TLS_PASSTHROUGH`

-   `undefined`

 |
| 

`region` \*

 | `string` |  |  |
| 

`serviceArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Vpc Lattice Listener Rule

`aws_vpc_lattice_listener_rule` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`createdAt` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isDefault` \*

 | `boolean` **|** `null` |  |  |
| 

`lastUpdatedAt` \*

 | `string` **|** `null` |  |  |
| 

`listenerArn` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`priority` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceArn` \*

 | `string` **|** `null` |  |  |
| 

`statusCode` \*

 | `number` **|** `null` |  |  |
| 

`targetGroupIdentifiers` \*

 | `array` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  | **Any of**:

-   `ForwardMember`

-   `FixedResponseMember`

-   `undefined`

 |

---

### Aws Vpc Lattice Service

`aws_vpc_lattice_service` inherits from [ApplicationEndpoint](/data-model/schemas/ApplicationEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`customDomainName` \*

 | `string` **|** `null` |  |  |
| 

`domainName` \*

 | `string` **|** `null` |  |  |
| 

`hostedZoneId` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Vpc Lattice Service Network

`aws_vpc_lattice_service_network` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`createdAt` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lastUpdatedAt` \*

 | `string` **|** `null` |  |  |
| 

`numberOfAssociatedResourceConfigurations` \*

 | `number` **|** `null` |  |  |
| 

`numberOfAssociatedServices` \*

 | `number` **|** `null` |  |  |
| 

`numberOfAssociatedVPCs` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Vpc Lattice Target Group

`aws_vpc_lattice_target_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`createdAt` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`ipAddressType` \*

 | `string` **|** `null` |  | **Any of**:

-   `IPV4`

-   `IPV6`

-   `undefined`

 |
| 

`lambdaEventStructureVersion` \*

 | `string` **|** `null` |  | **Any of**:

-   `V1`

-   `V2`

-   `undefined`

 |
| 

`lastUpdatedAt` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`port` \*

 | `number` **|** `null` |  |  |
| 

`protocol` \*

 | `string` **|** `null` |  | **Any of**:

-   `NOT_SET`

-   `HTTP`

-   `HTTPS`

-   `TCP`

-   `undefined`

 |
| 

`region` \*

 | `string` |  |  |
| 

`serviceArns` \*

 | `array` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  | **Any of**:

-   `NOT_SET`

-   `ACTIVE`

-   `CREATE_FAILED`

-   `CREATE_IN_PROGRESS`

-   `DELETE_FAILED`

-   `DELETE_IN_PROGRESS`

-   `undefined`

 |
| 

`type` \*

 | `string` **|** `null` |  | **Any of**:

-   `NOT_SET`

-   `ALB`

-   `INSTANCE`

-   `IP`

-   `LAMBDA`

-   `undefined`

 |
| 

`vpcIdentifier` \*

 | `string` **|** `null` |  |  |

---

### Aws Waf V2 Ip Set

`aws_waf_v2_ip_set` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `addresses` | `array` of `string`s |  |  |
| `arn` | `string` |  |  |
| `description` | `string` |  |  |
| `id` | `string` |  |  |
| `ipAddressVersion` | `string` |  | **Any of**:
-   `IPV4`

-   `IPV6`

 |
| `region` | `string` |  |  |

---

### Aws Waf V2 Rule Group

`aws_waf_v2_rule_group` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `capacity` | `number` |  |  |
| `description` | `string` |  |  |
| `id` | `string` |  |  |
| `isVisibilityConfigCloudWatchMetricsEnabled` | `boolean` |  |  |
| `isVisibilityConfigSampledRequestsEnabled` | `boolean` |  |  |
| `labelNamespace` | `string` |  |  |
| `region` | `string` |  |  |
| `ruleCount` | `number` |  |  |
| `scope` | `string` |  |  |
| `visibilityConfigMetricName` | `string` |  |  |
| `webLink` | `string` |  |  |

---

---

Source: /integrations/directory/hackerone

# HackerOne

Visualize HackerOne bounty programs and findings, and monitor changes through queries and alerts.

## Installation

To use this integration JupiterOne requires an **API key**, **API key name**, and the **Program handle** of your HackerOne program.

> **INFO**
> 
> HackerOne provides [detailed instructions on creating an API token](https://docs.hackerone.com/organizations/api-tokens.html) within your HackerOne account. When selecting the programs and groups you want to add, choose `Admin`.

### Configuration in JupiterOne

To install the HackerOne integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select HackerOne. Click **New Instance** to begin configuring your integration with the following settings:

-   Account Name by which you want to identify this HackerOne account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when Tag with Account Name is selected.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Select a Polling Interval that you feel is sufficient for your monitoring needs. You can leave this as `DISABLED` and manually execute the integration.
    
-   Enter the **API Key** and **API Key Name** to authenticate with HackerOne.
    
-   Enter the **Program Handle** or name of your HackerOne program.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Finding | `hackerone_report` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Finding | `hackerone_report` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Finding | `hackerone_report` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Weakness](https://docs.jupiterone.io/data-model/schemas/Weakness) |
| Service | `hackerone_program` | [Service](https://docs.jupiterone.io/data-model/schemas/Service), [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `hackerone_program` | **HAS** | `hackerone_report` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `hackerone_report` | **HAS** | `cwe` | FORWARD |
| `hackerone_report` | **HAS** | `cve` | FORWARD |

### Hackerone Report

`hackerone_report` inherits from [Finding](/data-model/schemas/Finding.md)

---

### Hackerone Report

`hackerone_report` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

---

### Hackerone Report

`hackerone_report` inherits from [Finding](/data-model/schemas/Finding.md), [Weakness](/data-model/schemas/Weakness.md)

---

---

Source: /integrations/directory/haekka

# Haekka

The Haekka integration with JupiterOne enables organizations to map their security awareness training data, including employee training progress, phishing simulation results, and engagement metrics, to their broader security and compliance posture, providing a comprehensive view of their security culture and training effectiveness.

## Installation

### Requirements

-   User requires API key generated in Haekka Account
-   You must have permission in JupiterOne to install new integrations

### Configuration in Haekka

#### Create API Key

1.  Contact Haekka support to have API access enabled for your account
2.  Generate a new API key from your Haekka account
3.  Give the key an accurate name and store it in a secure location following your organization's security policies. Note: Haekka does not store API keys, so if lost, you will need to regenerate it

### Configuration in JupiterOne

1.  From the top navigation of the J1 Search homepage, select **Integrations**
2.  Search for the **Haekka** and select it
3.  Click on the **Add Instance** button and configure the following settings:

-   Enter the **Account Name** by which you'd like to identify this Haekka instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
-   Enter a **Description** that will further assist your team when identifying the integration instance.
-   Select a **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
-   Enter the **Haekka API Key** generated for use by JupiterOne.

4.  Click **Create Configuration** once all values are provided.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Employee | `haekka_employee` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Training | `haekka_training` | [Training](https://docs.jupiterone.io/data-model/schemas/Training) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `haekka_employee` | **ASSIGNED** | `haekka_training` |

### Haekka Employee

`haekka_employee` inherits from [User](/data-model/schemas/User.md)

---

### Haekka Training

`haekka_training` inherits from [Training](/data-model/schemas/Training.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`completionPercentage` \*

 | `number` |  |  |
| 

`employeesAssigned` \*

 | `number` |  |  |
| 

`employeesCompleted` \*

 | `number` |  |  |
| 

`employeesNotCompleted` \*

 | `number` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`numberOfLessons` \*

 | `number` |  |  |
| 

`renews` \*

 | `boolean` |  |  |
| `startedOn` | `number` |  |  |

---

---

Source: /integrations/directory/hashicorp-vault

# HashiCorp Vault

Visualize Hashicorp Vault users and secret engines, map Vault users to employees, and monitor changes through queries and alerts.

## Installation

This integration ingests HashiCorp Vault accounts, secret engines, secrets, auth backends, users, and OIDC identity entities. It supports both standalone (on-premise) and HashiCorp Vault Cloud (HCP). Two authentication methods are available: a static **Vault token** or **OIDC via Azure Entra ID**.

### Prerequisites

The Vault token or service principal you configure must have ACL policies granting the capabilities listed below. Add these rules to the policy attached to the token or Vault role.

**Token self-lookup (required for all deployments)**

```hcl
path "auth/token/lookup-self" {
  capabilities = ["read"]
}
```

**Mount discovery (required for all deployments)**

```hcl
path "sys/internal/ui/mounts" {
  capabilities = ["read"]
}
```

**Secret engines — one rule per engine you want to ingest (KV v1, KV v2, and Cubbyhole)**

```hcl
# KV v1 example
path "my-kv-engine/*" {
  capabilities = ["list"]
}

# KV v2 example (the metadata sub-path is also required)
path "my-kv2-engine/*" {
  capabilities = ["list"]
}
```

**Userpass auth method users — one pair of rules per userpass mount**

```hcl
path "auth/my-userpass/*" {
  capabilities = ["read", "list"]
}
```

**OIDC identity entities (only required when using the OIDC auth section, or if you want to ingest Vault identity records)**

```hcl
path "identity/entity/id" {
  capabilities = ["list"]
}

path "identity/entity/id/*" {
  capabilities = ["read"]
}
```

> **INFO**
> 
> For more information on HashiCorp Vault ACL policies, see the [Vault policies documentation](https://developer.hashicorp.com/vault/docs/concepts/policies).

### Configuration in HashiCorp Vault

Choose the authentication method that fits your deployment.

#### Option A: API Token

1.  Create or identify a Vault token whose policy includes the capabilities listed above.
2.  If you use Vault Enterprise or HCP Vault, note the **namespace** for your cluster (for example, `admin` or `admin/team-a`). The namespace is optional for standalone Vault.
3.  Note the **hostname** of your Vault cluster, including the `https://` scheme (for example, `https://vault.example.com:8200`).

> **TIP**
> 
> For more information on Vault tokens, see the [Vault tokens guide](https://developer.hashicorp.com/vault/tutorials/get-started/introduction-tokens).

#### Option B: OIDC via Azure Entra ID

This method obtains a short-lived Vault token by exchanging an Azure Entra ID client-credentials JWT for a Vault login token via a Vault JWT/OIDC auth method.

1.  In **Azure Entra ID**, create an app registration for the JupiterOne integration. Note the **Tenant ID**, **Client ID**, and create a **Client Secret**.
2.  In **HashiCorp Vault**, configure a JWT/OIDC auth method (for example, mounted at `jwt` or `oidc`). Create a role with:
    -   `role_type = "jwt"`
    -   `bound_issuer` set to `https://sts.windows.net/<your-tenant-id>/`
    -   `bound_audiences` set to the Entra Client ID (or the custom audience you specify in **Vault Audience**)
    -   The policy grants listed in the prerequisites above
3.  Note the **auth mount path** (for example, `jwt`). If left blank, it defaults to `oidc`.

### Configuration in JupiterOne

Navigate to the **Integrations** tab in JupiterOne and select **HashiCorp Vault**. Click **New Instance** and select an authentication section.

#### API Token

Creating an instance requires:

-   **HashiCorp Vault Hostname** — The full URL of your Vault cluster, including the `https://` scheme (for example, `https://vault.example.com:8200`).
-   **HashiCorp Vault Namespace** — The Vault namespace header value. Required for Vault Enterprise and HCP Vault clusters; leave blank for standalone Vault.
-   **HashiCorp Vault Token** — A static Vault token whose attached policy grants the capabilities listed in the prerequisites.

#### OIDC (Azure Entra ID)

Creating an instance requires:

-   **HashiCorp Vault Hostname** — The full URL of your Vault cluster, including the `https://` scheme.
-   **HashiCorp Vault Namespace** — The Vault namespace header value. Required for Vault Enterprise and HCP Vault; leave blank for standalone Vault.
-   **Entra Tenant ID** — The Azure Entra tenant ID (Directory ID) for your app registration.
-   **Entra Client ID** — The application (client) ID of the Entra app registration.
-   **Entra Client Secret** — A client secret value for the Entra app registration.
-   **Vault JWT/OIDC Role** — The name of the Vault JWT/OIDC role to log in as.
-   **Vault JWT/OIDC Mount Path** _(optional)_ — The auth mount path for the JWT/OIDC method (for example, `jwt` or `oidc`). Defaults to `oidc` when left blank.
-   **Vault Audience** _(optional)_ — The audience value the Vault role expects in the JWT `aud` claim. Falls back to the Entra Client ID when left blank.

Click **Create** once all required fields are provided.

### Next steps

After creating the instance, it will begin ingesting data on the polling interval you selected. Continue to the [Instance management guide](/integrations/instance-management.md) to learn more about working with integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (8)

-   `path "auth/token/lookup-self" { capabilities = ["read"] }`
-   `path "auth/{userpass_mount}/users" { capabilities = ["list"] }`
-   `path "auth/{userpass_mount}/users/*" { capabilities = ["read"] }`
-   `path "identity/entity/id" { capabilities = ["list"] }`
-   `path "identity/entity/id/*" { capabilities = ["read"] }`
-   `path "sys/internal/ui/mounts" { capabilities = ["read"] }`
-   `path "{cubbyhole_name}/*" { capabilities = ["list"] }`
-   `path "{engine_name}/*" { capabilities = ["list"] }`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (9)

-   `{hostname}/v1/auth/token/lookup-self`
-   `{hostname}/v1/auth/{userpass_mount}/users`
-   `{hostname}/v1/auth/{userpass_mount}/users/{username}`
-   `{hostname}/v1/identity/entity/id`
-   `{hostname}/v1/identity/entity/id/{id}`
-   `{hostname}/v1/sys/internal/ui/mounts`
-   `{hostname}/v1/{cubbyhole_name}`
-   `{hostname}/v1/{engine_name}`
-   `{hostname}/v1/{engine_name}/metadata`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (9)

-   [https://developer.hashicorp.com/vault/api-docs/auth/token#lookup-a-token-self](https://developer.hashicorp.com/vault/api-docs/auth/token#lookup-a-token-self)
-   [https://developer.hashicorp.com/vault/api-docs/auth/userpass](https://developer.hashicorp.com/vault/api-docs/auth/userpass)
-   [https://developer.hashicorp.com/vault/api-docs/secret/cubbyhole](https://developer.hashicorp.com/vault/api-docs/secret/cubbyhole)
-   [https://developer.hashicorp.com/vault/api-docs/secret/identity/entity](https://developer.hashicorp.com/vault/api-docs/secret/identity/entity)
-   [https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v1](https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v1)
-   [https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2](https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2)
-   [https://developer.hashicorp.com/vault/api-docs/system/internal-ui-mounts](https://developer.hashicorp.com/vault/api-docs/system/internal-ui-mounts)
-   [https://developer.hashicorp.com/vault/api-docs/system/mounts](https://developer.hashicorp.com/vault/api-docs/system/mounts)
-   [https://developer.hashicorp.com/vault/docs/concepts/policies](https://developer.hashicorp.com/vault/docs/concepts/policies)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `hashicorp_vault_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Authentication Backend | `hashicorp_vault_auth_backend` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Secret | `hashicorp_vault_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Secret Engine | `hashicorp_vault_engine` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `hashicorp_vault_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `hashicorp_vault_account` | **HAS** | `hashicorp_vault_user` |
| `hashicorp_vault_account` | **HAS** | `hashicorp_vault_engine` |
| `hashicorp_vault_account` | **HAS** | `hashicorp_vault_auth_backend` |
| `hashicorp_vault_auth_backend` | **HAS** | `hashicorp_vault_user` |
| `hashicorp_vault_engine` | **HAS** | `hashicorp_vault_secret` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `hashicorp_vault_user` | **IS** | `User` | FORWARD |

### Hashicorp Vault User

`hashicorp_vault_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `policies` | `array` of `string`s |  |  |

---

---

Source: /integrations/directory/heroku

# Heroku

Visualizes Heroku teams, users, applications, and services, map Heroku users to employees, and monitors changes through queries and alerts.

## Installation

To use this integration, JupiterOne requires an API key configured for read access in your Heroku account. The integration requires a Heroku Enterprise account and the `read` token scope. Optionally, use the `global` token scope to also fetch members of each Heroku team.

The Heroku account that generates the API key determines which permissions are available. For full access to all data (including application add-ons), the account must have the **admin** role. An account with the **member** role can retrieve most data, but add-on information is only accessible to admins.

> **INFO**
> 
> For additional information on creating an API key on Heroku, refer to the [Heroku authentication documentation](https://devcenter.heroku.com/articles/platform-api-quickstart#authentication).

### Configuration in JupiterOne

To install the Heroku integration in JupiterOne, navigate to the **Integrations** tab and select **Heroku**. Click **New Instance** to begin configuring your integration, providing the following:

-   **Account Name** — A label used to identify this integration instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **AccountName** toggle is enabled.
    
-   **Description** — An optional description to help distinguish this instance from others.
    
-   **Polling Interval** — How often JupiterOne should collect data from Heroku. You may leave this as `DISABLED` and trigger the integration manually.
    
-   **API Key** — Your Heroku API key, configured for the appropriate token scope (`read` for basic access; `global` if team member data is needed).
    

Click **Create Configuration** after all values are provided.

### Next steps

Once your integration instance is configured, it will begin running on the polling interval you selected. Continue on to our [instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Addon | `heroku_addon` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Application | `heroku_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Enterprise Account | `heroku_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Team | `heroku_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team) |
| User | `heroku_account_member` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `heroku_account` | **HAS** | `heroku_account_member` |
| `heroku_account` | **HAS** | `heroku_team` |
| `heroku_application` | **HAS** | `heroku_addon` |
| `heroku_team` | **OWNS** | `heroku_application` |
| `heroku_team` | **HAS** | `heroku_account_member` |

### Heroku Account Member

`heroku_account_member` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`enterpriseAccountId` \*

 | `string` |  |  |

---

---

Source: /integrations/directory/hexnode

# Hexnode

Visualize Hexnode's account, users, and device groups, map Hexnode users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to create an provide a Hexnode API key within JupiterOne.

### Configuration in Hexnode

To create a Hexnode API key for use with JupiterOne:

1.  In the Hexnode dashboard, go to **Admin > API**.
2.  Select **Enable API Access**.
3.  Generate an API key for use within JupiterOne.

> **INFO**
> 
> You can find additional information on API key creation on [Hexnode's documentation here](https://www.hexnode.com/mobile-device-management/developers/setting-up-an-api/authentication/).

### Configuration in JupiterOne

To install the Hexnode integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Hexnode. Click **New Instance** to begin configuring your integration with the following:

-   **Account Name** used to identify the Hexnode account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **Hexnode API key**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `hexnode_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device | `hexnode_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Device Group | `hexnode_device_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| User | `hexnode_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Group | `hexnode_user_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `hexnode_account` | **HAS** | `hexnode_user` |
| `hexnode_account` | **HAS** | `hexnode_user_group` |
| `hexnode_account` | **HAS** | `hexnode_device` |
| `hexnode_account` | **HAS** | `hexnode_device_group` |
| `hexnode_device_group` | **HAS** | `hexnode_device` |
| `hexnode_user` | **OWNS** | `hexnode_device` |
| `hexnode_user_group` | **HAS** | `hexnode_user` |

### Hexnode User

`hexnode_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `domain` | `string` |  |  |
| `phoneno` | `string` |  |  |
| `totalDevices` | `integer` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS type and details for Hexnode device entities, combining OS name and version.

---

Source: /integrations/directory/hibob

# HiBob

Visualize HiBob employees, departments, and time-off data in the JupiterOne graph. Map employees to their managers to build an organization chart, track time-off policies and requests, and monitor changes through custom queries and alerts.

# HiBob Integration Installation in JupiterOne

## Overview

This guide walks you through how to connect your **HiBob** account with **JupiterOne** to ingest and monitor your HR data.

The integration pulls employee profiles, departments, organizational hierarchy, time-off policies, and time-off requests from HiBob using a service user authenticated via the HiBob API.

### Prerequisites

-   A **HiBob** account with admin access.
-   Permission to create service users and permission groups in HiBob.
-   Access to **JupiterOne** with permission to configure integrations.

## Set Up in HiBob

### Step 1: Create a Service User

1.  Log in to your HiBob account as an administrator.
2.  Navigate to **Settings** > **Integrations** > **Service Users**.
3.  Click **Add a New Service User** and provide a name (e.g., "JupiterOne").
4.  Generate an API token for the service user.
5.  Copy the **Service Account ID** and **Token** — save them securely. You will need both when configuring the integration in JupiterOne.

Refer to the [HiBob Service Users documentation](https://apidocs.hibob.com/docs/api-service-users) for more details.

### Step 2: Configure Service User Permissions

By default, HiBob service users have **no access permissions**. You must create a dedicated permission group and assign the appropriate permissions for the integration to work correctly.

1.  In HiBob, go to **Settings** > **Permissions** > **Permission Groups**.
2.  Create a new permission group (e.g., "JupiterOne Integration").
3.  Add the service user you created in Step 1 to this group.
4.  Grant the following permissions:

#### People's Data Permissions (Required)

The integration needs **View** access to employee data categories to read employee profiles, departments, and management hierarchy.

| Permission Category | Access Level | Purpose |
| --- | --- | --- |
| **Basic Info** (`root`) | View | Access employee names and core identity fields |
| **About** | View | Access personal information fields |
| **Employment** | View | Access employment-related data |
| **Work** | View | Access department, job title, site, start date, and manager (reports-to) information |
| **Lifecycle** | View | Access employee status and lifecycle status |
| **Personal > Communication** | View | Access work phone and mobile phone numbers |
| **Time Off > See who's out today** | View | Access time-off requests (select **See who's out**) |

> **NOTE**
> 
> HiBob permissions are assigned at the **category** level, not at the individual field level. Granting View access to a category provides access to all fields within that category.

> **NOTE**
> 
> HiBob returns a 200 OK response even when permissions are incomplete — fields the service user cannot access are silently omitted from the response. Verify that all expected data appears in JupiterOne after the first ingestion.

#### Feature Permissions (Required)

| Feature | Permission | Purpose |
| --- | --- | --- |
| **Time Off > Settings** | Manage company's time off settings | Access time-off policy types and policy definitions |

#### Access Rights

Under **Access Rights**, ensure the service user has access to **Everyone** (all active employees).

> **TIP**
> 
> The integration fetches only active employees (`showInactive: false`). You do not need to grant access to inactive employees.

## Data Volume Configuration

Control how much historical time-off request data is ingested from HiBob.

| Field | Description | Default |
| --- | --- | --- |
| **Time Off Requests Ingest Since Days** | Number of days of historical time-off request data to ingest | 365 |

Increasing this value will ingest more time-off request data, which increases the number of entities stored in JupiterOne.

## Configure Integration in JupiterOne

1.  In JupiterOne, go to the left navigation menu and click **Integrations**.
    
2.  Scroll to the **HiBob** integration tile and click it.
    
3.  Click **Add Configuration** and fill in the fields:
    
    | Field | What to Enter |
    | --- | --- |
    | **Account Name** | A friendly name to identify this HiBob account in JupiterOne (stored in `tag.AccountName`) |
    | **Description** | Optional notes to help identify this integration instance |
    | **Polling Interval** | How often to collect data (or choose `DISABLED` to run manually) |
    | **Service Account ID** | The Service Account ID from your HiBob service user |
    | **Service Account Token** | The API token generated for your HiBob service user |
    | **Time Off Requests Ingest Since Days** | Optional — number of days of time-off request history to ingest (default: 365) |
    
4.  Click **Create Configuration** to save.
    

JupiterOne will begin pulling data from HiBob based on the polling interval you set.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| HiBob Account | `hibob_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| HiBob Department | `hibob_department` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| HiBob Employee | `hibob_employee` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| HiBob Time Off Policy | `hibob_time_off_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| HiBob Time Off Request | `hibob_time_off_request` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `hibob_account` | **HAS** | `hibob_employee` |
| `hibob_account` | **HAS** | `hibob_department` |
| `hibob_account` | **HAS** | `hibob_time_off_policy` |
| `hibob_department` | **HAS** | `hibob_employee` |
| `hibob_employee` | **MANAGES** | `hibob_employee` |
| `hibob_employee` | **HAS** | `hibob_time_off_request` |
| `hibob_time_off_policy` | **HAS** | `hibob_time_off_request` |

## Release Notes

-   **2026-02-25** — New HiBob integration: ingests employees, departments, time-off policies, and time-off requests with manager hierarchy relationships.

---

Source: /integrations/directory/horizon3-nodezero

# Horizon3.ia NodeZero

Visualize Horizon3 Nodezero Attack Paths, Discovered Hosts, Operation Templates, Pentest Operations, Asset Groups, Data Stores, Runner Agents, Client Accounts, and Weaknesses while monitoring changes through advanced queries and automated alerts.

# Horizon3-Nodezero Integration Installation in Jupiterone

## Overview

This guide walks you through how to connect your **Horizon3 Nodezero account** with **JupiterOne** to monitor and manage your security data.

### Prerequisites

-   An active Horizon3 account with user role as **Org Admin** or **User** to Generate API Key.
-   API Key should have Permission Level as **Read-only** or **User**.
-   Access to **JupiterOne** with permission to configure integrations.

## Setup in Horizon3 Nodezero

### Generate API Token in Horizon3

#### Steps:

1.  Login to your Horizon3 account.
    
2.  Click on **Profile** at top right corner.
    
3.  Navigate to the **Settings** tab and open **My Settings** tab.
    
4.  Navigate to **API Keys** section and click **Generate API Key**.
    
5.  Select the Permission level as **Read-only** or **User** and click **Generate**.
    
6.  Copy the generated API key and save it securely for further use.
    
7.  Identify your **account region** based on the URL.
    
    | Account region | Base URL |
    | --- | --- |
    | US | `https://api.horizon3ai.com` |
    | EU | `https://api.horizon3ai.eu` |
    

## Configure Integration in JupiterOne

Now that you have required tokens and Region, let's connect everything in JupiterOne.

#### Steps:

1.  In JupiterOne, go to the left navigation menu and click **Integrations**.
    
2.  Scroll down and click the **Horizon3 Nodezero** integration tile.
    
3.  Click **Add Configuration** and fill in the fields:
    
    | Field | What to Enter |
    | --- | --- |
    | **Nodezero API Key** | Paste your API token generated in Horizon3 Nodezero portal here |
    | **Nodezero Region** | Select the region based on your account region |
    | **Account Name** | A friendly name (e.g., “Nodezero - US Region”) |
    | **Description** | Optional – notes to identify this setup |
    | **Polling Interval** | How often to collect data (or choose `DISABLED` to run manually) |
    
4.  Click **Create Configuration** to save it.
    

That’s it! JupiterOne will now start pulling data from Horizon3 Nodezero based on the schedule you set.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (3)

-   `org_admin`
-   `readonly`
-   `user`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (2)

-   `https://api.horizon3ai.com/v1/graphql`
-   `https://api.horizon3ai.eu/v1/graphql`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (3)

-   [https://docs.horizon3ai.com/api/getting\_started/authenticate/](https://docs.horizon3ai.com/api/getting_started/authenticate/)
-   [https://docs.horizon3ai.com/portal/settings/client\_management/](https://docs.horizon3ai.com/portal/settings/client_management/)
-   [https://docs.horizon3ai.com/portal/settings/user\_management/](https://docs.horizon3ai.com/portal/settings/user_management/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (8)

| Step | Roles | Endpoints |
| --- | --- | --- |
| Build Attack Path Exploits Weakness | `readonly` | `https://api.horizon3ai.com/v1/graphql`, `https://api.horizon3ai.eu/v1/graphql` |
| Fetch Attack Paths | `readonly` | `https://api.horizon3ai.com/v1/graphql`, `https://api.horizon3ai.eu/v1/graphql` |
| Fetch Data Stores | `readonly` | `https://api.horizon3ai.com/v1/graphql`, `https://api.horizon3ai.eu/v1/graphql` |
| Fetch Discovered Hosts | `readonly` | `https://api.horizon3ai.com/v1/graphql`, `https://api.horizon3ai.eu/v1/graphql` |
| Fetch Git Integrations | `readonly` | \- |
| Fetch Operation Templates | `user` | `https://api.horizon3ai.com/v1/graphql`, `https://api.horizon3ai.eu/v1/graphql` |
| Fetch Pentest Operations | `readonly` | `https://api.horizon3ai.com/v1/graphql`, `https://api.horizon3ai.eu/v1/graphql` |
| Fetch Weaknesses | `readonly` | `https://api.horizon3ai.com/v1/graphql`, `https://api.horizon3ai.eu/v1/graphql` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Nodezero Asset Group | `nodezero_asset_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Nodezero Attack Path | `nodezero_attack_path` | [Risk](https://docs.jupiterone.io/data-model/schemas/Risk) |
| Nodezero Client Account | `nodezero_client_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Nodezero Data Store | `nodezero_data_store` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Nodezero Discovered host | `nodezero_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Nodezero Git Integration | `nodezero_git_account` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Nodezero Operation template | `nodezero_operation_template` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Nodezero Pentest Operation | `nodezero_operation` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Nodezero Runner Agent | `nodezero_agent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Nodezero User Account | `nodezero_user_account` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Nodezero Weakness | `nodezero_weakness` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `nodezero_agent` | **PERFORMED** | `nodezero_operation` |
| `nodezero_attack_path` | **EXPLOITS** | `nodezero_weakness` |
| `nodezero_client_account` | **HAS** | `nodezero_operation` |
| `nodezero_data_store` | **HAS** | `nodezero_weakness` |
| `nodezero_host` | **HAS** | `nodezero_weakness` |
| `nodezero_operation` | **USES** | `nodezero_git_account` |
| `nodezero_operation` | **IDENTIFIED** | `nodezero_attack_path` |
| `nodezero_operation` | **SCANS** | `nodezero_host` |
| `nodezero_operation` | **SCANS** | `nodezero_data_store` |
| `nodezero_operation` | **IDENTIFIED** | `nodezero_weakness` |
| `nodezero_operation_template` | **DEFINES** | `nodezero_operation` |
| `nodezero_user_account` | **CREATED** | `nodezero_operation_template` |
| `nodezero_user_account` | **CREATED** | `nodezero_operation` |

### Nodezero Agent

`nodezero_agent` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `lastCommand` | `string` |  |  |
| `logFile` | `string` |  |  |
| `systemInfo` | `string` |  |  |

---

### Nodezero Asset Group

`nodezero_asset_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetsCount` | `number` |  |  |
| `authorizedAssetsCount` | `number` |  |  |
| `authorizedExternalDomainCount` | `number` |  |  |
| `authorizedIPCount` | `number` |  |  |
| `clientAccountCompanyName` | `string` |  |  |
| `clientAccountUUID` | `string` |  |  |
| `externalDomainCount` | `number` |  |  |
| `inScopeIPCount` | `number` |  |  |
| `lastAssetDiscoveryCompletedAt` | `string` |  |  |
| `pentestSeriesUUID` | `string` |  |  |
| `pentestTemplateUUID` | `string` |  |  |
| `userAccountName` | `string` |  |  |
| `userAccountUUID` | `string` |  |  |

---

### Nodezero Attack Path

`nodezero_attack_path` inherits from [Risk](/data-model/schemas/Risk.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `affectedAssetText` | `string` |  |  |
| `attackPathTitle` | `string` |  |  |
| `baseScore` | `number` |  |  |
| `contextScoreDescription` | `string` |  |  |
| `credentialRefs` | `array` of `string`s |  |  |
| `hostName` | `string` |  |  |
| `hostRefs` | `array` of `string`s |  |  |
| `hostText` | `string` |  |  |
| `id` | `string` |  |  |
| `impactDescription` | `string` |  |  |
| `impactTitle` | `string` |  |  |
| `impactType` | `string` |  |  |
| `ipAddress` | `string` |  |  |
| `pentestId` | `string` |  |  |
| `severity` | `string` |  |  |
| `targetEntityText` | `string` |  |  |
| `timeToFind` | `string` | Time took (in seconds or in HH:MM:SS) from the start of the pentest until this particular attack path was discovered |  |
| `weaknessRefs` | `array` of `string`s |  |  |

---

### Nodezero Client Account

`nodezero_client_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetsCount` | `number` |  |  |
| `childClientAccountsCount` | `number` |  |  |
| `companyLogoUrl` | `string` |  |  |
| `companyShortName` | `string` |  |  |
| `externalAssetsCount` | `number` |  |  |
| `internalAssetsCount` | `number` |  |  |
| `isWhiteLabelReportsCascaded` | `boolean` |  |  |
| `isWhiteLabelReportsEnabled` | `boolean` |  |  |
| `parentUUID` | `string` |  |  |
| `secondaryCompanyLogoUrl` | `string` |  |  |
| `sessionUserRoleId` | `string` |  |  |

---

### Nodezero Data Store

`nodezero_data_store` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `account` | `string` |  |  |
| `address` | `string` |  |  |
| `attackPathsCount` | `number` |  |  |
| `authenticated` | `boolean` |  |  |
| `baseScore` | `number` |  |  |
| `baseSeverity` | `string` |  |  |
| `cloudProvideName` | `string` |  |  |
| `cloudResourceARN` | `string` |  |  |
| `cloudServiceName` | `string` |  |  |
| `contextScore` | `number` |  |  |
| `contextSeverity` | `string` |  |  |
| `dataResourcesCount` | `number` |  |  |
| `dataResourcesLabel` | `string` |  |  |
| `dataStoreType` | `string` |  |  |
| `dnsAddress` | `string` |  |  |
| `downstreamImpactTypes` | `array` of `string`s |  |  |
| `downstreamImpactTypesAndCounts` | `array` of `string`s |  |  |
| `hostname` | `string` |  |  |
| `impactPathsCount` | `number` |  |  |
| `ipAddress` | `string` |  |  |
| `pentestId` | `string` |  |  |
| `permissions` | `array` of `string`s |  |  |
| `port` | `number` |  |  |
| `protocol` | `string` |  |  |
| `score` | `number` |  |  |
| `sensitiveDataItemCount` | `number` |  |  |
| `sensitiveDataItemTitlesAndCounts` | `array` of `string`s |  |  |
| `sensitiveDataItemTypes` | `string` |  |  |
| `sensitiveDataItemTypesAndCounts` | `array` of `string`s |  |  |
| `sensitiveResourcesCount` | `number` |  |  |
| `serviceType` | `string` |  |  |
| `severity` | `string` |  |  |
| `title` | `string` |  |  |
| `weaknessesCount` | `number` |  |  |

---

### Nodezero Git Account

`nodezero_git_account` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `source` | `string` |  |  |

---

### Nodezero Host

`nodezero_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `actionLogsCount` | `number` |  |  |
| `actionLogsCsvUrl` | `string` |  |  |
| `attackPathsCount` | `number` |  |  |
| `cloudARNs` | `array` of `string`s |  |  |
| `cloudProvider` | `string` |  |  |
| `cloudRegion` | `string` |  |  |
| `cNameChains` | `array` of `string`s |  |  |
| `confirmedCredentialsCount` | `number` |  |  |
| `confirmedWeaknessesCount` | `number` |  |  |
| `contextScoreDescription` | `string` |  |  |
| `credentialsCount` | `number` |  |  |
| `dataResourcesCount` | `number` |  |  |
| `dataStoresCount` | `number` |  |  |
| `downstreamImpactTypes` | `array` of `string`s |  |  |
| `firstSeenOn` | `string` |  |  |
| `isDatabaseServer` | `boolean` |  |  |
| `isDomainController` | `boolean` |  |  |
| `isInScope` | `boolean` |  |  |
| `isLoadBalancer` | `boolean` |  |  |
| `isMailServer` | `boolean` |  |  |
| `isPublic` | `boolean` |  |  |
| `isVPN` | `boolean` |  |  |
| `isWebApplicationFirewall` | `boolean` |  |  |
| `ldapHostname` | `string` |  |  |
| `pentestId` | `string` |  |  |
| `score` | `number` |  |  |
| `servicesCount` | `number` |  |  |
| `severity` | `string` |  |  |
| `subnet` | `string` |  |  |
| `subnetSource` | `string` |  |  |
| `weaknessesCount` | `number` |  |  |
| `webSharesCount` | `number` |  |  |

---

### Nodezero Operation

`nodezero_operation` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `attackPathsCount` | `number` |  |  |
| `awsAccountIds` | `array` of `string`s |  |  |
| `cancelledOn` | `number` |  |  |
| `clientName` | `string` |  |  |
| `createdBy` | `string` |  |  |
| `credAccessCount` | `number` |  |  |
| `credentialsCount` | `number` |  |  |
| `dataResourcesCount` | `number` |  |  |
| `dataStoresCount` | `number` |  |  |
| `duration` | `number` | Pentest duration in seconds |  |
| `etCompletedOn` | `number` |  |  |
| `excludeScope` | `array` of `string`s |  |  |
| `externalDomainsCount` | `number` |  |  |
| `hostsCount` | `number` |  |  |
| `impactPathsCount` | `number` |  |  |
| `impactsCount` | `number` |  |  |
| `maxScope` | `array` of `string`s |  |  |
| `minScope` | `array` of `string`s |  |  |
| `nodezeroIP` | `string` |  |  |
| `nodezeroScriptUrl` | `string` |  |  |
| `outOfScopeHostsCount` | `number` |  |  |
| `pentestType` | `string` |  |  |
| `phishedAttackPathsCount` | `number` |  |  |
| `phishedImpactPathsCount` | `number` |  |  |
| `runnerAgentUUID` | `string` |  |  |
| `scheduledOn` | `number` |  |  |
| `servicesCount` | `number` |  |  |
| `state` | `string` |  |  |
| `usersCount` | `number` |  |  |
| `weaknessesCount` | `number` |  |  |
| `weaknessTypesCount` | `number` |  |  |
| `websitesCount` | `number` |  |  |

---

### Nodezero Operation Template

`nodezero_operation_template` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetGroupUUID` | `string` |  |  |
| `autoInjectedCredentialsUUID` | `array` of `string`s |  |  |
| `blacklistedScope` | `string` |  |  |
| `clientAccountUUID` | `string` |  |  |
| `companyNames` | `array` of `string`s |  |  |
| `domainsList` | `array` of `string`s |  |  |
| `maximumRunTime` | `number` |  |  |
| `maximumScope` | `string` |  |  |
| `minimumRunTime` | `number` |  |  |
| `minimumScope` | `string` |  |  |
| `passwordsToSpray` | `array` of `string`s |  |  |
| `pentestName` | `string` |  |  |
| `pentestType` | `string` |  |  |
| `runnerName` | `string` |  |  |
| `runnerUUID` | `string` |  |  |
| `targetedTestId` | `string` |  |  |
| `userAccountUUID` | `string` |  |  |

---

### Nodezero User Account

`nodezero_user_account` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `lastSignInOn` | `number` |  |  |

---

### Nodezero Weakness

`nodezero_weakness` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `affectedAssetShortText` | `string` |  |  |
| `affectedAssetText` | `string` |  |  |
| `attackPathsCount` | `number` |  |  |
| `baseScore` | `number` |  |  |
| `baseSeverity` | `string` |  |  |
| `contextScore` | `number` |  |  |
| `contextScoreDescription` | `string` |  |  |
| `contextSeverity` | `string` |  |  |
| `downstreamImpactTypes` | `array` of `string`s |  |  |
| `downstreamImpactTypesAndCounts` | `array` of `string`s |  |  |
| `hasProof` | `boolean` |  |  |
| `id` | `string` |  |  |
| `impactPathsCount` | `number` |  |  |
| `ip` | `string` |  |  |
| `isCISAKnownExploitedVulnerability` | `boolean` |  |  |
| `isCISAKnownRansomwareCampaignVulnerability` | `boolean` |  |  |
| `pentestId` | `string` |  |  |
| `proofFailureCode` | `string` |  |  |
| `proofFailureReason` | `string` |  |  |
| `score` | `number` |  |  |
| `timeToFinding` | `number` |  |  |
| `vulnerabilityAliases` | `array` of `string`s |  |  |
| `vulnerabilityCategory` | `string` |  |  |
| `vulnerabilityId` | `string` |  |  |
| `vulnerabilityName` | `string` |  |  |
| `vulnerabilityShortName` | `string` |  |  |

---

## Release Notes

-   **2025-11-07** — New Horizon3 NodeZero integration: ingests pentest operations, discovered hosts, attack paths, weaknesses, data stores, and asset groups with full relationship mapping.

---

Source: /integrations/directory/hubspot

# HubSpot

Visualize Hubspot owners, roles, and companies, map Hubspot owners to employees, and monitor changes through queries and alerts.

## Installation

Before you can start using OAuth with HubSpot, you must have an app associated with your developer account and a HubSpot account to install your app in (you can use an existing account or create a test account).

> **INFO**
> 
> Hubspot supports OAuth for this integration, To create an OAuth account, you must have a developer account. See Hubspot's [OAuth Quickstart Guide](https://developers.hubspot.com/docs/api/oauth-quickstart-guide) for reference.

### Configuration in JupiterOne

To install the Hubspot integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Hubspot. Click **New Instance** to begin configuring your integration, providing the following:

-   The **Account Name** used to identify the Hubspot account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to finalize the integration. You will then be prompted to authenticate JupiterOne with Hubspot. Complete the authentication process to finalize the integration.

### Subscription tier requirements

Some HubSpot features ingested by this integration require specific subscription tiers:

-   **Roles (Permission Sets)**: Requires an Enterprise subscription for at least one Hub. If your HubSpot account does not have Enterprise access, the integration will skip ingesting roles and you may see an error message: `Account doesn't have access to roles`. This is expected behavior for accounts below the Enterprise tier. To verify if you have access to roles, navigate to **Settings > Users and Teams > Permission Sets** in your HubSpot portal.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| HubSpot Account | `hubspot_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| HubSpot Company | `hubspot_company` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| HubSpot Role | `hubspot_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| HubSpot User | `hubspot_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `hubspot_account` | **HAS** | `hubspot_role` |
| `hubspot_account` | **HAS** | `hubspot_user` |
| `hubspot_account` | **HAS** | `hubspot_company` |
| `hubspot_user` | **ASSIGNED** | `hubspot_role` |

---

Source: /integrations/directory/immersive-labs

# Immersive Labs

Visualize Immersive Labs learners, teams, catalog labs, collections, and scheduled exercises (Cyber Range drills, crisis simulations, screening, and CTF events) in the JupiterOne graph, along with per-learner assignments and completions — including earned CPE credits. Track training completion and CPE credit as compliance evidence, identify learners who have not engaged with assigned training, correlate learners to employee identities, and monitor engagement across teams through queries and alerts.

## Installation

### Prerequisites

-   An **Immersive Labs** organization (tenant) with an **Organization Admin** who can generate an API key.
-   Your **region-specific API base URL** (for example `https://api.immersivelabs.online` or `https://api.us.immersivelabs.com`).
-   Access to **JupiterOne** with permission to configure integrations.

### Generate an API key in Immersive Labs

The integration authenticates with an API key issued as an **Access Key** / **Secret Token** pair.

1.  Sign in to the Immersive Labs platform as an **Organization Admin**.
2.  Go to **Platform Settings → API**.
3.  Select **Generate API key**.
4.  Copy the **Access Key** and the **Secret Token**. The Secret Token is shown only once, so store it securely — you will paste both values into JupiterOne in the next section.

The integration issues read-only requests. It does not request specific scopes when minting its token — the token inherits the API key's own access — so no additional scope provisioning is required. See the [Authorization](/integrations/directory/immersive-labs.md?integration-docs=authorization) tab for details.

### Configure the integration in JupiterOne

To install the Immersive Labs integration in JupiterOne, navigate to the **Integrations** tab and select **Immersive Labs**. Click **New Instance** to begin configuring your integration.

Creating an Immersive Labs instance requires the following:

-   The **Account Name** used to identify the Immersive Labs account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
-   **Description** to assist in identifying the integration instance, if desired.
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **API Base URL** | Yes | Your region-specific Immersive Labs API endpoint (e.g. `https://api.immersivelabs.online` or `https://api.us.immersivelabs.com`). |
| **Access Key** | Yes | The **Access Key** from your Immersive Labs API key (used as the token username). |
| **Secret Token** | Yes | The **Secret Token** paired with the Access Key (used as the token password). |

#### Advanced — Activity Lookback Days

The completion and assignment steps fetch learner activity created within a lookback window, so each sync is bounded rather than pulling the full history.

| Field | Default | Options | Description |
| --- | --- | --- | --- |
| **Activity Lookback Days** | `90` | `14`, `30`, `90`, `180`, `365` | How far back (in days) to fetch completion and attempt activity on each sync. Increase it to capture older activity. |

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `immersive_labs_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Collection | `immersive_labs_collection` | [Training](https://docs.jupiterone.io/data-model/schemas/Training), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Exercise | `immersive_labs_exercise` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Lab | `immersive_labs_lab` | [Training](https://docs.jupiterone.io/data-model/schemas/Training) |
| Team | `immersive_labs_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team) |
| User | `immersive_labs_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `immersive_labs_collection` | **CONTAINS** | `immersive_labs_lab` |
| `immersive_labs_team` | **CONTAINS** | `immersive_labs_team` |
| `immersive_labs_team` | **HAS** | `immersive_labs_user` |
| `immersive_labs_team` | **ASSIGNED** | `immersive_labs_exercise` |
| `immersive_labs_user` | **ASSIGNED** | `immersive_labs_lab` |
| `immersive_labs_user` | **ASSIGNED** | `immersive_labs_collection` |
| `immersive_labs_user` | **ASSIGNED** | `immersive_labs_exercise` |
| `immersive_labs_user` | **COMPLETED** | `immersive_labs_lab` |
| `immersive_labs_user` | **COMPLETED** | `immersive_labs_collection` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `immersive_labs_user` | **IS** | `Person` | FORWARD |

### Immersive Labs Account

`immersive_labs_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`organizationId` \*

 | `string` | The Immersive Labs organisation (tenant) identifier returned with the API token. |  |

---

### Immersive Labs Collection

`immersive_labs_collection` inherits from [Training](/data-model/schemas/Training.md), [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The Immersive Labs organisation (tenant) id this collection belongs to (ADR-015 flat account reference). |  |
| 

`categories` \*

 | `array` **|** `null` | The catalog categories the collection is classified under. |  |
| 

`collectionType` \*

 | `string` **|** `null` | The Immersive Labs content type of the collection. |  |
| 

`uuid` \*

 | `string` | The Immersive Labs UUID of the collection. |  |

---

### Immersive Labs Exercise

`immersive_labs_exercise` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The Immersive Labs organisation (tenant) id this exercise belongs to (ADR-015 flat account reference). |  |
| 

`exerciseType` \*

 | `string` **|** `null` | The Immersive Labs exercise type (e.g. cyber range, crisis simulation, screening). |  |
| 

`scheduledEndOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the exercise is scheduled to end. |  |
| 

`uuid` \*

 | `string` | The Immersive Labs UUID of the exercise. |  |

---

### Immersive Labs Lab

`immersive_labs_lab` inherits from [Training](/data-model/schemas/Training.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The Immersive Labs organisation (tenant) id this lab belongs to (ADR-015 flat account reference). |  |
| 

`activityType` \*

 | `string` **|** `null` | The Immersive Labs content type of the activity (e.g. lab). |  |
| 

`tags` \*

 | `array` **|** `null` | The tags applied to the lab in the Immersive Labs catalog. |  |
| 

`uuid` \*

 | `string` | The Immersive Labs UUID of the lab/activity. |  |

---

### Immersive Labs Team

`immersive_labs_team` inherits from [Team](/data-model/schemas/Team.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The Immersive Labs organisation (tenant) id this team belongs to (ADR-015 flat account reference). |  |
| 

`uuid` \*

 | `string` | The Immersive Labs UUID of the team. |  |

---

### Immersive Labs User

`immersive_labs_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The Immersive Labs organisation (tenant) id this learner belongs to (ADR-015 flat account reference). |  |
| 

`externalId` \*

 | `string` **|** `null` | The customer-supplied external identifier for the learner (e.g. SSO/HRIS id), used to correlate to employee identity. |  |

---

---

Source: /integrations/directory/infoblox-nios

# Infoblox NIOS

Visualize Infoblox NIOS hosts and monitor changes through queries and alerts.

## Installation

For this integration, you will need to create a new user with a custom role in Infoblox NIOS Grid.

### Configuration in Infoblox NIOS

### 1\. Create a Custom Role

1.  In the Infoblox NIOS Grid Console, go to **Administration > Administrators > Roles**.
2.  Click on **Add Role** in the top-left corner.
3.  In the **Role Name** field, enter a name for your role, and optionally add a **Comment**.
4.  Click **Next**.
5.  On the next screen, click **Next** again, then click **Save**.
6.  Select **App Permissions** to set permissions for the role.
7.  Under **Permissions**, click on the **Add Permission** icon.
8.  In the **Select Role Permission** window:
    -   Choose the role you just created.
    -   Assign **Read-only** permission for **All Hosts** for DHCP, DNS and IPAM Services.
9.  Click **Save and Close**.

### 2\. Create a Group with the Custom Role

1.  Go to the **Groups** tab.
2.  Click **Add Group**.
3.  Enter a **Group Name** and optionally a **Comment**, then click **Next**.
4.  For steps 2, 3, and 4, keep the default settings and click **Next** each time.
5.  In step 5, click on the **Add Role** (+) button.
    -   Navigate to the **Custom Role** directory.
    -   Select the role you created in the previous section.
6.  Check allowed interfaces API & GUI checkboxes.
7.  Click **Save and Close**.

### 3\. Create an API User Account

1.  Go to the **Administrators** section.
2.  Click the **+** icon to create a new user.
3.  Set **Auth Type** to **Local**.
4.  Enter a **Login Name**, **Password**, and confirm the password in the **Confirm Password** field.
5.  Under **Admin Group**, select the group created in the previous section.
6.  Click **Save and Close**.

### Configuration in JupiterOne

To install the Infoblox NIOS integration in JupiterOne:

1.  Navigate to the **Integrations** tab in JupiterOne and select **Infoblox NIOS**.
2.  Click **New Instance** to begin configuring your integration.

You will need to provide the following:

In Authentication section:

-   **Infoblox NIOS Username**, **Infoblox NIOS Password**, and **Infoblox NIOS Base URL** for the Infoblox NIOS account.

In General Section

-   **Account Name**: Used to identify Infoblox Nios Instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
-   **Description** (optional): Assists in identifying the integration instance.

In Advance Section configure below (optional):

-   **Polling Interval**: Set this to your desired frequency for data polling, or leave it as `DISABLED` if you prefer manual execution.

Click **Create** once all values are provided to finalize the integration.

### Next Steps

Once your integration instance is configured, it will begin running on the polling interval you provided, populating data within JupiterOne. For more information on working with and managing integration instances, refer to our [Instance Management Guide](/integrations/instance-management.md).

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Infoblox NIOS Account | `infoblox_nios_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Infoblox NIOS Host | `infoblox_nios_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |

### Infoblox Nios Account

`infoblox_nios_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Infoblox Nios Host

`infoblox_nios_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowTelnet` | `boolean` |  |  |
| `comment` | `string` |  |  |
| `configureForDns` | `boolean` |  |  |
| `ddnsProtected` | `boolean` |  |  |
| `disableDiscovery` | `boolean` |  |  |
| `dnsName` | `string` |  |  |
| `location` | `string` |  |  |
| `networkView` | `string` |  |  |
| `rrsetOrder` | `string` |  |  |
| `useCliCredentials` | `boolean` |  |  |
| `useDnsEaInheritance` | `boolean` |  |  |
| `useSnmp3Credential` | `boolean` |  |  |
| `useSnmpCredential` | `boolean` |  |  |
| `useTtl` | `boolean` |  |  |
| `view` | `string` |  |  |
| `zone` | `string` |  |  |

---

---

Source: /integrations/directory/iriusrisk

# IriusRisk

Visualize Projects, Threats, Weaknesses, Countermeasures, and Users, and monitor changes through queries and alerts.

## Installation

### Requirements

-   You need the **IriusRisk Host URL** and an **API Token** generated in your IriusRisk account.
-   You must have the necessary permissions in **JupiterOne** to install new integrations.

### Configuring IriusRisk

#### Creating Global and Project Roles with Required Permissions

1.  Click the **Settings** icon to open the **General Settings** dropdown.
2.  Select **Permissions** from the dropdown.
3.  Under the **Global Roles** tab:
    -   Click **Create Role**.
    -   Provide a **Name** and **Description**.
    -   Enable the following permissions:
        -   **ALL\_USER\_UPDATE** (User Service)
        -   **API\_ACCESS** (APIs Service)
        -   **PRODUCTS\_LIST\_ALL** (Project Service)
    -   Click **Create** to finalize the role.
4.  Under the **Project Roles** tab:
    -   Click **Create Role**.
    -   Provide a **Name** and **Description**.
    -   Enable the following permissions:
        -   **THREAT\_VIEW** (Threats Service)
        -   **COUNTERMEASURE\_VIEW** (Countermeasures Service)
    -   Click **Create** to finalize the role.

#### Creating a User

1.  Click the **Settings** icon to open the **General Settings** dropdown.
2.  Select **Users** from the dropdown.
3.  Click **\+ Create User**.
4.  Provide the **First Name** and **Last Name**.
5.  Enter an **Email Address**.
6.  Set a **Password** for the user.
7.  Assign the previously created **Global Role** and **Project Role**.
8.  Click **Create** to finalize the user setup.

### Generating an IriusRisk API Token

Refer to the official IriusRisk documentation on [creating an API token](https://enterprise-support.iriusrisk.com/s/article/How-to-Enable-and-Configure-API-Access-in-IriusRisk).

**Note:** The API token should be generated using the user created above, ensuring the required roles are assigned.

### Configuring JupiterOne

1.  From the top navigation bar of the **J1 Search** homepage, go to **Integrations**.
    
2.  Search for **IriusRisk** and select it.
    
3.  Click the **Add Instance** button and configure the following settings:
    
    -   **Account Name:** Enter a name to identify this IriusRisk instance in JupiterOne. When **Tag with Account Name** is enabled, ingested entities will store this value in `tag.AccountName`.
    -   **Description:** Provide a description to help your team identify this integration instance.
    -   **Polling Interval:** Choose a suitable polling interval for monitoring, or leave it as `DISABLED` for manual execution.
    -   **IriusRisk Host URL:** Enter the host URL of your IriusRisk tenant.
    -   **IriusRisk API Token:** Enter the API token generated for use by JupiterOne.
4.  Click **Create Configuration** to save your settings.
    

### Next Steps

Now that your integration instance is configured, it will begin running based on the polling interval you provided, populating data within JupiterOne.

Refer to our [Instance Management Guide](/integrations/instance-management.md) to learn more about managing and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `iriusrisk_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Countermeasure | `iriusrisk_product_countermeasure` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Product | `iriusrisk_product` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Threat | `iriusrisk_product_threat` | [ThreatIntel](https://docs.jupiterone.io/data-model/schemas/ThreatIntel) |
| User | `iriusrisk_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Weakness | `iriusrisk_product_weakness` | [Weakness](https://docs.jupiterone.io/data-model/schemas/Weakness) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `iriusrisk_account` | **HAS** | `iriusrisk_user` |
| `iriusrisk_account` | **MANAGES** | `iriusrisk_product` |
| `iriusrisk_product` | **HAS** | `iriusrisk_product_countermeasure` |
| `iriusrisk_product` | **HAS** | `iriusrisk_product_weakness` |
| `iriusrisk_product` | **HAS** | `iriusrisk_product_threat` |

### Iriusrisk Account

`iriusrisk_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Iriusrisk Product

`iriusrisk_product` inherits from [Project](/data-model/schemas/Project.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `criticalRiskThreats` | `number` |  |  |
| `groups` | `array` of `string`s |  |  |
| `highRiskThreats` | `number` |  |  |
| `inheritRiskScore` | `number` |  |  |
| `lowRiskThreats` | `number` |  |  |
| `mediumRiskThreats` | `number` |  |  |
| `mitigatedRiskThreats` | `number` |  |  |
| `priority` | `number` |  |  |
| `projectedRiskScore` | `number` |  |  |
| `residualRiskScore` | `number` |  |  |
| `type` | `string` |  |  |
| `users` | `array` of `string`s |  |  |
| `workflowState` | `string` |  |  |

---

### Iriusrisk Product Countermeasure

`iriusrisk_product_countermeasure` inherits from [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cost` | `number` |  |  |
| `issueId` | `string` |  |  |
| `library` | `string` |  |  |
| `mitigation` | `string` |  |  |
| `owner` | `string` |  |  |
| `platform` | `string` |  |  |
| `risk` | `number` |  |  |
| `source` | `string` |  |  |
| `state` | `string` |  |  |
| `testExpiresOn` | `number` |  |  |
| `testExpiryPeriod` | `number` |  |  |
| `testNotes` | `string` |  |  |
| `testSteps` | `string` |  |  |

---

### Iriusrisk Product Threat

`iriusrisk_product_threat` inherits from [ThreatIntel](/data-model/schemas/ThreatIntel.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `availabilityRiskRatting` | `string` |  |  |
| 
`componentReferenceId` \*

 | `string` |  |  |
| `confidentialityRiskRatting` | `string` |  |  |
| `easeOfExploitationRiskRatting` | `string` |  |  |
| `expiresOn` | `number` |  |  |
| `inherentRiskScore` | `number` |  |  |
| `integrityRiskRatting` | `string` |  |  |
| `issueId` | `string` |  |  |
| `issueLink` | `string` |  |  |
| `mitigation` | `number` |  |  |
| `owner` | `string` |  |  |
| `projectedRiskScore` | `number` |  |  |
| `riskScore` | `number` |  |  |
| `source` | `string` |  |  |
| `state` | `string` |  |  |
| 

`useCaseReferenceId` \*

 | `string` |  |  |

---

### Iriusrisk Product Weakness

`iriusrisk_product_weakness` inherits from [Weakness](/data-model/schemas/Weakness.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `impact` | `number` |  |  |
| `issueId` | `string` |  |  |
| `issueLink` | `string` |  |  |
| `state` | `number` |  |  |
| `testExpiesOn` | `number` |  |  |
| `testExpiryPeriod` | `number` |  |  |
| `testLastUpdatedOn` | `number` |  |  |
| `testNotes` | `string` |  |  |
| `testOutput` | `string` |  |  |
| `testSourceArgs` | `string` |  |  |
| `testSourceEnabled` | `boolean` |  |  |
| `testSourceFileName` | `string` |  |  |
| `testSourceResult` | `string` |  |  |
| `testSourceType` | `string` |  |  |
| `testSteps` | `string` |  |  |

---

### Iriusrisk User

`iriusrisk_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `firstName` | `string` |  |  |
| `groups` | `array` of `string`s |  |  |
| `lastName` | `string` |  |  |
| `roles` | `array` of `string`s |  |  |

---

---

Source: /integrations/directory/jamf

# Jamf

Visualize Jamf admins, users, groups, devices, and profiles, map Jamf users to employees, and monitor changes through queries and alerts.

## Installation

To use this integration, JupiterOne requires your Jamf hostname to interact with the API as well as authentication credentials. These authentication credentials can either be a Client ID and Client Secret for an API Client, or a user's username and password used to authenticate with Jamf.

The JupiterOne integration uses the [Classic API](https://developer.jamf.com/jamf-pro/docs/getting-started-2) to fetch Jamf data.

The JupiterOne integration uses the [Bearer Authentication token](https://developer.jamf.com/jamf-pro/docs/classic-api-authentication-changes#bearer-token-authentication) to authorize the APIs.

Required Permissions:

-   Read - Jamf Pro User Accounts & Groups
-   Read - Users
-   Read - Mobile Devices
-   Read - Mobile Device Configuration Profile
-   Read - Smart Mobile Device Groups (for smart groups)
-   Read - Static Mobile Device Groups (for static groups)
-   Read - Provisioning Profiles
-   Read - Computers
-   Read - Advanced Computer Searches
-   Read - macOS Configuration Profiles

### Configuration in JupiterOne

To install the Jamf integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Jamf. Click **New Instance** to begin configuring your integration, providing the following:

-   **Account Name** used to identify the Jamf account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **AccountName** option is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Authentication method** in which to authenticate with Jamf. OAuth is the new preferred mechanism.
    
-   **Hostname** of your Jamf organization.
    
-   **Client ID** of the API Client you have created within Jamf, should the OAuth authentication method be selected.
    
-   **Client Secret** of the API Client you have created within Jamf, should the OAuth authentication method be selected.
    
-   **Username** used to authenticate with Jamf when having selected Basic for authentication method.
    
-   **Password** associated with the username to authenticate with Jamf via the Basic authentication method.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `jamf_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Admin | `jamf_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Computer | `jamf_computer` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Computer (deprecated entity) | `user_endpoint` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Computer Group | `jamf_computer_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Group | `jamf_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Local Account | `jamf_local_account` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| macOS Application | `macos_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| macOS Configuration Profile | `jamf_osx_configuration_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Mobile Device | `jamf_mobile_device` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Mobile Device (deprecated entity) | `mobile_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Mobile Device Configuration Profile | `jamf_mobile_device_configuration_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Mobile Device Group | `jamf_mobile_device_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Mobile Device Provisioning Profile | `jamf_mobile_device_provisioning_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| User | `device_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `device_user` | **OWNS** | `jamf_mobile_device` |
| `device_user` | **OWNS** | `mobile_device` |
| `device_user` | **OWNS** | `jamf_computer` |
| `device_user` | **OWNS** | `user_endpoint` |
| `jamf_account` | **HAS** | `jamf_group` |
| `jamf_account` | **HAS** | `jamf_user` |
| `jamf_account` | **HAS** | `device_user` |
| `jamf_account` | **HAS** | `jamf_osx_configuration_profile` |
| `jamf_account` | **MANAGES** | `jamf_mobile_device` |
| `jamf_account` | **HAS** | `mobile_device` |
| `jamf_account` | **HAS** | `jamf_mobile_device_configuration_profile` |
| `jamf_account` | **HAS** | `jamf_mobile_device_provisioning_profile` |
| `jamf_account` | **HAS** | `jamf_mobile_device_group` |
| `jamf_account` | **MANAGES** | `jamf_computer` |
| `jamf_account` | **HAS** | `user_endpoint` |
| `jamf_computer` | **USES** | `jamf_osx_configuration_profile` |
| `jamf_computer` | **INSTALLED** | `macos_app` |
| `jamf_computer_group` | **HAS** | `jamf_computer` |
| `jamf_computer_group` | **HAS** | `user_endpoint` |
| `jamf_group` | **HAS** | `jamf_user` |
| `jamf_local_account` | **USES** | `jamf_computer` |
| `jamf_local_account` | **USES** | `user_endpoint` |
| `jamf_mobile_device` | **USES** | `jamf_mobile_device_configuration_profile` |
| `jamf_mobile_device` | **USES** | `jamf_mobile_device_provisioning_profile` |
| `jamf_mobile_device_group` | **HAS** | `jamf_mobile_device` |
| `user_endpoint` | **USES** | `jamf_osx_configuration_profile` |
| `user_endpoint` | **INSTALLED** | `macos_app` |

### Device User

`device_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `customPhotoUrl` | `string` |  |  |
| `emailAddress` | `string` |  |  |
| `enableCustomPhotoUrl` | `boolean` |  |  |
| `fullName` | `string` |  |  |
| `ldapServer` | `string` |  |  |
| 
`os` \*

 | `array` of `string`s |  |  |
| `phoneNumber` | `string` |  |  |
| `position` | `string` |  |  |
| `totalVppCodeCount` | `number` |  |  |

---

### Jamf Account

`jamf_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`name` \*

 | `string` |  |  |

---

### Jamf Computer

`jamf_computer` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetTag` | `string` |  |  |
| `barcode1` | `string` |  |  |
| `barcode2` | `string` |  |  |
| 
`building` \*

 | `string` |  |  |
| 

`department` \*

 | `string` |  |  |
| `deploymentStatus` | `string` **|** `array` |  |  |
| `encrypted` | `boolean` |  |  |
| `enrolledOn` | `number` |  |  |
| `firewallEnabled` | `boolean` |  |  |
| `gatekeeperEnabled` | `boolean` |  |  |
| `jamfVersion` | `string` |  |  |
| `lastCloudBackup` | `number` |  |  |
| `lastReportedOn` | `number` |  |  |
| `locationEmail` | `string` |  |  |
| 

`managed` \*

 | `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| `netbootServer` | `string` |  |  |
| `networkAdapterType` | `string` |  |  |
| `realName` | `string` |  |  |
| `systemIntegrityProtectionEnabled` | `boolean` |  |  |
| `username` | `string` |  |  |

---

### Jamf Computer Group

`jamf_computer_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`name` \*

 | `string` |  |  |

---

### Jamf Group

`jamf_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessLevel` | `string` |  |  |
| `privilegeSet` | `string` |  |  |

---

### Jamf Local Account

`jamf_local_account` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`home` \*

 | `string` |  |  |
| 

`realName` \*

 | `string` |  |  |
| 

`uid` \*

 | `string` |  |  |

---

### Jamf Mobile Device

`jamf_mobile_device` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activationLockEnabled` | `boolean` |  |  |
| `blockLevelEncryption` | `boolean` |  |  |
| `capacity` | `number` |  |  |
| `cloudBackupEnabled` | `boolean` |  |  |
| `dataProtectionEnabled` | `boolean` |  |  |
| `email` | `string` |  |  |
| `fileLevelEncryption` | `boolean` |  |  |
| `hasPasscode` | `boolean` |  |  |
| `jailbroken` | `string` |  |  |
| `lastBackupOn` | `number` |  |  |
| `locatorServiceEnabled` | `boolean` |  |  |
| `managed` | `boolean` |  |  |
| `passcodeCompliant` | `boolean` |  |  |
| `passcodeLockGracePeriodEnforced` | `string` |  |  |
| `phoneNumber` | `string` |  |  |
| `profileCompliant` | `boolean` |  |  |
| `supervised` | `boolean` |  |  |
| `username` | `string` |  |  |

---

### Jamf Mobile Device Configuration Profile

`jamf_mobile_device_configuration_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`categoryId` \*

 | `null` **|** `string` |  |  |
| 

`categoryName` \*

 | `null` **|** `string` |  |  |
| 

`deploymentMethod` \*

 | `null` **|** `string` |  |  |
| 

`description` \*

 | `null` **|** `string` |  |  |
| 

`isAllJssUsers` \*

 | `null` **|** `boolean` |  |  |
| 

`isAllMobileDevices` \*

 | `null` **|** `boolean` |  |  |
| 

`level` \*

 | `null` **|** `string` |  |  |
| 

`payloads` \*

 | `null` **|** `string` |  |  |
| 

`redeployDaysBeforeCertificateExpires` \*

 | `null` **|** `number` |  |  |
| 

`redeployOnUpdate` \*

 | `null` **|** `string` |  |  |
| 

`siteId` \*

 | `null` **|** `string` |  |  |
| 

`siteName` \*

 | `null` **|** `string` |  |  |
| 

`uuid` \*

 | `null` **|** `string` |  |  |

---

### Jamf Mobile Device Group

`jamf_mobile_device_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isSmart` \*

 | `null` **|** `boolean` |  |  |
| 

`siteId` \*

 | `null` **|** `string` |  |  |
| 

`siteName` \*

 | `null` **|** `string` |  |  |

---

### Jamf Mobile Device Provisioning Profile

`jamf_mobile_device_provisioning_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `null` **|** `string` |  |  |
| 

`uuid` \*

 | `null` **|** `string` |  |  |

---

### Jamf Osx Configuration Profile

`jamf_osx_configuration_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`allComputers` \*

 | `boolean` |  |  |
| 

`allJSSUsers` \*

 | `boolean` |  |  |
| 

`categoryName` \*

 | `string` |  |  |
| 

`description` \*

 | `string` |  |  |
| 

`distributionMethod` \*

 | `string` |  |  |
| 

`level` \*

 | `string` |  |  |
| 

`redeployOnUpdate` \*

 | `string` |  |  |
| 

`siteName` \*

 | `string` |  |  |
| 

`userRemovable` \*

 | `boolean` |  |  |

---

### Jamf User

`jamf_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessLevel` | `string` |  |  |
| 
`active` \*

 | `boolean` |  |  |
| 

`admin` \*

 | `boolean` |  |  |
| `directoryUser` | `boolean` |  |  |
| `emailAddress` | `string` |  |  |
| `enabled` | `string` |  |  |
| `forcePasswordChange` | `boolean` |  |  |
| `fullName` | `string` |  |  |
| `permissions` | `array` of `string`s |  |  |
| `privilegeSet` | `string` |  |  |

---

### Macos App

`macos_app` inherits from [Application](/data-model/schemas/Application.md)

---

## Release Notes

-   **2026-04-08** — Improved OS name accuracy for Jamf mobile device entities, using human-readable names for iOS, iPadOS, and tvOS.
-   **2026-03-17** — Added configuration options to control Jamf extension attribute ingestion, including an option to skip all extension attributes or restrict ingestion to a specified allow list.
-   **2025-11-05** — Added ingestion of Jamf mobile device configuration profiles, provisioning profiles, and device groups with device relationships.
-   **2025-07-23** — Added additional payload version properties to Jamf macOS configuration profile entities, including firewall, login window, restrictions, and system policy payload versions.

---

Source: /integrations/directory/jenkins

# Jenkins

Visualize Jenkins entities and relationship within JupiterOne to proactively identify changes to users, jobs and repositories.

## Installation

### Configuration in Jenkins

To install this integration, you will need to configure settings both within Jenkins and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your Jenkins's instance.

-   Install Jenkins on the local machine/server and take note of the provided domain
-   Install recommended plugins
-   Create an admin account on this installation
-   Go to Dashboard -> Configure and add a new API Token
-   Go to Dashboard -> Configure -> Manage Plugins and add the [Docker](https://plugins.jenkins.io/docker-plugin) and [Docker Pipeline](https://plugins.jenkins.io/docker-workflow) plugins
-   To push data from your Jenkins instance you must run our Docker container in a pipeline. Here is an example:

```text
pipeline {
    agent {
        docker { image 'jupiterone/graph-jenkins:<version>' }
    }

    environment {
        JUPITERONE_API_KEY = credentials('j1-api-key')
        JUPITERONE_ACCOUNT = credentials('j1-account')
        USER_NAME = credentials('jenkins-username')
        API_KEY   = credentials('jenkins-api-key')
        HOST_NAME = 'https://<your_hostname>'
    }

    stages {
        stage('Collect data') {
            steps {
                sh 'cd /opt/jupiterone/integration && ./scripts/collect.sh'
            }
        }
    }
}
```

### Finalize in JupiterOne

To install the Jenkins integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Jenkins. Click **New Instance** to begin configuring the integration.

Creating an integration instance requires the following:

-   The **Account Name** used to identify the AirWatch account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Enter the **Jenkins API Key** generated for use by JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `jenkins_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Job | `jenkins_job` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Repository | `jenkins_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| User | `jenkins_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `jenkins_account` | **HAS** | `jenkins_job` |
| `jenkins_account` | **HAS** | `jenkins_user` |
| `jenkins_job` | **HAS** | `jenkins_job` |
| `jenkins_job` | **HAS** | `jenkins_repository` |

---

Source: /integrations/directory/jira

# Jira

Visualize Jira projects, users, and issues, map Jira users to employees, and monitor changes through queries and alerts.

## Installation

To use this integration, JupiterOne requires the hostname for your Jira organization, credentials for API access, and optionally an Assets mapping configuration for CMDB ingestion.

> **NOTE**
> 
> The integration supports Jira Cloud with Jira API v3 and Jira Data Center with Jira API v2. Other setups may work.

## Configure a Jira User

Create or designate a Jira user for the JupiterOne integration:

**Option 1: Create a New Service Account (Recommended)**

1.  Log in to Jira as an administrator
2.  Navigate to **User Management**
3.  Create a new user (e.g., `jupiterone-integration@yourcompany.com`)
4.  Grant the necessary permissions (see [User Permissions](#user-permissions) below)

**Option 2: Use an Existing User**

Verify the user has the required permissions and that you can log in to generate an API token.

## User Permissions

The Jira user needs the following permissions:

1.  **Browse Users** - Grant the ["Browse Users" global permission](https://confluence.atlassian.com/adminjiraserver/managing-global-permissions-938847142.html) to read groups and users
2.  **Project Access** - Authorize browse access to projects using [Jira permission features](https://support.atlassian.com/jira-core-cloud/docs/how-do-jira-permissions-work/)
3.  **Create Issues** (optional) - Required only if using JupiterOne Alert Rules to create Jira issues
4.  **Assets Access** (optional) - Required for CMDB ingestion. The user must have access to Jira Service Management Assets.

> **TIP**
> 
> For read-only access, see [How to Create a Read Only User](https://confluence.atlassian.com/jirakb/jira-cloud-how-to-create-a-read-only-user-779160729.html).

## Authentication Methods

The integration supports two authentication methods. Choose the one that fits your organization:

-   **API Token (Basic)** — a user email plus an API token (or password). The simplest option.
-   **OAuth 2.0 (Service account)** — an OAuth 2.0 service account credential (Client ID + Client Secret). Recommended when your organization is restricting or disabling API tokens.

## Create an API Token

Follow these steps for the **API Token (Basic)** method.

1.  Log in to Jira as the JupiterOne integration user
2.  Go to [Atlassian Account Settings > API Tokens](https://id.atlassian.com/manage-profile/security/api-tokens)
3.  Click **Create API token**
4.  Give it a descriptive label (e.g., "JupiterOne Integration")
5.  Copy and save the token value

> **WARNING**
> 
> The token is only shown once. Store it securely.

## Create OAuth 2.0 Credentials (Service Account)

Follow these steps for the **OAuth 2.0 (Service account)** method. The integration uses the OAuth 2.0 `client_credentials` grant, so no interactive browser authorization is required.

1.  Log in to [Atlassian administration](https://admin.atlassian.com/) as an organization admin
2.  Go to **Service accounts** and create or select a service account
3.  Create an **OAuth 2.0 credential** for the service account
4.  Grant the credential the following Jira scopes:
    -   `read:jira-user`
    -   `read:jira-work`
    -   For Assets (CMDB) ingestion, also grant: `read:cmdb-object:jira`, `read:cmdb-attribute:jira`, `read:cmdb-schema:jira`, `read:cmdb-type:jira`
5.  Ensure the service account has access to the site and projects you intend to ingest
6.  Copy and save the **Client ID** and **Client Secret**

> **WARNING**
> 
> The Client Secret is only shown once. Store it securely.

> **NOTE**
> 
> OAuth access tokens are valid for 60 minutes. The integration requests and refreshes them automatically. For details, see Atlassian's [Create an OAuth 2.0 credential for service accounts](https://support.atlassian.com/user-management/docs/create-oauth-2-0-credential-for-service-accounts/).

## Assets (CMDB) Requirements

To ingest Jira Assets (CMDB), the integration credentials must have:

-   Access to **Jira Service Management**
-   Permission to view **Assets** in your Jira organization

For **API Token (Basic)**, the token must belong to a user with these permissions. For **OAuth 2.0 (Service account)**, the credential must be granted the `read:cmdb-*:jira` scopes listed above and the service account must have Assets access.

## Configuration in JupiterOne

Navigate to **Integrations** > **Jira** > **New Instance**, select your authentication method, and provide the common fields:

| Field | Description |
| --- | --- |
| **Account Name** | Identifier for this Jira account in JupiterOne |
| **Description** | Optional description |
| **Polling Interval** | How often to sync data |
| **Hostname** | Your Jira hostname (e.g., `yourcompany.atlassian.net`) |
| **Project Keys** | Comma-separated list of project keys to ingest |
| **Assets Mapping** | JSON file for CMDB ingestion (see below) |

For the **API Token (Basic)** method, also provide:

| Field | Description |
| --- | --- |
| **User Email** | Email of the Jira integration user |
| **API Token** | The API token created above |

For the **OAuth 2.0 (Service account)** method, also provide:

| Field | Description |
| --- | --- |
| **Client ID** | The Client ID of the OAuth 2.0 service account credential |
| **Client Secret** | The Client Secret of the OAuth 2.0 service account credential |

## Assets (CMDB) Configuration

To ingest assets from Jira Service Management Assets, upload a JSON mapping configuration that defines which object types to ingest and how to map their attributes to JupiterOne entities.

### Mapping Structure

```json
{
  "version": "1.0",
  "description": "My organization's asset mappings",
  "objectTypes": [
    {
      "objectTypeId": "15",
      "objectTypeName": "Laptop",
      "_class": "Device",
      "enabled": true,
      "propertyToAttributeMap": {
        "hostname": { "attributeId": "135", "attributeName": "Hostname" },
        "serial": { "attributeId": "136", "attributeName": "Serial Number" },
        "category": { "attributeId": null, "default": "laptop" }
      }
    }
  ]
}
```

### Object Type Configuration

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `objectTypeName` | string | Yes | Jira Object Type name (generates entity `_type` automatically) |
| `objectTypeId` | string | No | Jira Object Type ID (more stable for queries) |
| `_class` | string or string\[\] | Yes | JupiterOne entity class |
| `enabled` | boolean | Yes | Whether to ingest this object type |
| `filter` | string | No | Additional AQL filter (e.g., `Status = Active`) |
| `propertyToAttributeMap` | object | Yes | Maps J1 properties to Jira attributes |
| `ownerEmailProperty` | string | No | **Deprecated** — use `ownerProperties`. Name of a property in `propertyToAttributeMap` containing the owner's email. Builds a generic `jira_user OWNS` mapped relationship. |
| `ownerProperties` | array | No | Multiple owner email properties, each with a `role` (`business`, `technical`, or `generic`) that builds a typed `jira_user OWNS` mapped relationship. |
| `referenceRelationships` | array | No | Direct relationships to other Jira Assets objects this object references (e.g. Function, Process, Information Category, ICT Supplier). |

### Attribute Mapping

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `attributeId` | string or null | Yes | Jira attribute ID. Use `null` for default-only values |
| `attributeName` | string | No | Human-readable name (documentation only) |
| `type` | string | No | Type conversion: `string`, `number`, `boolean`, `date`, `array`, `json` |
| `default` | string, number, boolean, or string\[\] | No | Default value when attribute is missing |
| `transform` | string | No | Transform: `lowercase`, `uppercase`, `trim`, `slug` |
| `pattern` | string | No | Regex pattern to extract value |

### Complete Example: Devices and Servers

This example maps laptops and servers from Jira Assets:

```json
{
  "version": "1.0",
  "description": "IT Asset inventory mapping",
  "objectTypes": [
    {
      "objectTypeId": "15",
      "objectTypeName": "Laptop",
      "_class": "Device",
      "enabled": true,
      "propertyToAttributeMap": {
        "hostname": { "attributeId": "135", "attributeName": "Hostname" },
        "serial": { "attributeId": "136", "attributeName": "Serial Number" },
        "make": { "attributeId": "137", "attributeName": "Manufacturer" },
        "model": { "attributeId": "138", "attributeName": "Model" },
        "macAddress": { "attributeId": "139", "attributeName": "MAC Address" },
        "osName": { "attributeId": "141", "attributeName": "Operating System" },
        "osVersion": { "attributeId": "142", "attributeName": "OS Version" },
        "deviceId": { "attributeId": "144", "attributeName": "Asset Tag" },
        "category": { "attributeId": null, "default": "laptop" }
      }
    },
    {
      "objectTypeId": "17",
      "objectTypeName": "Server",
      "_class": "Host",
      "enabled": true,
      "filter": "Status != Decommissioned",
      "propertyToAttributeMap": {
        "hostname": { "attributeId": "201", "attributeName": "Hostname" },
        "fqdn": { "attributeId": "202", "attributeName": "FQDN" },
        "serial": { "attributeId": "203", "attributeName": "Serial Number" },
        "make": { "attributeId": "204", "attributeName": "Manufacturer" },
        "model": { "attributeId": "205", "attributeName": "Model" },
        "ipAddress": { "attributeId": "207", "attributeName": "IP Address" },
        "osName": { "attributeId": "210", "attributeName": "Operating System" },
        "osVersion": { "attributeId": "211", "attributeName": "OS Version" },
        "category": { "attributeId": null, "default": "server" }
      }
    }
  ]
}
```

### Additional Examples

**Load Balancer (Gateway class with array defaults):**

```json
{
  "objectTypeName": "Load Balancer",
  "_class": "Gateway",
  "enabled": true,
  "propertyToAttributeMap": {
    "category": { "attributeId": null, "default": ["network"] },
    "function": { "attributeId": null, "default": ["load-balancing"] },
    "public": { "attributeId": "301", "attributeName": "Public Facing", "type": "boolean" }
  }
}
```

**Cloud Account (Account class with strictly required `vendor`):**

```json
{
  "objectTypeName": "AWS Account",
  "_class": "Account",
  "enabled": true,
  "propertyToAttributeMap": {
    "vendor": { "attributeId": null, "default": "Amazon Web Services" },
    "accountId": { "attributeId": "501", "attributeName": "Account ID" }
  }
}
```

**Physical Firewall (combined classes):**

```json
{
  "objectTypeName": "Firewall",
  "_class": ["Device", "Firewall"],
  "enabled": true,
  "propertyToAttributeMap": {
    "category": { "attributeId": null, "default": ["network"] },
    "hostname": { "attributeId": "601", "attributeName": "Hostname" },
    "serial": { "attributeId": "602", "attributeName": "Serial Number" },
    "make": { "attributeId": "603", "attributeName": "Vendor" }
  }
}
```

### Asset Ownership Relationships

You can build `jira_user OWNS jira_assets_*` relationships by specifying which mapped property contains the asset owner's email. Add `ownerEmailProperty` to an object type, pointing to the property name in `propertyToAttributeMap`:

```json
{
  "objectTypeId": "15",
  "objectTypeName": "Laptop",
  "_class": "Device",
  "enabled": true,
  "ownerEmailProperty": "ownerEmail",
  "propertyToAttributeMap": {
    "hostname": { "attributeId": "135", "attributeName": "Hostname" },
    "serial": { "attributeId": "136", "attributeName": "Serial Number" },
    "ownerEmail": { "attributeId": "157", "attributeName": "Owner" },
    "category": { "attributeId": null, "default": "laptop" }
  }
}
```

The integration matches the email value against existing `jira_user` entities. For Jira **User-type** attributes (where the value is a reference to a Jira user), the integration automatically extracts the email address.

> **NOTE**
> 
> This ingestion source is disabled by default. Enable the `user-owns-asset` ingestion source in the integration configuration. The `jira_user` entity must already exist — no placeholder is created.

#### Multiple Owners (Business Owner / Technical Owner)

When an object type has more than one owner role — for example a "System" with both a Business Owner and a Technical Owner — use `ownerProperties` instead of the singular `ownerEmailProperty`:

```json
{
  "objectTypeId": "5",
  "objectTypeName": "Systems",
  "_class": "Application",
  "enabled": true,
  "ownerProperties": [
    { "property": "businessOwner", "role": "business" },
    { "property": "technicalOwner", "role": "technical" }
  ],
  "propertyToAttributeMap": {
    "businessOwner": { "attributeId": "301", "attributeName": "Business Owner" },
    "technicalOwner": { "attributeId": "302", "attributeName": "Technical Owner" }
  }
}
```

| `role` | Relationship `_type` |
| --- | --- |
| `business` | `jira_user_business_owns_asset` |
| `technical` | `jira_user_technical_owns_asset` |
| `generic` (default) | `jira_user_owns_asset` |

`ownerProperties` and `ownerEmailProperty` can be combined — the singular field is treated as an additional `generic` owner. Both properties must resolve to a user email (a User-type attribute or a plain email string).

### Asset Reference Relationships

Jira Assets objects often reference **other objects** — for example a _System_ that references its _Function_, _Process_, _Information Category_, and _ICT Supplier_. Configure `referenceRelationships` to turn these references into direct relationships between the asset entities:

```json
{
  "objectTypeId": "5",
  "objectTypeName": "Systems",
  "_class": "Application",
  "enabled": true,
  "referenceRelationships": [
    { "attributeId": "310", "attributeName": "Function", "targetObjectType": "Function", "_class": "USES" },
    { "attributeId": "311", "attributeName": "Process", "targetObjectType": "Process", "_class": "USES" },
    { "attributeId": "312", "attributeName": "Information Category", "targetObjectType": "Information Category", "_class": "HAS" },
    { "attributeId": "313", "attributeName": "ICT Supplier", "targetObjectType": "Supplier", "_class": "HAS" }
  ],
  "propertyToAttributeMap": { }
}
```

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `attributeId` | string | Yes | Jira attribute ID holding the reference to the target object |
| `attributeName` | string | No | Human-readable name (documentation only) |
| `targetObjectType` | string | Yes | Jira Assets Object Type **Name** of the referenced object (e.g. `"Supplier"`) |
| `_class` | string | Yes | JupiterOne relationship class (e.g. `HAS`, `USES`, `ASSIGNED`) |

> **NOTE**
> 
> The referenced object type (e.g. `Supplier`) **must also be configured and enabled** in `objectTypes` — otherwise the target entity doesn't exist and the relationship is skipped. If a reference attribute holds multiple values (e.g. multiple suppliers), a relationship is created for each referenced object.

### Supported JupiterOne Classes

| Class | Use For | Key Properties |
| --- | --- | --- |
| `Device` | Laptops, desktops, phones, printers, cameras | `hostname`, `serial`, `make`, `model`, `macAddress`, `category` |
| `Host` | Servers, VMs, VDI | `hostname`, `fqdn`, `ipAddress`, `osName`, `osVersion`, `category` |
| `Application` | Software applications, licenses | `name`, `version` |
| `Service` | Business services | `category` (array), `function` (array) |
| `Person` | Employees, contractors | `firstName`, `lastName`, `email` |
| `Site` | Physical locations, offices | `name` |
| `Vendor` | Third-party vendors | `name` |
| `Network` | Network segments, VLANs, subnets | `CIDR`, `public`, `internal` |
| `Certificate` | SSL/TLS certificates | `domainName`, `expiresOn` |
| `Account` | Cloud accounts (AWS, Azure, GCP) | `vendor` |
| `IpAddress` | IP address resources (IPAM) | `ipAddress` |
| `Gateway` | Load balancers, NAT gateways, proxies | `category` (array), `function` (array), `public` |
| `Firewall` | Firewall appliances, security groups | `category` (array) |
| `Disk` | Storage devices, volumes | `name` |
| `CryptoKey` | Encryption keys, HSM devices | `name` |

You can combine multiple classes: `"_class": ["Device", "Firewall"]`

> **NOTE**
> 
> Some classes have strictly required properties that **must** be mapped (e.g., `vendor` for Account, `ipAddress` for IpAddress). Other classes like Device and Host have nullable required properties that will default to `null` if not mapped. The integration validates your mapping against the JupiterOne data model and will report errors for missing required properties.

### Finding Object Type and Attribute IDs

To find the IDs needed for your mapping configuration:

**Finding Object Type ID:**

1.  Go to **Jira Service Management** > **Assets**
2.  Click on an **Object Schema**
3.  Click on an **Object Type** (e.g., "Laptop")
4.  The Object Type ID is in the URL: `.../object-type/{objectTypeId}`

**Finding Attribute IDs:**

1.  From the Object Type page, click **Attributes**
2.  Click on an attribute to see its details
3.  The Attribute ID is in the URL or settings panel

> **TIP**
> 
> Use your browser's network inspector when viewing an asset to see the API responses with all IDs.

### Auto-Generated Properties

These properties are automatically set by the integration and don't need mapping:

-   `_key`, `_type`, `_class` - Entity identifiers
-   `name`, `displayName` - From Jira object label
-   `id` - Jira object ID
-   `webLink` - Link to asset in Jira
-   `createdOn`, `updatedOn` - Timestamps
-   `objectKey`, `objectTypeName`, `objectTypeId` - Jira metadata

### Entities Created

Assets ingestion creates:

| Entity | `_type` | `_class` |
| --- | --- | --- |
| Assets Workspace | `jira_assets_workspace` | `Repository` |
| Asset Objects | `jira_assets_{objectTypeName}` | As configured |

For example, `objectTypeName: "Laptop"` creates entities with `_type: jira_assets_laptop`.

### Relationships Created

| Source | Relationship | Target |
| --- | --- | --- |
| `jira_account` | **HAS** | `jira_assets_workspace` |
| `jira_assets_workspace` | **HAS** | `jira_assets_*` |
| `jira_user` | **OWNS** | `jira_assets_*` (generic, via `ownerEmailProperty` or a `generic` entry in `ownerProperties`) |
| `jira_user` | **OWNS** | `jira_assets_*` (Business Owner, via `ownerProperties` with `role: "business"`) |
| `jira_user` | **OWNS** | `jira_assets_*` (Technical Owner, via `ownerProperties` with `role: "technical"`) |
| `jira_assets_*` | as configured | `jira_assets_*` (via `referenceRelationships`, e.g. Function, Process, Information Category, ICT Supplier) |

## Next Steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `jira_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Assets Workspace | `jira_assets_workspace` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| Jira Issue | `jira_issue` | [Record](https://docs.jupiterone.io/data-model/schemas/Record), [Issue](https://docs.jupiterone.io/data-model/schemas/Issue) |
| Jira Project | `jira_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Jira User | `jira_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `jira_account` | **HAS** | `jira_project` |
| `jira_account` | **HAS** | `jira_user` |
| `jira_account` | **HAS** | `jira_assets_workspace` |
| `jira_issue` | **LINKS** | `jira_issue` |
| `jira_project` | **HAS** | `jira_issue` |
| `jira_user` | **CREATED** | `jira_issue` |
| `jira_user` | **REPORTED** | `jira_issue` |
| `jira_user` | **ASSIGNED** | `jira_issue` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `jira_user` | **OWNS** | `jira_assets_` | REVERSE |

### Jira Assets Workspace

`jira_assets_workspace` inherits from [Repository](/data-model/schemas/Repository.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `webLink` | `string` |  |  |
| 
`workspaceId` \*

 | `string` |  |  |

---

## Release Notes

-   **2026-07-29** — Issue link relationships now include the link type, allowing two issues linked by multiple relationship types to be correctly represented.
-   **2026-07-07** — Jira Service Management Assets can now be linked to multiple owners and their ICT supplier organizations.
-   **2026-06-16** — Added OAuth 2.0 (service account) authentication using the client credentials grant, allowing the integration to connect without a user API token.
-   **2026-03-03** — Added relationships linking Jira users to the assets they own in Jira Assets, enabling ownership queries across asset workspaces.
-   **2026-01-27** — Added Jira Assets ingestion, bringing asset workspace objects into JupiterOne as queryable entities with configurable type mappings.
-   **2025-12-18** — Added relationships between related Jira issues using issue link types, enabling traversal of issue dependencies and relationships.
-   **2025-05-27** — Added relationships tracking which Jira user is assigned to each Jira issue.
-   **2025-05-16** — Added guest user indicator to Jira user entities, identifying customer portal accounts versus internal Atlassian users.

---

Source: /integrations/directory/jumpcloud

# JumpCloud

Visualize JumpCloud users, groups, and applications, map JumpCloud users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> JupiterOne requires a Read Only Admin API key used to authenticate with the JumpCloud account.

### Configuration in JumpCloud

1.  Log into the Admin [portal](https://console.jumpcloud.com/login/admin)
2.  Create a new Administrator user with the Read Only role:
    -   Press the profile circle in the top right
    -   Press `Administrators`
    -   Press `Add Administrator`
    -   Press `Create New Admin`
    -   Enter required fields
    -   Set role to `Read Only`
    -   Check `Enable API access`
    -   Press `Save`
3.  Log into the Admin portal with new Read Only Admin
4.  Once logged in, press the profile circle
    -   Press My API Key
    -   Copy API Key for use in the next section

### Configuration in JupiterOne

To install the JumpCloud integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select JumpCloud. Click **New Instance** to begin configuring your integration, providing the following:

-   **Account Name** used to identify the JumpCloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` option is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **API Key** from an Admin with the Read Only role.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Application | `jumpcloud_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Configuration | `jumpcloud_apple_mdm` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Device | `jumpcloud_apple_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Group | `jumpcloud_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Organization | `jumpcloud_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account), [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| System | `jumpcloud_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| User | `jumpcloud_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `jumpcloud_account` | **HAS** | `jumpcloud_user` |
| `jumpcloud_account` | **HAS** | `jumpcloud_group` |
| `jumpcloud_account` | **HAS** | `jumpcloud_application` |
| `jumpcloud_account` | **HAS** | `jumpcloud_apple_mdm` |
| `jumpcloud_account` | **PROTECTS** | `jumpcloud_device` |
| `jumpcloud_apple_device` | **HAS** | `jumpcloud_apple_mdm` |
| `jumpcloud_group` | **HAS** | `jumpcloud_user` |
| `jumpcloud_group` | **ASSIGNED** | `jumpcloud_application` |
| `jumpcloud_user` | **ASSIGNED** | `jumpcloud_application` |

### Jumpcloud Account

`jumpcloud_account` inherits from [Account](/data-model/schemas/Account.md), [Organization](/data-model/schemas/Organization.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `logoUrl` | `string` |  |  |

---

### Jumpcloud Apple Device

`jumpcloud_apple_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdAt` | `number` | Please use createdOn instead | **deprecated**: true |
| 
`depRegistered` \*

 | `boolean` | Please use isDepRegistered instead | **deprecated**: true |
| `deviceCapacity` | `number` |  |  |
| 

`enrolled` \*

 | `boolean` | Please use isEnrolled instead | **deprecated**: true |
| 

`hasActivationLockBypassCodes` \*

 | `boolean` |  |  |
| 

`isDepRegistered` \*

 | `boolean` |  |  |
| 

`isEnrolled` \*

 | `boolean` |  |  |
| 

`isSupervised` \*

 | `boolean` |  |  |
| 

`lastSeenOn` \*

 | `null` |  |  |
| `macAddress` | `string` |  |  |
| 

`make` \*

 | `string` |  | **const**: Apple |

---

### Jumpcloud Apple Mdm

`jumpcloud_apple_mdm` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apnsCertExpiry` | `string` |  |  |
| `appleCertSerialNumber` | `string` |  |  |
| `depServerTokenState` | `string` |  |  |

---

### Jumpcloud Application

`jumpcloud_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`beta` \*

 | `boolean` **|** `null` |  |  |
| 

`displayLabel` \*

 | `string` **|** `null` |  |  |
| 

`organization` \*

 | `string` **|** `null` |  |  |
| `ssoUrl` | `string` **|** `null` |  |  |

---

### Jumpcloud Device

`jumpcloud_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentVersion` | `string` |  |  |
| `encrypted` | `boolean` | Indicates if the Full Disk Encryption is active in the system |  |
| `fileSystem` | `string` |  |  |
| `isDesktopCapable` | `boolean` |  |  |
| `isEncryptionKeyPresent` | `boolean` |  |  |
| 
`isMultiFactorAuthenticationEnabled` \*

 | `boolean` |  |  |
| `isPolicyBound` | `boolean` |  |  |
| 

`isPublicKeyAuthenticationEnabled` \*

 | `boolean` |  |  |
| `isSecureLoginEnabled` | `boolean` |  |  |
| `isSecureLoginSupported` | `boolean` |  |  |
| 

`isSshPasswordAuthenticationEnabled` \*

 | `boolean` |  |  |
| 

`isSshRootEnabled` \*

 | `boolean` | Also refer to property isSshRootLoginEnabled. |  |
| 

`isSshRootLoginEnabled` \*

 | `boolean` | Also refer to property isSshRootEnabled. |  |
| 

`lastSeenOn` \*

 | `number` **|** `null` | Value originates from the "lastContact" property on the System resource. |  |
| `platform` | `string` |  |  |
| `systemTimezone` | `number` |  |  |
| `templateName` | `string` |  |  |

---

### Jumpcloud Group

`jumpcloud_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `attributes` | `string` | Stringified object |  |

---

### Jumpcloud User

`jumpcloud_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `company` | `string` |  |  |
| `department` | `string` |  |  |
| `employeeId` | `string` |  |  |
| `employeeType` | `string` |  |  |
| 
`externallyManaged` \*

 | `boolean` |  |  |
| 

`id` \*

 | `string` |  |  |
| `isPasswordExpired` | `boolean` |  |  |
| 

`isPasswordFederated` \*

 | `boolean` | True when the user password is managed by a federated identity provider (restrictedFields entry with field="password"). |  |
| `isPasswordSetToNeverExpire` | `boolean` |  |  |
| `jobTitle` | `string` |  |  |
| 

`ldapBindingUser` \*

 | `boolean` |  |  |
| `login` | `string` | Derived from username |  |
| 

`mfaConfigured` \*

 | `boolean` |  |  |
| 

`mfaExclusion` \*

 | `boolean` |  |  |
| `mfaExclusionEndOn` | `number` |  |  |
| `mfaExclusionUntil` | `number` | Use mfaExclusionEndOn instead | **deprecated**: true |
| `passwordExpiresOn` | `number` |  |  |
| `passwordFederationType` | `string` | The federation type for the password entry in restrictedFields (e.g. "federated\_identity\_provider"), if present. |  |
| 

`sambaServiceUser` \*

 | `boolean` |  |  |
| `state` | `string` |  | **Any of**:

-   `staged`

-   `activated`

-   `suspended`

 |
| 

`sudo` \*

 | `boolean` |  |  |
| 

`suspended` \*

 | `boolean` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name accuracy for JumpCloud device entities, deriving human-readable OS names from Apple device model names and system platform.
-   **2025-12-19** — Added beta status, display label, and organization ID properties to JumpCloud application entities.
-   **2025-05-06** — Added password expiration status, password expiration date, and never-expires indicator properties to JumpCloud user entities.

---

Source: /integrations/directory/justworks

# Justworks 2.0

Visualize your Justworks company and workforce in the JupiterOne graph. Ingest the Justworks company/organization and its members — employees and contractors — mapping each member to the company and to their manager, and enriching members with job title, department, office, and employment details. Monitor your identity and org structure through queries and alerts.

## Installation

The Justworks integration ingests your Justworks company and workforce using the Justworks Partner API (`https://public-api.justworks.com/v1`). It reads your company/organization (`/company`) and members (`/members`) to build a graph of the company, its employees and contractors, and the manager relationships between them. Because JupiterOne is not a Justworks partner, this integration uses a **customer-provided credentials** model: you obtain your own OAuth application from Justworks and supply its credentials to JupiterOne.

### Prerequisites

-   A **Justworks** account with administrator access.
-   A Justworks **OAuth application** (`client_id` and `client_secret`). Creating an OAuth application for the Partner API is **not self-service** — you must request one from Justworks. See the [Justworks Partner API documentation](https://public-api.justworks.com/v1/docs) for details.
-   A **refresh token** obtained by completing the one-time OAuth authorization (see below). Justworks refresh tokens are valid for 30 days.
-   Access to JupiterOne with permission to configure integrations.

### Obtaining Justworks credentials

1.  Request an OAuth application from Justworks for your company and note the issued **Client ID** and **Client Secret**.
2.  Grant the application the read scopes this integration uses:
    -   `company.basic:read` and `company.detail:read` — company profile, including the company legal name.
    -   `member.basic:read`, `member.detail:read`, and `member.employment:read` — members, including their emails, manager, member type, and employment details.
3.  Complete the one-time authorization at `https://payroll.justworks.com/oauth/authorize` (OAuth 2.0 Authorization Code flow) to obtain an initial **refresh token**. JupiterOne exchanges this refresh token for short-lived access tokens at `https://public-api.justworks.com/oauth/token`.

> **NOTE**
> 
> Justworks refresh tokens expire after 30 days. If an integration instance is idle for more than 30 days, the refresh token expires and you must re-authorize to generate a new one and update the instance configuration.

### Configuration in JupiterOne

To install the Justworks integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Justworks**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Justworks account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Justworks **Client ID** — the OAuth client ID issued by Justworks. This field is required.
    
-   Your Justworks **Client Secret** — the OAuth client secret issued by Justworks. This field is required.
    
-   Your Justworks **Refresh Token** — the refresh token obtained from the authorization flow above. This field is required.
    
-   Optionally, an **API Base URL** to override the default Justworks API endpoint (`https://public-api.justworks.com/v1`). Leave this blank unless instructed otherwise by Justworks or JupiterOne support.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (5)

-   `company.basic:read`
-   `company.detail:read`
-   `member.basic:read`
-   `member.detail:read`
-   `member.employment:read`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (2)

-   `https://public-api.justworks.com/v1/company`
-   `https://public-api.justworks.com/v1/members`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://public-api.justworks.com/v1/docs](https://public-api.justworks.com/v1/docs)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (1)

| Step | OAuth Scopes | Endpoints |
| --- | --- | --- |
| Fetch Members | `member.basic:read`, `member.detail:read`, `member.employment:read` | `https://public-api.justworks.com/v1/members` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `justworks_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Company | `justworks_company` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Member | `justworks_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `justworks_account` | **HAS** | `justworks_company` |
| `justworks_company` | **HAS** | `justworks_user` |
| `justworks_user` | **MANAGES** | `justworks_user` |

### Justworks Account

`justworks_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Justworks Company

`justworks_company` inherits from [Organization](/data-model/schemas/Organization.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`countryCodes` \*

 | `array` **|** `null` | ISO 3166-1 alpha-2 country codes of the company's addresses. |  |
| 

`departmentNames` \*

 | `array` **|** `null` | Names of the departments defined within the company. |  |
| 

`legalName` \*

 | `string` **|** `null` | The registered legal name of the company. |  |
| 

`officeNames` \*

 | `array` **|** `null` | Names of the offices defined within the company. |  |

---

### Justworks User

`justworks_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`companyId` \*

 | `string` **|** `null` | The identifier of the company the member belongs to. |  |
| 

`dateAddedToJustworksOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when the member was added to Justworks. |  |
| 

`departmentName` \*

 | `string` **|** `null` | Name of the department the member belongs to. |  |
| 

`employmentLocationType` \*

 | `string` **|** `null` | Location type where the member works (office or remote). |  |
| 

`employmentStartOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when the member's employment started. |  |
| 

`employmentTerminationOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when the member's employment was terminated. |  |
| 

`jobTitle` \*

 | `string` **|** `null` | The member's job title. |  |
| 

`managerName` \*

 | `string` **|** `null` | Full preferred name of the member's manager. The link to the manager is modeled by the justworks\_user\_manages\_user relationship. |  |
| 

`memberType` \*

 | `string` **|** `null` | The Justworks member type (e.g. full\_time\_employee, contractor). |  |
| 

`officeName` \*

 | `string` **|** `null` | Name of the office the member belongs to. |  |
| 

`phoneNumbers` \*

 | `array` **|** `null` | The member's phone numbers in E.164 format. |  |
| 

`workId` \*

 | `string` **|** `null` | The employer-assigned work identifier of the member. |  |

---

## Release Notes

-   **2026-07-15** — Added initial Justworks integration, ingesting accounts, companies, and users with their relationships.

---

Source: /integrations/directory/kandji

# Kandji

Visualize Iru (formerly Kandji) devices and apps, and monitor changes through queries and alerts.

## Installation

JupiterOne requires an API access token and the organization API URL for this integration. You need admin access to Iru (formerly Kandji) to generate an API token.

### Configuration in Iru

1.  Log in to your Iru tenant. Existing Kandji tenants use `https://{subdomain}.kandji.io/`; new Iru tenants use their assigned Iru URL.
    
2.  Go to **Settings**, then click the **Access** tab.
    
3.  Click **Add API Token**.
    
4.  Enter a **Name** for the token (required). A description is optional.
    
5.  Click **Create**. Copy the API token shown and store it securely — you will not be able to view it again.
    
6.  Click **Next**, then click **Configure** to assign endpoint permissions to the token.
    
7.  Enable the following permissions:
    
    | Permission | Endpoint |
    | --- | --- |
    | Device list | `GET /api/v1/devices` |
    | Device details | `GET /api/v1/devices/{device_id}/details` |
    | Application list | `GET /api/v1/devices/{device_id}/apps` |
    | List custom profiles | `GET /api/v1/library/custom-profiles` |
    | List blueprints | `GET /api/v1/blueprints` |
    | Vulnerability management — vulnerabilities | `GET /api/v1/vulnerability-management/vulnerabilities` |
    | Vulnerability management — detections | `GET /api/v1/vulnerability-management/detections` |
    | Threat details | `GET /api/v1/threat-details` |
    
8.  Click **Save**.
    
9.  Your tenant-specific **API URL** is shown on the API tokens page. Copy it for use in JupiterOne.
    

## Data Volume Configuration

Control how much data is ingested from Iru to manage storage and processing.

### Ingestion Windows

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Threat Ingest Since Days** | How many days back to look when ingesting threat data. Increasing this value ingests more threats. | 90 | 90, 180, 275, 365 |

### Data Filtering Options

| Field | Description | Default |
| --- | --- | --- |
| **Threat Status** | Filters threat ingestion to the selected quarantine status. When unset, all statuses are ingested. | All statuses |

**Available options for Threat Status:**

-   **Quarantined** — Only ingest threats that are quarantined.
-   **Not Quarantined** — Only ingest threats that are not quarantined.
-   **Released** — Only ingest threats that have been released from quarantine.

## Configuration in JupiterOne

To install the integration in JupiterOne, navigate to the **Integrations** tab, select **Kandji**, and click **New Instance**. Provide the following:

-   **Account Name** — A label to identify this account in JupiterOne. Ingested entities store this value in `tag.AccountName`.
    
-   **Description** — Optional. Helps distinguish multiple integration instances.
    
-   **Polling Interval** — How often JupiterOne collects data from Iru. Set to `DISABLED` to run manually.
    
-   **Kandji API Url** — The organization API URL from your Iru tenant, in the format `https://{yourApiUrl}/api/v1/`. Include `https://` at the start and `/api/v1/` at the end.
    
-   **Kandji Access Token** — The API token generated in the steps above.
    

Click **Create** to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (8)

-   `Device applications`
-   `Device details`
-   `Device list`
-   `List blueprints`
-   `List custom profiles`
-   `Threat details`
-   `Vulnerability management - detections`
-   `Vulnerability management - vulnerabilities`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (8)

-   `GET {apiUrl}/blueprints`
-   `GET {apiUrl}/devices`
-   `GET {apiUrl}/devices/{device_id}/apps`
-   `GET {apiUrl}/devices/{device_id}/details`
-   `GET {apiUrl}/library/custom-profiles`
-   `GET {apiUrl}/threat-details`
-   `GET {apiUrl}/vulnerability-management/detections`
-   `GET {apiUrl}/vulnerability-management/vulnerabilities`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (2)

-   [https://api-docs.kandji.io/](https://api-docs.kandji.io/)
-   [https://support.kandji.io/kb/kandji-api](https://support.kandji.io/kb/kandji-api)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (6)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Build Device Blueprint Relationships | \- | \- |
| Build Device Profile Relationships | \- | \- |
| Build Vulnerability Relationships | `Vulnerability management - detections` | `GET {apiUrl}/vulnerability-management/detections` |
| Fetch Device Apps | `Device applications` | `GET {apiUrl}/devices/{device_id}/apps` |
| Fetch Device Users | \- | \- |
| Fetch File Threats | `Threat details` | `GET {apiUrl}/threat-details` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `kandji_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| App | `kandji_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Blueprint | `kandji_blueprint` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Custom\_Profile | `kandji_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Device | `kandji_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| File Threat | `kandji_file_threat` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| User | `kandji_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vulnerability | `kandji_vulnerability` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Vulnerability | `kandji_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `kandji_account` | **HAS** | `kandji_device` |
| `kandji_app` | **HAS** | `kandji_vulnerability` |
| `kandji_device` | **INSTALLED** | `kandji_app` |
| `kandji_device` | **HAS** | `kandji_vulnerability` |
| `kandji_device` | **HAS** | `kandji_file_threat` |
| `kandji_device` | **ASSIGNED** | `kandji_blueprint` |
| `kandji_device` | **ASSIGNED** | `kandji_profile` |
| `kandji_user` | **OWNS** | `kandji_device` |

### Kandji Account

`kandji_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`name` \*

 | `string` |  |  |

---

### Kandji App

`kandji_app` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appStoreVendable` | `string` |  |  |
| 
`bundleId` \*

 | `string` |  |  |
| `deviceBasedVpp` | `string` |  |  |
| `process` | `string` |  |  |
| `source` | `string` |  |  |

---

### Kandji Blueprint

`kandji_blueprint` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`computersCount` \*

 | `string` |  |  |
| 

`description` \*

 | `string` |  |  |
| 

`enrollmentCodeActive` \*

 | `boolean` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Kandji Device

`kandji_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activationLock.activationLockAllowedWhileSupervised` | `boolean` **|** `null` |  |  |
| `activationLock.activationLockSupported` | `boolean` |  |  |
| `activationLock.bypassCodeFailed` | `boolean` |  |  |
| `activationLock.deviceActivationLockEnabled` | `boolean` |  |  |
| `activationLock.userActivationLockEnabled` | `boolean` |  |  |
| `agentInstalled` | `boolean` |  |  |
| `agentVersion` | `string` |  |  |
| `blueprintId` | `string` |  |  |
| `blueprintName` | `string` |  |  |
| `filevault.filevaultEnabled` | `boolean` |  |  |
| `filevault.filevaultNextRotation` | `string` |  |  |
| `filevault.filevaultPrkEscrowed` | `boolean` |  |  |
| `filevault.filevaultRecoverykeyType` | `string` |  |  |
| `filevault.filevaultRegenRequired` | `boolean` |  |  |
| `firstEnrollmentOn` | `number` |  |  |
| `general.assignedUserEmail` | `string` |  |  |
| `general.assignedUserId` | `number` |  |  |
| `general.assignedUserIsArchived` | `boolean` |  |  |
| `general.assignedUserName` | `string` |  |  |
| `general.blueprintName` | `string` |  |  |
| `general.blueprintUuid` | `string` |  |  |
| `general.bootVolume` | `string` |  |  |
| `general.lastUser` | `string` |  |  |
| `general.systemVersion` | `string` |  |  |
| `general.timeSinceBoot` | `string` |  |  |
| `hardwareOverview.memory` | `string` |  |  |
| `hardwareOverview.modelIdentifier` | `string` |  |  |
| `hardwareOverview.modelName` | `string` |  |  |
| `hardwareOverview.numberOfProcessors` | `string` |  |  |
| `hardwareOverview.processorName` | `string` |  |  |
| `hardwareOverview.processorSpeed` | `string` |  |  |
| `hardwareOverview.totalNumberOfCores` | `string` |  |  |
| `installedProfiles` | `array` of `string`s |  |  |
| `isMissing` | `boolean` |  |  |
| `isRemoved` | `boolean` |  |  |
| `kandjiAgent.agentInstalled` | `string` |  |  |
| `kandjiAgent.agentVersion` | `string` |  |  |
| `kandjiAgent.installDate` | `string` |  |  |
| `kandjiAgent.lastCheckIn` | `string` |  |  |
| `lastCheckinOn` | `number` **|** `null` |  |  |
| `lastEnrollmentOn` | `number` |  |  |
| `macAddress` | `string` |  |  |
| `mdm.installDate` | `string` |  |  |
| `mdm.lastCheckIn` | `string` |  |  |
| `mdm.mdmEnabled` | `string` |  |  |
| `mdm.mdmEnabledUser` | `array` of `string`s |  |  |
| `mdmEnabled` | `boolean` |  |  |
| `network.ipAddress` | `string` |  |  |
| `network.localHostname` | `string` |  |  |
| `network.macAddress` | `string` | This property is deprecated and will be removed in future versions. Please use the macAddress property instead. |  |
| `network.publicIp` | `string` |  |  |
| `platform` | `string` |  |  |
| `serialNumber` | `string` **|** `null` |  |  |
| `user.email` | `string` **|** `null` |  |  |
| `user.id` | `number` **|** `null` |  |  |
| `user.isArchived` | `boolean` **|** `null` |  |  |
| `user.name` | `string` **|** `null` |  |  |
| `users.regularUsers` | `array` of `string`s |  |  |
| `users.systemUsers` | `array` of `string`s |  |  |
| `volumes` | `array` of `string`s |  |  |

---

### Kandji File Threat

`kandji_file_threat` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `classification` | `string` |  |  |
| `fileHash` | `string` |  |  |
| `filePath` | `string` |  |  |
| `status` | `string` |  |  |

---

### Kandji Profile

`kandji_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `mdmIdentifier` | `string` |  |  |

---

### Kandji User

`kandji_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isArchived` | `boolean` |  |  |

---

### Kandji Vulnerability

`kandji_vulnerability` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cveDescription` | `string` |  |  |
| `cveLink` | `string` |  |  |
| `cvePublishedOn` | `number` |  |  |
| `cveUpdatedOn` | `number` |  |  |
| `cvssScore` | `number` |  |  |
| `cvssSeverity` | `string` |  |  |
| `devicesImpacted` | `number` |  |  |
| `firstDetectedOn` | `number` |  |  |
| `lastDetectedOn` | `number` |  |  |

---

### Kandji Vulnerability

`kandji_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cveDescription` | `string` |  |  |
| `cveLink` | `string` |  |  |
| `cvePublishedOn` | `number` |  |  |
| `cveUpdatedOn` | `number` |  |  |
| `cvssScore` | `number` |  |  |
| `cvssSeverity` | `string` |  |  |
| `devicesImpacted` | `number` |  |  |
| `firstDetectedOn` | `number` |  |  |
| `lastDetectedOn` | `number` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name accuracy for Kandji device entities, using human-readable names for macOS and iOS devices.
-   **2025-06-04** — Added CVE ID to Kandji vulnerability entities and enabled the Vulnerability entity class for unified vulnerability querying.
-   **2025-04-28** — Added Kandji vulnerability and file threat ingestion, exposing device vulnerabilities and detected file threats as new entity types.

---

Source: /integrations/directory/knowbe4

# KnowBe4

Visualize Knowbe4 users, groups, training campaigns, and modules, and monitor changes through queries and alerts.

## Installation

For you to use this integration, JupiterOne requires the regional site for where your account is located and a Knowbe4 API key configured for use in JupiterOne.

### Configuration in Knowbe4

You can generate a new key in your KnowBe4 account settings under the API section. Be sure to request a key for the Reporting API, not for the User Event API. Select the Enabled Reporting API Access option, and click **Save Changes**. Refresh the page to ensure that the changes were saved. Then, copy the API Token to use in JupiterOne.

> **INFO**
> 
> KnowBe4 APIs are available to Platinum and Diamond customers only. See the [KnowBe4 API Reference Guide](https://developer.knowbe4.com/rest/reporting/) for more information.

### Configuration in JupiterOne

To install the Knowbe4 integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Knowbe4. Click **New Instance** to begin configuring your integration, providing the following:

-   **Account Name** used to identify the Knowbe4 account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` option is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Site of your KnowBe4 account**, either `US` or `EU`.
    
-   **API Key** configured in your KnowBe4 account.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| KnowBe4 Account | `knowbe4_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| KnowBe4 Group | `knowbe4_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| KnowBe4 Phishing Campaign | `knowbe4_phishing_campaign` | [Training](https://docs.jupiterone.io/data-model/schemas/Training) |
| KnowBe4 Phishing Security Test | `knowbe4_phishing_security_test` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| KnowBe4 Phishing Security Test Results | `knowbe4_phishing_security_test_result` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| KnowBe4 Training Campaign | `training_campaign` | [Training](https://docs.jupiterone.io/data-model/schemas/Training) |
| KnowBe4 Training Module | `training_module` | [Training](https://docs.jupiterone.io/data-model/schemas/Training), [Module](https://docs.jupiterone.io/data-model/schemas/Module) |
| KnowBe4 User | `knowbe4_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `knowbe4_account` | **HAS** | `knowbe4_user_group` |
| `knowbe4_account` | **HAS** | `knowbe4_user` |
| `knowbe4_account` | **HAS** | `training_campaign` |
| `knowbe4_account` | **HAS** | `knowbe4_phishing_campaign` |
| `knowbe4_phishing_campaign` | **CONTAINS** | `knowbe4_phishing_security_test` |
| `knowbe4_phishing_security_test` | **CONTAINS** | `knowbe4_phishing_security_test_result` |
| `knowbe4_user` | **COMPLETED** | `training_module` |
| `knowbe4_user` | **HAS** | `knowbe4_phishing_security_test_result` |
| `knowbe4_user_group` | **HAS** | `knowbe4_user` |
| `training_campaign` | **ASSIGNED** | `knowbe4_user_group` |
| `training_campaign` | **HAS** | `training_module` |
| `training_module` | **ASSIGNED** | `knowbe4_user` |

### Knowbe4 User

`knowbe4_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `adiGuid` | `string` |  |  |
| `adiManageable` | `boolean` |  |  |
| `aliases` | `array` of `string`s |  |  |
| `archivedAt` | `string` | This property is deprecated. Please use archivedOn instead. | **deprecated**: true |
| `archivedOn` | `integer` |  |  |
| `comment` | `string` |  |  |
| `department` | `string` |  |  |
| `division` | `string` |  |  |
| `employeeNumber` | `string` |  |  |
| `employeeStartDate` | `integer` |  |  |
| `extension` | `string` |  |  |
| `groups` | `array` of `integer`s |  |  |
| `jobTitle` | `string` |  |  |
| `joinedOn` | `integer` |  |  |
| `language` | `string` |  |  |
| `lastSignIn` | `integer` |  |  |
| `location` | `string` |  |  |
| `managerEmail` | `string` |  |  |
| `managerName` | `string` |  |  |
| `mobilePhoneNumber` | `string` |  |  |
| `organization` | `string` |  |  |
| `phishPronePercentage` | `number` |  |  |
| `phoneNumber` | `string` |  |  |

---

## Release Notes

-   **2026-03-23** — Added QR code scanned tracking to KnowBe4 phishing security test result entities.
-   **2026-03-18** — Added parsed timestamp properties for phishing campaign and test result events, enabling date-based queries on scheduled, delivered, opened, clicked, and reported activity times.

---

Source: /integrations/directory/kong-konnect

# Kong Konnect

Visualize your Kong Konnect API gateway estate in the JupiterOne graph — the Control Planes in your organization and the Gateway configuration each one owns: the Services traffic is proxied to, the Routes that match requests to them, the Consumers that call them, and the Plugins enforcing authentication, rate limiting and other policy. Plugins are linked to the Service, Route or Consumer they protect, so you can see which of your APIs are behind an auth plugin and which are exposed without one. TLS Certificates and Consumer Group membership are ingested alongside, letting you audit gateway policy coverage and monitor configuration changes through queries and alerts.

## Installation

This integration reads your Kong Konnect organization through the [Konnect Control Planes](https://developer.konghq.com/api/konnect/control-planes/v2/) and [Control Planes Config](https://developer.konghq.com/api/konnect/control-planes-config/v2/) v2 APIs — the Control Planes in your organization, and the Gateway configuration each one owns: Services, Routes, Consumers, Consumer Groups, Plugins and Certificates. It is read-only, issuing only `GET` requests, and never modifies your Gateway configuration.

Plugins are attached to the Service, Route or Consumer they are scoped to, and Routes to the Service they proxy to, so gateway policy coverage is queryable directly from the graph.

### Prerequisites

-   A **Kong Konnect** organization.
-   The **geographic region** your organization is hosted in. Konnect data is geo-scoped, so this determines which API host the integration reads from — see **Choosing a region** below.
-   A Konnect **access token** with read access to your Control Planes — see **Creating an access token** below.
-   Access to JupiterOne with permission to configure integrations.

### Choosing a region

Konnect runs in six geographic regions, and each one is served from its own API host:

| Region | API host |
| --- | --- |
| United States (`us`) | `https://us.api.konghq.com` |
| Europe (`eu`) | `https://eu.api.konghq.com` |
| Australia (`au`) | `https://au.api.konghq.com` |
| India (`in`) | `https://in.api.konghq.com` |
| Middle East (`me`) | `https://me.api.konghq.com` |
| Singapore (`sg`) | `https://sg.api.konghq.com` |

> **NOTE**
> 
> Konnect objects such as Control Planes, Services and Consumers are **geo-specific** — an object created in one region does not exist in another, and only authentication, billing and usage are shared between regions. An integration instance therefore sees exactly one region. If your organization operates in more than one, create one instance per region.
> 
> The Singapore region must be opted into by a Konnect org admin in the region picker before it can be used. See [Geographic regions](https://developer.konghq.com/konnect-platform/geos/) for the current list.

### Creating an access token

The integration authenticates with a bearer token, and accepts either kind of Konnect access token:

-   A **Personal Access Token (PAT)**, prefixed `kpat_`, tied to a user account.
-   A **System Account Access Token (SPAT)**, prefixed `spat_`, tied to a system account.

A system account is the better choice for an integration: it is not tied to a person, so the integration keeps working when that person's access changes or they leave the organization. System accounts cannot sign in to the Konnect UI and exist only for API use.

To create a personal access token, select your user icon in Konnect to open the context menu, click **Personal access tokens**, then click **Generate token**.

> **CAUTION**
> 
> The token is displayed only once, when it is generated. Record it before leaving the page — if you lose it, you must generate a new one.

#### Granting read access

A Konnect token carries exactly the access of the identity it belongs to — Konnect has no separate scopes or permission strings for tokens, only the RBAC roles assigned to that user or system account.

Assign the **Control Planes → Viewer** role, which grants "read only access to all entities within a control plane" and covers everything this integration reads. Roles can be scoped to one Control Plane or to all Control Planes.

> **NOTE**
> 
> Scope the role to **all Control Planes**. `GET /control-planes` returns only the Control Planes the identity has a role on, so a token scoped to a subset silently ingests only that subset rather than reporting an error. If you intend to cover the whole organization, grant the role organization-wide — or use the predefined **Organization Admin (Read Only)** team, which can view all entities and configuration in the organization.

See [Teams and roles](https://developer.konghq.com/konnect-platform/teams-and-roles/) for how roles are assigned to users, teams and system accounts.

Personal access tokens have a maximum lifetime of 12 months, are limited to 10 per user, and are revoked after 12 months of inactivity. Plan a rotation before the token expires, or the integration will begin failing authentication.

### Configuration in JupiterOne

To install the Kong Konnect integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Kong Konnect**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Kong Konnect account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **Personal Access Token** — the `kpat_` or `spat_` token you created above.
    
-   Your **Region** — the geographic region your Konnect organization is hosted in, selected from the list.
    

Click **Create** once all values are provided to finalize the integration.

#### Data sources

You can narrow what the integration collects from the instance's ingestion source settings. All sources are enabled by default.

| Ingestion source | Default | Data collected |
| --- | --- | --- |
| **Fetch Control Planes** | Enabled | The Control Planes in your organization, with cluster type, data-plane auth type, and the Control Plane and telemetry endpoints. |
| **Fetch Services** | Enabled | Gateway Services — the upstreams Kong proxies to — with the upstream address, protocol, timeouts, retries and TLS verification setting. |
| **Fetch Routes** | Enabled | Routes and their matching rules (protocols, methods, hosts, paths, SNIs or router expression), and the Service each one proxies to. |
| **Fetch Consumers** | Enabled | Consumers — the clients of your proxied Services — with their username and custom ID. |
| **Fetch Consumer Groups** | Enabled | Consumer Groups used to apply shared policy, and which Consumers belong to each. |
| **Fetch Plugins** | Enabled | Plugins, the policy they represent, whether they are enabled, and the Service, Route or Consumer each one is scoped to. |
| **Fetch Certificates** | Enabled | TLS Certificate metadata and the SNI hostnames associated with each. |

Sources build on one another, and disabling one also disables the sources that depend on it:

-   **Fetch Control Planes** underpins every other source — Gateway configuration is read per Control Plane, so disabling it disables all of them.
-   **Fetch Routes** depends on **Fetch Services**, so that each Route can be linked to the Service it proxies to.
-   **Fetch Consumer Groups** depends on **Fetch Consumers**, so that group membership can be resolved.
-   **Fetch Plugins** depends on **Fetch Services**, **Fetch Routes** and **Fetch Consumers**, so that each Plugin can be attached to what it protects. Because Plugins carry your authentication and rate-limiting policy, check this before turning any of those three off.

> **NOTE**
> 
> Certificate private keys are never ingested. The Konnect API returns the PEM `cert` and `key` material on every Certificate, and the integration discards it before anything is written to the graph — only the certificate ID, SNIs, tags and timestamps are kept. Plugin `config` blocks are discarded the same way, since they hold credentials for several plugin types.

> **NOTE**
> 
> **Control Plane groups** are ingested as Control Planes but their Gateway configuration is not read separately. A group is a read-only Control Plane that combines the configuration of its member Control Planes under the same entity IDs, so reading both would duplicate every Service, Route, Consumer, Plugin and Certificate. The members are ingested directly instead, and each skipped group is recorded in the job log.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Konnect API authentication](https://developer.konghq.com/konnect-api/) — personal access tokens, system accounts and the regional API hosts
-   [Geographic regions](https://developer.konghq.com/konnect-platform/geos/) — the Konnect regions and what is scoped to each
-   [Teams and roles](https://developer.konghq.com/konnect-platform/teams-and-roles/) — the Control Planes roles and how they are assigned
-   [Control plane groups](https://developer.konghq.com/gateway/control-plane-groups/) — how a group combines its members' configuration
-   [Konnect Control Planes Config API](https://developer.konghq.com/api/konnect/control-planes-config/v2/) — the Gateway configuration endpoints this integration reads

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `Control Planes: Viewer`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (8)

-   `GET /control-planes`
-   `GET /control-planes/{controlPlaneId}/core-entities/certificates`
-   `GET /control-planes/{controlPlaneId}/core-entities/consumer_groups`
-   `GET /control-planes/{controlPlaneId}/core-entities/consumer_groups/{ConsumerGroupId}/consumers`
-   `GET /control-planes/{controlPlaneId}/core-entities/consumers`
-   `GET /control-planes/{controlPlaneId}/core-entities/plugins`
-   `GET /control-planes/{controlPlaneId}/core-entities/routes`
-   `GET /control-planes/{controlPlaneId}/core-entities/services`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (3)

-   [https://developer.konghq.com/api/konnect/control-planes-config/v2/](https://developer.konghq.com/api/konnect/control-planes-config/v2/)
-   [https://developer.konghq.com/api/konnect/control-planes/v2/](https://developer.konghq.com/api/konnect/control-planes/v2/)
-   [https://developer.konghq.com/konnect/org-management/roles-and-permissions/](https://developer.konghq.com/konnect/org-management/roles-and-permissions/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (6)

| Step | Roles | Endpoints |
| --- | --- | --- |
| Fetch Certificates | `Control Planes: Viewer` | `GET /control-planes/{controlPlaneId}/core-entities/certificates` |
| Fetch Consumer Groups | `Control Planes: Viewer` | `GET /control-planes/{controlPlaneId}/core-entities/consumer_groups`, `GET /control-planes/{controlPlaneId}/core-entities/consumer_groups/{ConsumerGroupId}/consumers` |
| Fetch Consumers | `Control Planes: Viewer` | `GET /control-planes/{controlPlaneId}/core-entities/consumers` |
| Fetch Plugins | `Control Planes: Viewer` | `GET /control-planes/{controlPlaneId}/core-entities/plugins` |
| Fetch Routes | `Control Planes: Viewer` | `GET /control-planes/{controlPlaneId}/core-entities/routes` |
| Fetch Services | `Control Planes: Viewer` | `GET /control-planes/{controlPlaneId}/core-entities/services` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `kong_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Certificate | `kong_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| Consumer | `kong_consumer` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| ConsumerGroup | `kong_consumer_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| ControlPlane | `kong_control_plane` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Plugin | `kong_plugin` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Route | `kong_route` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Service | `kong_service` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `kong_account` | **HAS** | `kong_control_plane` |
| `kong_consumer_group` | **HAS** | `kong_consumer` |
| `kong_control_plane` | **HAS** | `kong_service` |
| `kong_control_plane` | **HAS** | `kong_route` |
| `kong_control_plane` | **HAS** | `kong_consumer` |
| `kong_control_plane` | **HAS** | `kong_consumer_group` |
| `kong_control_plane` | **HAS** | `kong_plugin` |
| `kong_control_plane` | **HAS** | `kong_certificate` |
| `kong_plugin` | **PROTECTS** | `kong_service` |
| `kong_plugin` | **PROTECTS** | `kong_route` |
| `kong_plugin` | **PROTECTS** | `kong_consumer` |
| `kong_route` | **CONNECTS** | `kong_service` |

### Kong Account

`kong_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`region` \*

 | `string` | The Kong Konnect geographic region hosting the organization ('us', 'eu', 'au', 'in', 'me' or 'sg'). |  |

---

### Kong Certificate

`kong_certificate` inherits from [Certificate](/data-model/schemas/Certificate.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`snis` \*

 | `array` **|** `null` | Server Name Indication hostnames associated with the Certificate. |  |

---

### Kong Consumer

`kong_consumer` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`customId` \*

 | `string` **|** `null` | An existing unique ID for the Consumer, for mapping to an external datastore. |  |

---

### Kong Consumer Group

`kong_consumer_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

---

### Kong Control Plane

`kong_control_plane` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`authType` \*

 | `string` **|** `null` | The data-plane auth type ('pinned\_client\_certs' or 'pki\_client\_certs'). |  |
| 

`clusterType` \*

 | `string` **|** `null` | The cluster type of the Control Plane (e.g. 'CLUSTER\_TYPE\_CONTROL\_PLANE'). |  |
| 

`controlPlaneEndpoint` \*

 | `string` **|** `null` | The Control Plane endpoint URL for data planes. |  |
| 

`isCloudGateway` \*

 | `boolean` **|** `null` | Whether the Control Plane can be used for cloud gateways. |  |
| 

`telemetryEndpoint` \*

 | `string` **|** `null` | The telemetry endpoint URL for data planes. |  |

---

### Kong Plugin

`kong_plugin` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`consumerGroupId` \*

 | `string` **|** `null` | The id of the Consumer Group the Plugin is scoped to, if any. |  |
| 

`instanceName` \*

 | `string` **|** `null` | An optional unique instance name for the Plugin. |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` | Whether the Plugin is enabled. |  |
| 

`pluginName` \*

 | `string` | The Kong plugin type name (e.g. 'rate-limiting', 'key-auth', 'cors'). |  |
| 

`protocols` \*

 | `array` **|** `null` | Protocols the Plugin applies to. |  |

---

### Kong Route

`kong_route` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`expression` \*

 | `string` **|** `null` | Router Expression used to match the Route (expressions router flavor). |  |
| 

`hosts` \*

 | `array` **|** `null` | Domain names that match this Route. |  |
| 

`httpsRedirectStatusCode` \*

 | `number` **|** `null` | Status code Kong responds with to redirect HTTP requests to HTTPS. |  |
| 

`isPreserveHostEnabled` \*

 | `boolean` **|** `null` | Whether the request Host header is used in the upstream request. |  |
| 

`isStripPathEnabled` \*

 | `boolean` **|** `null` | Whether the matching path prefix is stripped from the upstream request URL. |  |
| 

`methods` \*

 | `array` **|** `null` | HTTP methods that match this Route. |  |
| 

`pathHandling` \*

 | `string` **|** `null` | How Service and Route paths are combined ('v0' or 'v1'). |  |
| 

`paths` \*

 | `array` **|** `null` | Paths that match this Route. |  |
| 

`protocols` \*

 | `array` **|** `null` | Protocols this Route allows (e.g. http, https, grpc). |  |
| 

`snis` \*

 | `array` **|** `null` | SNIs that match this Route (for tls/tls\_passthrough). |  |

---

### Kong Service

`kong_service` inherits from [ApplicationEndpoint](/data-model/schemas/ApplicationEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`connectTimeout` \*

 | `number` **|** `null` | Timeout in milliseconds for establishing a connection to the upstream. |  |
| 

`host` \*

 | `string` | The host of the upstream server. |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` | Whether the Service is active. |  |
| 

`isTlsVerificationEnabled` \*

 | `boolean` **|** `null` | Whether verification of the upstream TLS certificate is enabled. |  |
| 

`path` \*

 | `string` **|** `null` | The path used in requests to the upstream server. |  |
| 

`port` \*

 | `number` **|** `null` | The upstream server port. |  |
| 

`protocol` \*

 | `string` **|** `null` | The protocol used to communicate with the upstream (e.g. 'http', 'https', 'grpc'). |  |
| 

`readTimeout` \*

 | `number` **|** `null` | Timeout in milliseconds between two successive read operations. |  |
| 

`retries` \*

 | `number` **|** `null` | The number of retries to execute upon proxy failure. |  |
| 

`writeTimeout` \*

 | `number` **|** `null` | Timeout in milliseconds between two successive write operations. |  |

---

---

Source: /integrations/directory/kubernetes

# Kubernetes Native

Visualize Kubernetes resources and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> To use this integration, you must have a running Kubernetes cluster. This integration with JupiterOne is deployed as a pod and interacts with a Kubernetes API server.

### Configuration in JupiterOne

1.  Navigate to the **Integrations** tab in JupiterOne and select **Kubernetes**.
    
2.  Click **New Instance** to begin configuring your integration and provide the following:
    
    -   **Account Name** — used to identify the Kubernetes account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **AccountName** toggle is enabled.
    -   **Description** (optional) — helps identify the integration instance.
3.  Click **Create**. Your instance appears in the list of Kubernetes instances.
    
4.  Click the name of the new instance and go to the **API Keys** tab.
    
5.  Follow the prompts to create an integration API key.
    
6.  Click **Reveal** and copy the API key.
    

For the Kubernetes configuration you will need:

-   The Integration API Key you just created
-   The Integration Instance ID (listed as **ID** in Configuration Settings)
-   Your Account ID (listed under **Account Management** after clicking the gear icon)

### Configuration in Kubernetes using Helm (recommended)

The easiest way to install and keep the integration up to date is through the published Helm chart. See the [JupiterOne Helm repository](https://github.com/JupiterOne/helm-charts/tree/main/charts/graph-kubernetes) for full chart documentation.

#### Quickstart

```bash
helm repo add jupiterone https://jupiterone.github.io/helm-charts
helm repo update
helm install [RELEASE_NAME] jupiterone/graph-kubernetes \
  --set secrets.jupiteroneAccountId="<account-id>" \
  --set secrets.jupiteroneApiKey="<api-key>" \
  --set secrets.jupiteroneIntegrationInstanceId="<integration-instance-id>"
```

The Helm chart automatically creates the service account, the required RBAC Role/ClusterRole, and the RoleBinding/ClusterRoleBinding for the integration.

### Configuration in Kubernetes using standard YAML

#### Authentication — RBAC

The integration runs as a Kubernetes service account that must be granted **read** access to the resources it ingests. It dynamically skips any resource type the service account cannot access, so you can tune permissions to match what your cluster allows.

> **NOTE**
> 
> The built-in `view` ClusterRole is **not sufficient**. It omits `secrets`, cluster-scoped RBAC resources (`clusterroles`, `clusterrolebindings`), `nodes`, and `certificatesigningrequests`, which the integration collects. Use a custom Role or ClusterRole as shown below.

**Namespace-scoped access** (limits ingestion to a single namespace):

1.  Create a service account:
    
    ```bash
    kubectl create sa jupiterone-integration -n <namespace>
    ```
    
2.  Apply a custom Role granting read access to the required resources, then bind it:
    
    ```bash
    kubectl apply -f role.yml
    kubectl apply -f roleBinding.yml
    ```
    

**Cluster-wide access** (ingests all namespaces and cluster-scoped resources):

1.  Create a service account:
    
    ```bash
    kubectl create sa jupiterone-integration-cluster
    ```
    
2.  Apply a custom ClusterRole and ClusterRoleBinding:
    
    ```bash
    kubectl apply -f clusterRole.yml
    kubectl apply -f clusterRoleBinding.yml
    ```
    

See the [Helm chart RBAC templates](https://github.com/JupiterOne/helm-charts/tree/main/charts/graph-kubernetes) for reference Role and ClusterRole definitions that match the integration's full resource requirements.

> **NOTE**
> 
> If you use a different service account name or namespace, update the names consistently across all YAML files and `kubectl` commands.

#### Secrets

The integration reads your JupiterOne credentials from Kubernetes Secrets. Create the secret with base64-encoded values:

```bash
kubectl apply -f createSecret.yml
```

#### Deploying

Deploy the integration as a Kubernetes CronJob:

-   **Namespace-scoped access:**
    
    ```bash
    kubectl apply -f cronjobNamespace.yml
    ```
    
-   **Cluster-wide access:**
    
    ```bash
    kubectl apply -f cronjobCluster.yml
    ```
    

#### Debugging

-   Check whether the CronJob was created:
    
    ```bash
    kubectl get cronjob
    ```
    
-   Check whether the CronJob has spawned jobs:
    
    ```bash
    kubectl get job
    ```
    
-   View pod logs:
    
    ```bash
    kubectl logs --selector job-name=<job-name>
    ```
    

#### Uninstall

```bash
kubectl delete cronjob <name>
kubectl delete serviceaccount <serviceaccount> -n <namespace>
kubectl delete clusterrolebinding <clusterrolebinding>
kubectl delete clusterrole <clusterrole>
```

#### Upgrading

Reapply any changed resource manifest:

```bash
kubectl apply -f resourceFile.yaml
```

### Telemetry and Diagnostics

The Helm chart and vanilla Kubernetes YAML manifests include the OpenTelemetry Collector and FluentBit, with FluentBit forwarding container logs into the OpenTelemetry Collector. To forward telemetry to your own systems (CloudWatch, Prometheus, etc.), configure the collector to point to them and update the manifests.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Kubernetes Certificate Signing Request | `kube_certificate_signing_request` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Kubernetes Cluster | `kube_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Kubernetes Cluster Role | `kube_cluster_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Kubernetes Cluster Role Binding | `kube_cluster_role_binding` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Kubernetes ConfigMap | `kube_config_map` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Kubernetes Container | `kube_container` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| Kubernetes Container Spec | `kube_container_spec` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Kubernetes CronJob | `kube_cron_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Kubernetes Custom Resource | `kube_custom_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Kubernetes Custom Resource Definition | `kube_custom_resource_definition` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Kubernetes DaemonSet | `kube_daemon_set` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Kubernetes Deployment | `kube_deployment` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Kubernetes Image | `kube_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Kubernetes Job | `kube_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Kubernetes Namespace | `kube_namespace` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Kubernetes Network Policy | `kube_network_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Kubernetes Node | `kube_node` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Kubernetes Pod | `kube_pod` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Kubernetes ReplicaSet | `kube_replica_set` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Kubernetes Role | `kube_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Kubernetes Role Binding | `kube_role_binding` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Kubernetes Role Rule | `kube_role_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Kubernetes Secret | `kube_secret` | [Vault](https://docs.jupiterone.io/data-model/schemas/Vault), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Kubernetes Service | `kube_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Kubernetes Service Account | `kube_service_account` | [User](https://docs.jupiterone.io/data-model/schemas/User), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Kubernetes StatefulSet | `kube_stateful_set` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Kubernetes User | `kube_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Kubernetes Volume | `kube_volume` | [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `kube_cluster` | **CONTAINS** | `kube_cluster_role` |
| `kube_cluster` | **CONTAINS** | `kube_cluster_role_binding` |
| `kube_cluster` | **CONTAINS** | `kube_namespace` |
| `kube_cluster_role` | **ENFORCES** | `kube_role_rule` |
| `kube_cluster_role` | **ASSIGNED** | `kube_role_binding` |
| `kube_cluster_role_binding` | **ASSIGNED** | `kube_service_account` |
| `kube_container` | **USES** | `kube_image` |
| `kube_container_spec` | **USES** | `kube_volume` |
| `kube_cron_job` | **MANAGES** | `kube_job` |
| `kube_cron_job` | **USES** | `kube_container_spec` |
| `kube_custom_resource` | **IMPLEMENTS** | `kube_custom_resource_definition` |
| `kube_daemon_set` | **USES** | `kube_container_spec` |
| `kube_deployment` | **USES** | `kube_container_spec` |
| `kube_deployment` | **MANAGES** | `kube_replica_set` |
| `kube_job` | **USES** | `kube_container_spec` |
| `kube_job` | **MANAGES** | `kube_pod` |
| `kube_namespace` | **CONTAINS** | `kube_network_policy` |
| `kube_namespace` | **CONTAINS** | `kube_service_account` |
| `kube_namespace` | **CONTAINS** | `kube_role` |
| `kube_namespace` | **CONTAINS** | `kube_role_binding` |
| `kube_namespace` | **CONTAINS** | `kube_service` |
| `kube_namespace` | **CONTAINS** | `kube_deployment` |
| `kube_namespace` | **CONTAINS** | `kube_replica_set` |
| `kube_namespace` | **CONTAINS** | `kube_stateful_set` |
| `kube_namespace` | **CONTAINS** | `kube_daemon_set` |
| `kube_namespace` | **CONTAINS** | `kube_job` |
| `kube_namespace` | **CONTAINS** | `kube_cron_job` |
| `kube_namespace` | **CONTAINS** | `kube_config_map` |
| `kube_namespace` | **CONTAINS** | `kube_secret` |
| `kube_node` | **HAS** | `kube_image` |
| `kube_node` | **RUNS** | `kube_pod` |
| `kube_pod` | **CONTAINS** | `kube_container` |
| `kube_pod` | **USES** | `kube_secret` |
| `kube_pod` | **USES** | `kube_container_spec` |
| `kube_pod` | **USES** | `kube_service_account` |
| `kube_pod` | **HAS** | `kube_certificate_signing_request` |
| `kube_replica_set` | **USES** | `kube_image` |
| `kube_replica_set` | **USES** | `kube_container_spec` |
| `kube_replica_set` | **MANAGES** | `kube_pod` |
| `kube_role` | **ENFORCES** | `kube_role_rule` |
| `kube_role` | **ASSIGNED** | `kube_cluster_role_binding` |
| `kube_role` | **ASSIGNED** | `kube_role_binding` |
| `kube_service_account` | **USES** | `kube_secret` |
| `kube_service_account` | **ASSIGNED** | `kube_role_binding` |
| `kube_stateful_set` | **MANAGES** | `kube_pod` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `kube_cluster` | **IS** | `azure_kubernetes_cluster` | FORWARD |
| `kube_cluster` | **IS** | `google_container_cluster` | FORWARD |

### Kube Service Account

`kube_service_account` inherits from [User](/data-model/schemas/User.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `deletionGracePeriodSeconds` | `integer` |  |  |
| `generation` | `integer` |  |  |
| `namespace` | `string` |  |  |
| `resourceVersion` | `string` |  |  |
| `secretIds` | `array` of `string`s |  |  |
| `secretNames` | `array` of `string`s |  |  |

---

### Kube User

`kube_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `certFile` | `string` |  |  |
| `keyFile` | `string` |  |  |

---

## Release Notes

-   **2026-03-31** — Added OS kernel version to Kubernetes node entities.
-   **2025-10-03** — Added relationships linking Kubernetes role bindings to their assigned cluster roles.
-   **2025-09-25** — Added relationships linking Kubernetes pods to their assigned service accounts.
-   **2025-08-06** — Added namespace property to all Kubernetes resource entities for easier namespace-scoped queries.
-   **2025-06-03** — Added security context properties to Kubernetes pods and container specs, including seccomp profile type and privilege escalation settings.
-   **2025-05-21** — Added Kubernetes role rule ingestion as individual rule entities linked to their parent roles and cluster roles, exposing role permission details.
-   **2025-05-12** — Added ingestion of Kubernetes Certificate Signing Requests as certificate entities, with relationships linking pods to their certificate requests.
-   **2025-04-15** — Added support for Kubernetes Custom Resource Definitions and custom resources as queryable entities.

---

Source: /integrations/directory/kubernetes-managed

# Kubernetes Managed

Visualize Kubernetes resources and monitor changes through queries and alerts.

## Installation

### Prerequisites

Before installing the Kubernetes Managed integration, you must have a Kubernetes collector running. For instructions on setting up the Kubernetes collector, see the [Kubernetes collector documentation](/integrations/development/collector/kubernetes.md).

### Configuration in JupiterOne

1.  Navigate to the **Integrations** tab in JupiterOne and select **Kubernetes Managed**.
    
2.  Click **New Instance** to begin configuring your integration and provide the following:
    
    -   The **Account Name** used to identify the Kubernetes account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
        
    -   **Description** to assist in identifying the integration instance, if desired.
        
    -   When prompted about **where should this run**, select the Kubernetes collector you created in the prerequisites.
        
    -   **Use Default Kubernetes Configuration** (optional): Enable when running the integration outside of a Kubernetes cluster, such as on a local machine. When disabled, the integration uses the cluster's built-in in-cluster authentication. Disabled by default.
        
3.  Click **Create** after all values are provided and your instance appears in the list of all your Kubernetes Managed instances.
    

### Helm

The Helm-based install is for users that would like their integrations managed via Kubernetes resources.

1.  **Ensure you have the repository set up and updated**

```shell
helm repo add jupiterone https://jupiterone.github.io/helm-charts
helm repo update
```

2.  **Find the name of your runner**. The integration needs to know the name of the runner.

```shell
kubectl get integrationrunner -n jupiterone
```

##### Output

```shell
NAME     STATE     DETAIL   REGISTRATION   AGE
runner   running            registered     162m
```

3.  **Configuration Options**

Values:

-   `collectorName` - (Default "runner"). This is the name of the Runner/Collector you installed as part of the Kubernetes Operator installation.
-   `includeNamespaces` - An array of namespace names to include. If specified, only these namespaces will be ingested.
-   `excludeNamespaces` - An array of namespace names to exclude from ingestion.
-   `loadKubernetesConfigFromDefault` - (Default false). Set to `true` when running the integration outside of a Kubernetes cluster (for example, on your local machine). When `false`, the integration uses the cluster's built-in in-cluster authentication.
-   `crdMappingConfig` - Path to a YAML file containing the CRD mapping configuration (see Advanced: Configuring Custom Resource Definitions section below).
-   `pollingInterval` - (Default ONE\_WEEK). Specifies how often the integration runs to collect data. Options:
    -   DISABLED
    -   THIRTY\_MINUTES
    -   ONE\_HOUR
    -   FOUR\_HOURS
    -   EIGHT\_HOURS
    -   TWELVE\_HOURS
    -   ONE\_DAY
    -   ONE\_WEEK
-   `pollingIntervalCron` - (Default disabled). If setting this field, set **pollingInterval** to DISABLED. This option has two fields: `hour` and `dayOfWeek`. Example:
    
    ```shell
    --set pollingInterval=DISABLED --set pollingIntervalCron.hour=2 --set pollingIntervalCron.dayOfWeek=0
    ```
    

For a complete list of configuration options, run:

```shell
helm show values jupiterone/kubernetes-managed
```

4.  **Install the Managed Kubernetes Helm chart** Add in your configuration options from above into this command:

```shell
helm install kubernetes jupiterone/kubernetes-managed -n jupiterone --set collectorName=<runnerName>
```

5.  **Verify Installation** Check that the integration was successfully installed and registered with JupiterOne:

```shell
kubectl get integrationinstance -n jupiterone
```

##### Output

```shell
NAME         READY   REASON    AGE
kubernetes   True    Success   176m
```

## Data Volume Configuration

By default, the integration ingests all namespaces in your cluster. Use the options below to limit which namespaces are included.

### Data Filtering Options

| Field | Description | Default |
| --- | --- | --- |
| **Include Specific Namespaces** | Restrict ingestion to the listed namespaces only. Separate names with commas. If left empty, all namespaces are ingested (unless exclusions are specified). | All namespaces |
| **Exclude Specific Namespaces** | Skip the listed namespaces during ingestion. Useful for omitting system namespaces such as `kube-system`. Separate names with commas. | None |

### RBAC

The Kubernetes collector installs with a ClusterRole that provides read-only access to Kubernetes resources. The collector has permissions to get, list, and watch the following:

**Core Resources:**

-   Pods, namespaces, service accounts, config maps, nodes, services, secrets, and events

**Application Workloads:**

-   Deployments, replica sets, stateful sets, daemon sets, jobs, and cron jobs

**Networking:**

-   Ingresses and network policies

**RBAC and Security:**

-   Cluster roles, cluster role bindings, roles, and role bindings
-   Self-subject access reviews and subject access reviews
-   Token reviews

**Extensions:**

-   All resources in the extensions API group

**Integration Management:**

-   Integration instance jobs, integration runners, and their status and finalizers (for managing integration workloads)

All permissions are read-only (get, list, watch) and do not allow modification of any cluster resources.

### Advanced: Configuring Custom Resource Definitions (CRDs)

By default, the Kubernetes Managed integration ingests standard Kubernetes resources. However, you can extend the integration to also collect and map Custom Resource Definitions (CRDs) that exist in your cluster. This is particularly useful for capturing custom resources created by operators, such as IntegrationRunners and IntegrationInstanceJobs from the JupiterOne Kubernetes Operator.

#### Overview

The CRD configuration allows you to:

-   **Define which custom resources to ingest**: Specify the CRD resources you want to collect from your cluster
-   **Map resource properties**: Transform CRD fields into JupiterOne entity properties
-   **Create relationships**: Define how custom resources relate to other entities in your JupiterOne graph

#### Configuration File Structure

The CRD configuration is defined in a YAML file with two main sections: `resources` and `relationships`. This configuration file can be provided when setting up your integration instance.

#### Resources Section

The `resources` section defines which custom resources to ingest and how to map their properties to JupiterOne entities.

Each resource entry contains:

-   **`name`** (required): The fully qualified name of the CRD resource type, following the format `<plural>.<group>`. For example, `integrationrunners.integrations.jupiterone.io` refers to the `IntegrationRunner` CRD in the `integrations.jupiterone.io` API group.
    
-   **`version`** (optional): The API version of the resource. For example, `v1` indicates the resource uses version 1 of the API. If not provided, all versions will be ingested.
    
-   **`_type`** (required): The entity type that will be assigned to ingested resources in JupiterOne. This is a custom identifier that you'll use to query and reference these entities. It should follow the pattern `kube_cr_<resource_name>` (e.g., `kube_cr_integration_runner`).
    
-   **`_class`** (required): The entity class that categorizes the resource in JupiterOne's data model. All supported entity classes can be found in the [JupiterOne Data Model documentation](/data-model/jupiterone-data-model.md#defined-entities).
    
-   **`propertyToFieldMap`** (required): A mapping that defines how fields from the Kubernetes resource are transformed into JupiterOne entity properties. This is where you specify which Kubernetes resource fields map to which JupiterOne properties.
    
    -   **`_key`** (required): Maps to the unique identifier for the entity in JupiterOne. It's recommended to use `metadata.uid` to ensure uniqueness.
    -   **Standard properties**: Common mappings include:
        -   `name`: Usually maps to `metadata.name`
        -   `namespace`: Usually maps to `metadata.namespace`
        -   `createdOn`: Usually maps to `metadata.creationTimestamp`
    -   **Custom properties**: You can map any field from the resource's `spec` or `status` sections to custom properties. For example, `accountId: spec.accountId` maps the `accountId` field from the resource's spec to a property called `accountId` on the JupiterOne entity.

#### Relationships Section

The `relationships` section defines how custom resources relate to other entities in your JupiterOne graph. This allows you to create meaningful connections between resources, such as showing which secrets an IntegrationRunner uses or which runner an IntegrationInstanceJob runs on.

Each relationship entry contains:

-   **`_class`** (required): The type of relationship. All supported relationship classes can be found in the [JupiterOne Data Model documentation](/data-model/jupiterone-data-model.md#relationships).
    
-   **`sourceType`** (required): The entity type of the source entity in the relationship. This should match the `_type` you defined in the resources section (e.g., `kube_cr_integration_runner`).
    
-   **`targetType`** (required): The entity type of the target entity in the relationship. This can be:
    
    -   Another custom resource type you've defined (e.g., `kube_cr_integration_instance_job`)
    -   A standard Kubernetes resource type (e.g., `kube_secret`, `kube_pod`, `kube_namespace`)
-   **`matchBy`** (required): Defines how to match the source and target entities to create the relationship. This is a key-value mapping where:
    
    -   The **key** is a property name on the source entity (e.g., `secretName`)
    -   The **value** is a property name on the target entity (e.g., `name`)
    
    The relationship is created when the source entity's property value matches the target entity's property value. You can specify multiple match conditions, and all must be satisfied (AND logic). For example:
    
    ```yaml
    matchBy:
      secretName: name
      namespace: namespace
    ```
    
    This creates a relationship when both the `secretName` on the source matches the `name` on the target, AND the `namespace` on the source matches the `namespace` on the target.
    
    > **NOTE**
    > 
    > If a property is not defined for either the source or the target, the relationship won't be created. Undefined doesn't match with undefined.
    

#### Example Configuration

Here's a complete example configuration that ingests IntegrationRunners and IntegrationInstanceJobs and creates relationships between them and their associated secrets:

```yaml
resources:
  - name: integrationrunners.integrations.jupiterone.io
    version: v1
    _type: kube_cr_integration_runner
    _class: Process
    propertyToFieldMap:
      _key: metadata.uid
      name: metadata.name
      namespace: metadata.namespace
      createdOn: metadata.creationTimestamp
      accountId: spec.accountId
      collectorId: spec.collectorId
      collectorPoolId: spec.collectorPoolId
      jupiterOneEnvironment: spec.jupiterOneEnvironment
      secretAPITokenName: spec.secretAPITokenName
      secretName: spec.secretName
      syncIntervalSeconds: spec.syncIntervalSeconds

  - name: integrationinstancejobs.integrations.jupiterone.io
    _type: kube_cr_integration_instance_job
    _class: Task
    propertyToFieldMap:
      _key: metadata.uid
      name: metadata.name
      namespace: metadata.namespace
      createdOn: metadata.creationTimestamp
      accountId: spec.accountId
      certificateIdentity: spec.certificateIdentity
      image: spec.image
      integrationDefinitionName: spec.integrationDefinitionName
      integrationInstanceId: spec.integrationInstanceId
      integrationInstanceJobId: spec.integrationInstanceJobId
      integrationRunnerName: spec.integrationRunnerName
      secretName: spec.secretName

relationships:
  - _class: HAS
    sourceType: kube_cr_integration_runner
    targetType: kube_secret
    matchBy:
      secretName: name
      namespace: namespace

  - _class: HAS
    sourceType: kube_cr_integration_instance_job
    targetType: kube_secret
    matchBy:
      secretName: name
      namespace: namespace

  - _class: HAS
    sourceType: kube_cr_integration_instance_job
    targetType: kube_cr_integration_runner
    matchBy:
      integrationRunnerName: name
      namespace: namespace
```

#### Understanding the Example

**Resources Explained:**

1.  **IntegrationRunner Resource**:
    
    -   Ingested as `kube_cr_integration_runner` entities with class `Process`
    -   Maps standard Kubernetes metadata (uid, name, namespace, creationTimestamp)
    -   Maps custom spec fields like `accountId`, `collectorId`, and `syncIntervalSeconds` to entity properties
    -   The `secretName` property is used later to create relationships with secrets
2.  **IntegrationInstanceJob Resource**:
    
    -   Ingested as `kube_cr_integration_instance_job` entities with class `Task`
    -   Similar metadata mapping
    -   Maps job-specific fields like `integrationInstanceId`, `image`, and `integrationRunnerName`
    -   The `integrationRunnerName` property links jobs to their runners

**Relationships Explained:**

1.  **IntegrationRunner → Secret**:
    
    -   Creates a `HAS` relationship from each IntegrationRunner to the secret it uses
    -   Matches when the runner's `secretName` equals the secret's `name` AND they're in the same `namespace`
2.  **IntegrationInstanceJob → Secret**:
    
    -   Creates a `HAS` relationship from each IntegrationInstanceJob to its associated secret
    -   Uses the same matching logic as above
3.  **IntegrationInstanceJob → IntegrationRunner**:
    
    -   Creates a `HAS` relationship showing which runner executes each job
    -   Matches when the job's `integrationRunnerName` equals the runner's `name` AND they're in the same `namespace`

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Kubernetes Certificate Signing Request | `kube_certificate_signing_request` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| Kubernetes Cluster | `kube_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Kubernetes Cluster Role | `kube_cluster_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Kubernetes Cluster Role Binding | `kube_cluster_role_binding` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Kubernetes ConfigMap | `kube_config_map` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Kubernetes Container | `kube_container` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| Kubernetes CronJob | `kube_cron_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Kubernetes DaemonSet | `kube_daemon_set` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Kubernetes Deployment | `kube_deployment` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Kubernetes Image | `kube_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Kubernetes Ingress | `kube_ingress` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Kubernetes Job | `kube_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Kubernetes Namespace | `kube_namespace` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Kubernetes Network Policy | `kube_network_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Kubernetes Node | `kube_node` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Kubernetes Pod | `kube_pod` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Kubernetes ReplicaSet | `kube_replica_set` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Kubernetes Role | `kube_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Kubernetes Role Binding | `kube_role_binding` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Kubernetes Role Rule | `kube_role_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Kubernetes Secret | `kube_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Kubernetes Service | `kube_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Kubernetes Service Account | `kube_service_account` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Kubernetes StatefulSet | `kube_stateful_set` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Kubernetes User | `kube_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Kubernetes Volume | `kube_volume` | [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `kube_cluster` | **CONTAINS** | `kube_node` |
| `kube_cluster` | **CONTAINS** | `kube_namespace` |
| `kube_cluster` | **CONTAINS** | `kube_cluster_role` |
| `kube_cluster` | **CONTAINS** | `kube_cluster_role_binding` |
| `kube_cluster` | **CONTAINS** | `kube_user` |
| `kube_cluster` | **CONTAINS** | `kube_certificate_signing_request` |
| `kube_cluster` | **CONTAINS** | `ANY_RESOURCE` |
| `kube_cluster_role` | **ASSIGNED** | `kube_role_binding` |
| `kube_cluster_role` | **ASSIGNED** | `kube_cluster_role_binding` |
| `kube_cluster_role_binding` | **ASSIGNED** | `kube_service_account` |
| `kube_container` | **USES** | `kube_secret` |
| `kube_container` | **USES** | `kube_config_map` |
| `kube_container` | **USES** | `kube_volume` |
| `kube_container` | **USES** | `kube_image` |
| `kube_cron_job` | **MANAGES** | `kube_job` |
| `kube_daemon_set` | **MANAGES** | `kube_pod` |
| `kube_deployment` | **MANAGES** | `kube_replica_set` |
| `kube_ingress` | **CONNECTS** | `kube_service` |
| `kube_job` | **CONTAINS** | `kube_namespace` |
| `kube_job` | **MANAGES** | `kube_pod` |
| `kube_namespace` | **CONTAINS** | `kube_role` |
| `kube_namespace` | **CONTAINS** | `kube_role_binding` |
| `kube_namespace` | **CONTAINS** | `kube_cron_job` |
| `kube_namespace` | **CONTAINS** | `kube_pod` |
| `kube_namespace` | **CONTAINS** | `kube_daemon_set` |
| `kube_namespace` | **CONTAINS** | `kube_config_map` |
| `kube_namespace` | **CONTAINS** | `kube_secret` |
| `kube_namespace` | **CONTAINS** | `kube_deployment` |
| `kube_namespace` | **CONTAINS** | `kube_replica_set` |
| `kube_namespace` | **CONTAINS** | `kube_network_policy` |
| `kube_namespace` | **CONTAINS** | `kube_ingress` |
| `kube_namespace` | **CONTAINS** | `kube_service` |
| `kube_namespace` | **CONTAINS** | `ANY_RESOURCE` |
| `kube_node` | **CONTAINS** | `kube_pod` |
| `kube_pod` | **USES** | `kube_service_account` |
| `kube_pod` | **USES** | `kube_secret` |
| `kube_pod` | **CONTAINS** | `kube_container` |
| `kube_pod` | **USES** | `kube_volume` |
| `kube_pod` | **HAS** | `kube_certificate_signing_request` |
| `kube_replica_set` | **MANAGES** | `kube_pod` |
| `kube_role` | **ENFORCES** | `kube_role_rule` |
| `kube_role` | **ASSIGNED** | `kube_role_binding` |
| `kube_role_binding` | **ASSIGNED** | `kube_service_account` |
| `kube_service` | **CONNECTS** | `kube_pod` |
| `kube_service_account` | **CONTAINS** | `kube_namespace` |
| `kube_stateful_set` | **CONTAINS** | `kube_namespace` |
| `kube_stateful_set` | **MANAGES** | `kube_pod` |
| `kube_volume` | **USES** | `kube_config_map` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `kube_cluster` | **IS** | `azure_kubernetes_cluster` | FORWARD |
| `kube_cluster` | **IS** | `google_container_cluster` | FORWARD |
| `kube_cluster` | **IS** | `aws_eks_cluster` | FORWARD |

### Kube Certificate Signing Request

`kube_certificate_signing_request` inherits from [Certificate](/data-model/schemas/Certificate.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `groups` | `array` of `string`s |  |  |
| `signerName` | `string` |  |  |
| `status.lastUpdatedOn` | `number` |  |  |
| `status.message` | `string` |  |  |
| `status.reason` | `string` |  |  |
| `status.type` | `string` |  |  |
| `subject.commonName` | `string` |  |  |
| `subject.dnsSAN` | `array` of `string`s |  |  |
| `subject.organization` | `string` |  |  |
| 
`uid` \*

 | `string` |  |  |
| `usages` | `array` of `string`s |  |  |
| `userId` | `string` |  |  |
| `username` | `string` |  |  |

---

### Kube Cluster

`kube_cluster` inherits from [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`server` \*

 | `string` |  |  |
| 

`skipTlsVerify` \*

 | `boolean` |  |  |

---

### Kube Cluster Role

`kube_cluster_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiVersion` | `string` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `kind` | `string` |  |  |
| `namespace` | `string` |  |  |
| `resourceVersion` | `string` |  |  |

---

### Kube Cluster Role Binding

`kube_cluster_role_binding` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiVersion` | `string` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `kind` | `string` |  |  |
| `namespace` | `string` |  |  |
| `resourceVersion` | `string` |  |  |

---

### Kube Config Map

`kube_config_map` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiVersion` | `string` |  |  |
| `binaryDataKeys` | `array` of `string`s |  |  |
| `dataKeys` | `array` of `string`s |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `immutable` | `boolean` |  |  |
| `kind` | `string` |  |  |
| `namespace` | `string` |  |  |
| `resourceVersion` | `string` |  |  |

---

### Kube Container

`kube_container` inherits from [Container](/data-model/schemas/Container.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowPrivilegeEscalation` | `boolean` |  |  |
| `appArmorProfile.localhostProfile` | `string` |  |  |
| `appArmorProfile.type` | `string` |  |  |
| `args` | `array` of `string`s |  |  |
| `command` | `array` of `string`s |  |  |
| `containerId` | `string` |  |  |
| `cpuLimit` | `string` |  |  |
| `cpuRequest` | `string` |  |  |
| `finishedAt` | `number` |  |  |
| `hasStarted` | `boolean` |  |  |
| `image` | `string` |  |  |
| `imagePullPolicy` | `string` |  |  |
| `isReady` | `boolean` |  |  |
| `isUsingEnvironmentVariableSecrets` | `boolean` |  |  |
| `memoryLimit` | `string` |  |  |
| `memoryRequest` | `string` |  |  |
| `namespace` | `string` |  |  |
| `normalizedCpuLimit` | `number` |  |  |
| `normalizedCpuRequest` | `number` |  |  |
| `normalizedMemoryLimit` | `number` |  |  |
| `normalizedMemoryRequest` | `number` |  |  |
| `podUid` | `string` |  |  |
| `privileged` | `boolean` |  |  |
| `procMount` | `string` |  |  |
| `readOnlyRoolFilesystem` | `boolean` |  |  |
| `restartCount` | `number` |  |  |
| `runAsGroup` | `number` |  |  |
| `runAsNonRoot` | `boolean` |  |  |
| `runAsUser` | `number` |  |  |
| `running` | `boolean` |  |  |
| `seccompProfile.localhostProfile` | `string` |  |  |
| `seccompProfile.type` | `string` |  |  |
| `seLinuxOptions.level` | `string` |  |  |
| `seLinuxOptions.role` | `string` |  |  |
| `seLinuxOptions.type` | `string` |  |  |
| `seLinuxOptions.user` | `string` |  |  |
| `startedAt` | `number` |  |  |
| `terminated` | `boolean` |  |  |
| `terminatedExitCode` | `number` |  |  |
| `terminationMessagePath` | `string` |  |  |
| `terminationMessagePolicy` | `string` |  |  |
| `type` | `string` |  |  |
| `waiting` | `boolean` |  |  |
| `waitingMessage` | `string` |  |  |
| `waitingReason` | `string` |  |  |
| `windowsOptions.gmsaCredentialSpec` | `string` |  |  |
| `windowsOptions.gmsaCredentialSpecName` | `string` |  |  |
| `windowsOptions.hostProcess` | `boolean` |  |  |
| `windowsOptions.runAsUserName` | `string` |  |  |

---

### Kube Cron Job

`kube_cron_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiVersion` | `string` |  |  |
| `concurrencyPolicy` | `string` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `failedJobsHistoryLimit` | `number` |  |  |
| `kind` | `string` |  |  |
| `lastScheduledOn` | `number` |  |  |
| `lastSuccessfulOn` | `number` |  |  |
| `namespace` | `string` |  |  |
| `resourceVersion` | `string` |  |  |
| `schedule` | `string` |  |  |
| `startingDeadlineSeconds` | `number` |  |  |
| `successfulJobsHistoryLimit` | `number` |  |  |
| `suspend` | `boolean` |  |  |
| `timeZone` | `string` |  |  |

---

### Kube Daemon Set

`kube_daemon_set` inherits from [Deployment](/data-model/schemas/Deployment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiVersion` | `string` |  |  |
| `collisionCount` | `number` |  |  |
| `currentNumberScheduled` | `number` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `desiredNumberScheduled` | `number` |  |  |
| `kind` | `string` |  |  |
| `minReadySeconds` | `number` |  |  |
| `namespace` | `string` |  |  |
| `numberAvailable` | `number` |  |  |
| `numberMisscheduled` | `number` |  |  |
| `numberReady` | `number` |  |  |
| `numberUnavailable` | `number` |  |  |
| `observedGeneration` | `number` |  |  |
| `resourceVersion` | `string` |  |  |
| `revisionHistoryLimit` | `number` |  |  |
| `updatedNumberScheduled` | `number` |  |  |
| `updateStrategyType` | `string` |  |  |

---

### Kube Deployment

`kube_deployment` inherits from [Deployment](/data-model/schemas/Deployment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiVersion` | `string` |  |  |
| `availableReplicas` | `number` |  |  |
| `collisionCount` | `number` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `kind` | `string` |  |  |
| `minReadySeconds` | `number` |  |  |
| `namespace` | `string` |  |  |
| `observedGeneration` | `number` |  |  |
| `paused` | `boolean` |  |  |
| `progressDeadlineSeconds` | `number` |  |  |
| `readyReplicas` | `number` |  |  |
| `replicas` | `number` |  |  |
| `resourceVersion` | `string` |  |  |
| `revisionHistoryLimit` | `number` |  |  |
| `statusReplicas` | `number` |  |  |
| `strategyType` | `string` |  |  |
| `unavailableReplicas` | `number` |  |  |
| `updatedReplicas` | `number` |  |  |

---

### Kube Image

`kube_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `digest` | `string` |  |  |
| `imageId` | `string` |  |  |

---

### Kube Ingress

`kube_ingress` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` of `string`s |  |  |
| `deletionOn` | `number` |  |  |
| `finalizers` | `array` of `string`s |  |  |
| 

`function` \*

 | `array` of `string`s |  |  |
| `generation` | `number` |  |  |
| `hasDefaultBackend` | `boolean` |  |  |
| `hosts` | `array` of `string`s |  |  |
| `ingressClassName` | `string` |  |  |
| `namespace` | `string` |  |  |
| `paths` | `array` of `string`s |  |  |
| 

`public` \*

 | `boolean` |  |  |
| `resourceVersion` | `string` |  |  |
| `status.loadBalancer.ingress` | `array` of `string`s |  |  |
| `tlsEnabled` | `boolean` |  |  |
| `tlsHosts` | `array` of `string`s |  |  |
| `tlsSecretNames` | `array` of `string`s |  |  |

---

### Kube Job

`kube_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activeDeadlineSeconds` | `number` |  |  |
| `backoffLimit` | `number` |  |  |
| `completions` | `number` |  |  |
| `createdOn` | `number` |  |  |
| `deletedOn` | `number` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `generation` | `number` |  |  |
| `manualSelector` | `boolean` |  |  |
| `namespace` | `string` |  |  |
| `parallelism` | `number` |  |  |
| `resourceVersion` | `string` |  |  |
| `status.active` | `number` |  |  |
| `status.completionTime` | `number` |  |  |
| `status.failed` | `number` |  |  |
| `status.startTime` | `number` |  |  |
| `status.succeeded` | `number` |  |  |
| `ttlSecondsAfterFinished` | `number` |  |  |

---

### Kube Namespace

`kube_namespace` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdOn` | `number` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `finalizers` | `array` of `string`s |  |  |
| `generation` | `number` |  |  |
| `ownerNames` | `array` of `string`s |  |  |
| `resourceVersion` | `string` |  |  |
| `status.phase` | `string` |  |  |

---

### Kube Network Policy

`kube_network_policy` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiVersion` | `string` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `kind` | `string` |  |  |
| `namespace` | `string` |  |  |
| `podSelectorMatchExpressions` | `string` |  |  |
| `policyTypes` | `array` of `string`s |  |  |
| `resourceVersion` | `string` |  |  |

---

### Kube Node

`kube_node` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `architecture` | `string` |  |  |
| `capacity.cpu` | `string` |  |  |
| `capacity.memory` | `string` |  |  |
| `capacity.pods` | `string` |  |  |
| `containerRuntimeVersion` | `string` |  |  |
| `kernelVersion` | `string` |  |  |
| `kubeletVersion` | `string` |  |  |
| `operatingSystem` | `string` |  |  |
| `osImage` | `string` |  |  |
| `osKernel` | `string` |  |  |
| `providerID` | `string` |  |  |
| 
`unschedulable` \*

 | `boolean` |  |  |

---

### Kube Pod

`kube_pod` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activeDeadlineSeconds` | `number` |  |  |
| `automountServiceAccountToken` | `boolean` |  |  |
| `cpuLimit` | `string` |  |  |
| `cpuRequest` | `string` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `dnsPolicy` | `string` |  |  |
| `enableServiceLinks` | `boolean` |  |  |
| `finalizers` | `array` of `string`s |  |  |
| `generation` | `number` |  |  |
| `hasSecurityContext` | `boolean` |  |  |
| `hostIPC` | `boolean` |  |  |
| `hostname` | `string` |  |  |
| `hostNetwork` | `boolean` |  |  |
| `hostPID` | `boolean` |  |  |
| `imagePullSecrets` | `array` of `string`s |  |  |
| `memoryLimit` | `string` |  |  |
| `memoryRequest` | `string` |  |  |
| `namespace` | `string` |  |  |
| `nodeName` | `string` |  |  |
| `normalizedCpuLimit` | `number` |  |  |
| `normalizedCpuRequest` | `number` |  |  |
| `normalizedMemoryLimit` | `number` |  |  |
| `normalizedMemoryRequest` | `number` |  |  |
| `podAnnotations` | `array` of `string`s |  |  |
| `preemptionPolicy` | `string` |  |  |
| `priority` | `number` |  |  |
| `priorityClassName` | `string` |  |  |
| `resourceVersion` | `string` |  |  |
| `restartPolicy` | `string` |  |  |
| `runtimeClassName` | `string` |  |  |
| `schedulerName` | `string` |  |  |
| `securityContext.apparmorProfile.localhostProfile` | `string` |  |  |
| `securityContext.apparmorProfile.type` | `string` |  |  |
| `securityContext.fsGroup` | `number` |  |  |
| `securityContext.fsGroupChangePolicy` | `string` |  |  |
| `securityContext.runAsGroup` | `number` |  |  |
| `securityContext.runAsNonRoot` | `boolean` |  |  |
| `securityContext.runAsUser` | `number` |  |  |
| `securityContext.seccompProfile.localhostProfile` | `string` |  |  |
| `securityContext.seccompProfile.type` | `string` |  |  |
| `securityContext.seLinuxChangePolicy` | `string` |  |  |
| `securityContext.seLinuxOptions.level` | `string` |  |  |
| `securityContext.seLinuxOptions.role` | `string` |  |  |
| `securityContext.seLinuxOptions.type` | `string` |  |  |
| `securityContext.seLinuxOptions.user` | `string` |  |  |
| `securityContext.supplementalGroups` | `array` of `number`s |  |  |
| `securityContext.supplementalGroupsPolicy` | `string` |  |  |
| `securityContext.sysctls` | `array` of `string`s |  |  |
| `securityContext.windowsOptions.gmsaCredentialSpec` | `string` |  |  |
| `securityContext.windowsOptions.gmsaCredentialSpecName` | `string` |  |  |
| `securityContext.windowsOptions.hostProcess` | `boolean` |  |  |
| `securityContext.windowsOptions.runAsUserName` | `string` |  |  |
| `serviceAccount` | `string` |  |  |
| `serviceAccountName` | `string` |  |  |
| `setHostnameAsFQDN` | `boolean` |  |  |
| `shareProcessNamespace` | `boolean` |  |  |
| `status.hostIP` | `string` |  |  |
| `status.hostIPs` | `array` of `string`s |  |  |
| `status.message` | `string` |  |  |
| `status.nominatedNodeName` | `string` |  |  |
| `status.phase` | `string` |  |  |
| `status.podIP` | `string` |  |  |
| `status.podIPs` | `array` of `string`s |  |  |
| `status.qosClass` | `string` |  |  |
| `status.reason` | `string` |  |  |
| `status.startTime` | `number` |  |  |
| `subdomain` | `string` |  |  |
| `terminationGracePeriodSeconds` | `number` |  |  |

---

### Kube Replica Set

`kube_replica_set` inherits from [Deployment](/data-model/schemas/Deployment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `annotations` | `array` of `string`s |  |  |
| `apiVersion` | `string` |  |  |
| `currentSize` | `number` |  |  |
| `desiredSize` | `number` |  |  |
| `generation` | `number` |  |  |
| `kind` | `string` |  |  |
| `labels` | `array` of `string`s |  |  |
| `minReadySeconds` | `number` |  |  |
| `namespace` | `string` |  |  |
| `ownerReferences` | `array` of `string`s |  |  |
| `resourceVersion` | `string` |  |  |
| `selector` | `string` |  |  |
| `status.availableReplicas` | `number` |  |  |
| `status.fullyLabeledReplicas` | `number` |  |  |
| `status.observedGeneration` | `number` |  |  |
| `status.readyReplicas` | `number` |  |  |

---

### Kube Role

`kube_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiVersion` | `string` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `kind` | `string` |  |  |
| 
`namespace` \*

 | `string` |  |  |
| `resourceVersion` | `string` |  |  |

---

### Kube Role Binding

`kube_role_binding` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admin` | `boolean` |  |  |
| `apiVersion` | `string` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `kind` | `string` |  |  |
| 
`namespace` \*

 | `string` |  |  |
| `resourceVersion` | `string` |  |  |
| `roleRefApiGroup` | `string` |  |  |
| `roleRefKind` | `string` |  |  |
| `roleRefName` | `string` |  |  |
| `subjectCount` | `number` |  |  |
| `subjects` | `array` of `string`s |  |  |

---

### Kube Role Rule

`kube_role_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiGroups` | `array` of `string`s |  |  |
| `namespace` | `string` |  |  |
| `resourceNames` | `array` of `string`s |  |  |
| `resources` | `array` of `string`s |  |  |
| 
`verbs` \*

 | `array` of `string`s |  |  |

---

### Kube Secret

`kube_secret` inherits from [Secret](/data-model/schemas/Secret.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiVersion` | `string` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `immutable` | `boolean` |  |  |
| `kind` | `string` |  |  |
| `namespace` | `string` |  |  |
| `resourceVersion` | `string` |  |  |
| `type` | `string` |  |  |

---

### Kube Service

`kube_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allocateLoadBalancerNodePorts` | `boolean` |  |  |
| 
`category` \*

 | `array` of `string`s |  |  |
| `clusterIP` | `string` |  |  |
| `clusterIPs` | `array` of `string`s |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `endpoints` | `array` of `string`s |  |  |
| `externalIPs` | `array` of `string`s |  |  |
| `externalName` | `string` |  |  |
| `externalTrafficPolicy` | `string` |  |  |
| 

`function` \*

 | `array` of `string`s |  |  |
| `healthCheckNodePort` | `number` |  |  |
| `ipFamilies` | `array` of `string`s |  |  |
| `ipFamilyPolicy` | `string` |  |  |
| `loadBalancerIP` | `string` |  |  |
| `loadBalancerSourceRanges` | `array` of `string`s |  |  |
| `namespace` | `string` |  |  |
| `portName` | `array` of `string`s |  |  |
| `portNumber` | `array` of `number`s |  |  |
| `protocol` | `array` of `string`s |  |  |
| `publishNotReadyAddresses` | `boolean` |  |  |
| `resourceVersion` | `string` |  |  |
| `selectors` | `array` of `string`s |  |  |
| `sessionAffinity` | `string` |  |  |
| `targetPort` | `array` of `string`s |  |  |
| `type` | `string` |  |  |

---

### Kube Service Account

`kube_service_account` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `deletionGracePeriodSeconds` | `integer` |  |  |
| `generation` | `integer` |  |  |
| `namespace` | `string` |  |  |
| `resourceVersion` | `string` |  |  |
| `secretIds` | `array` of `string`s |  |  |
| `secretNames` | `array` of `string`s |  |  |

---

### Kube Stateful Set

`kube_stateful_set` inherits from [Deployment](/data-model/schemas/Deployment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `generation` | `number` |  |  |
| `namespace` | `string` |  |  |
| `podManagementPolicy` | `string` |  |  |
| `replicas` | `number` |  |  |
| `resourceVersion` | `string` |  |  |
| `revisionHistoryLimit` | `number` |  |  |
| `serviceName` | `string` |  |  |
| `status.collisionCount` | `number` |  |  |
| `status.currentReplicas` | `number` |  |  |
| `status.currentRevision` | `string` |  |  |
| `status.observedGeneration` | `number` |  |  |
| `status.readyReplicas` | `number` |  |  |
| `status.replicas` | `number` |  |  |
| `status.updatedReplicas` | `number` |  |  |
| `status.updateRevision` | `string` |  |  |
| `strategy.partition` | `number` |  |  |
| `strategy.type` | `string` |  |  |

---

### Kube User

`kube_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `certFile` | `string` |  |  |
| `keyFile` | `string` |  |  |

---

### Kube Volume

`kube_volume` inherits from [Disk](/data-model/schemas/Disk.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `awsVolumeID` | `string` |  |  |
| `azureDiskName` | `string` |  |  |
| `azureDiskURI` | `string` |  |  |
| `claimName` | `string` |  |  |
| `configMapName` | `string` |  |  |
| `csiDriver` | `string` |  |  |
| `csiFsType` | `string` |  |  |
| `csiReadOnly` | `boolean` |  |  |
| `emptyDirMedium` | `string` |  |  |
| `emptyDirSizeLimit` | `string` |  |  |
| `gcePdName` | `string` |  |  |
| `hostPath` | `string` |  |  |
| `hostPathType` | `string` |  |  |
| `namespace` | `string` |  |  |
| `nfsPath` | `string` |  |  |
| `nfsServer` | `string` |  |  |
| `readOnly` | `boolean` |  |  |
| `secretName` | `string` |  |  |
| 
`volumeName` \*

 | `string` |  |  |
| 

`volumeType` \*

 | `string` |  |  |

---

## Release Notes

-   **2026-03-31** — Added OS kernel version to managed Kubernetes node entities.
-   **2025-12-01** — Added support for Custom Resource Definitions (CRDs), enabling ingestion of custom Kubernetes resource types.
-   **2025-11-20** — Added mapped relationships linking Kubernetes clusters to their underlying cloud provider resources in Azure AKS, Google GKE, and AWS EKS.
-   **2025-11-20** — Added Kubernetes role rules ingestion as individual rule entities, each linked to their parent role.
-   **2025-11-20** — Added relationships linking Kubernetes pods to their assigned service accounts and nodes, containers to their referenced secrets, config maps, and volumes, and deployments to their replica sets.
-   **2025-11-19** — Added ingestion of Kubernetes Services with namespace and selector relationships.
-   **2025-11-19** — Added ingestion of Kubernetes Secrets (metadata only, data fields are not ingested).
-   **2025-11-12** — Added ingestion of Kubernetes Role Bindings and Cluster Role Bindings with subject relationships.
-   **2025-11-11** — Added Kubernetes container image ingestion with configuration options for image scanning.
-   **2025-11-10** — Added ingestion of Kubernetes Replica Sets with pod template relationships.
-   **2025-11-10** — Added ingestion of Kubernetes StatefulSets as new entity types.
-   **2025-11-07** — Added ingestion of container images, Jobs, and Service Accounts.
-   **2025-11-07** — Added ingestion of Kubernetes Volumes with pod relationships.
-   **2025-11-07** — Added ingestion of Kubernetes Ingress resources as new entity types.
-   **2025-11-06** — Added ingestion of Kubernetes Roles as new entity types.
-   **2025-11-06** — Added ingestion of Kubernetes Containers within pods as new entity types.
-   **2025-11-06** — Added ingestion of Kubernetes Network Policies as new entity types.
-   **2025-11-05** — Added ingestion of Kubernetes Users with RBAC relationships.
-   **2025-11-05** — Added ingestion of Kubernetes Deployments with replica set relationships.
-   **2025-11-05** — Added ingestion of Kubernetes Nodes as new entity types.
-   **2025-11-05** — Added ingestion of Kubernetes Cluster Role Bindings.
-   **2025-11-04** — Added ingestion of Kubernetes ConfigMaps as new entity types.
-   **2025-11-04** — Added ingestion of Kubernetes Daemon Sets as new entity types.
-   **2025-11-03** — Added ingestion of Kubernetes Pods with container relationships.
-   **2025-10-31** — Added ingestion of Kubernetes CronJobs as new entity types.
-   **2025-10-31** — Added ingestion of Kubernetes Namespaces as new entity types.
-   **2025-10-30** — Added Kubernetes Cluster Roles ingestion.
-   **2025-10-29** — Added Kubernetes Cluster ingestion as the foundation entity for all Kubernetes-managed resources.

---

Source: /integrations/directory/lacework

# Lacework

Visualize Lacework services, teams, and users in the JupiterOne graph. Map Lacework users to employees in your JupiterOne account. Monitor changes to Lacework users using JupiterOne alerts.

## Installation

> **INFO**
> 
> You will need to create an API key on Lacework and get the "key ID" and "generated secret". See [their documentation](https://docs.lacework.net/console/api-access-keys#api-keys) for more information.

To install the Lacework integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Lacework. Click **New Instance** to begin configuring the integration.

Creating a Lacework instance requires the following:

-   The **Account Name** used to identify the Lacework account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Lacework Organization URL, Secret Key, Access Key Id.
    

## Data Volume Configuration

Control how much data is ingested from Lacework to manage entity counts and job duration.

### Data Filtering Options

| Field | Type | Description | Default |
| --- | --- | --- | --- |
| **Included Host Vulnerability Severities** | Multi-select | Select host vulnerability severities to ingest | Critical, High, Medium |
| **Included Container Vulnerability Severities** | Multi-select | Select container vulnerability severities to ingest | Critical, High, Medium |

**Available severity options:**

-   Critical
-   High
-   Medium
-   Low
-   Info (host vulnerabilities only)

**How it affects data volume:** Filtering by severity reduces the number of vulnerability entities ingested. By default, only Critical, High, and Medium severity vulnerabilities are imported for both hosts and containers. Enabling Low and Info severities will significantly increase data volume.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Alert Finding | `lacework_alert_finding` | [Alert](https://docs.jupiterone.io/data-model/schemas/Alert) |
| Application | `lacework_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Assessment | `lacework_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Cloud Account | `lacework_cloud_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Container | `lacework_container` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| Container Finding | `lacework_container_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Machine | `lacework_machine` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Organization | `lacework_organization` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Package | `lacework_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Service | `lacework_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Team User | `lacework_team_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vulnerability | `lacework_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `lacework_application` | **HAS** | `lacework_alert_finding` |
| `lacework_assessment` | **IDENTIFIED** | `lacework_finding` |
| `lacework_container` | **HAS** | `lacework_container_finding` |
| `lacework_machine` | **HAS** | `lacework_alert_finding` |
| `lacework_machine` | **HAS** | `lacework_application` |
| `lacework_machine` | **HAS** | `lacework_package` |
| `lacework_machine` | **HAS** | `lacework_finding` |
| `lacework_machine` | **HAS** | `lacework_container` |
| `lacework_organization` | **HAS** | `lacework_cloud_account` |
| `lacework_organization` | **HAS** | `lacework_service` |
| `lacework_organization` | **HAS** | `lacework_team_user` |
| `lacework_organization` | **HAS** | `lacework_machine` |
| `lacework_service` | **PERFORMED** | `lacework_assessment` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `lacework_finding` | **HAS** | `aws_instance` | REVERSE |
| `lacework_finding` | **IS** | `cve` | FORWARD |

---

Source: /integrations/directory/lansweeper

# Lansweeper

Visualize Lansweeper computers, users, groups, and software in the JupiterOne graph. Our guide provides step-by-step instructions on setting up the integration and utilizing its data model to gain visibility into your environment.

## Installation

### Configuration in JupiterOne

To install the Lansweeper integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Lansweeper. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Lansweeper account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to finalize the integration. You will then be prompted to authenticate JupiterOne with Lansweeper. Complete the authentication process to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Host | `lansweeper_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Site | `lansweeper_site` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| User | `lansweeper_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `lansweeper_site` | **CONTAINS** | `lansweeper_host` |
| `lansweeper_user` | **USES** | `lansweeper_host` |

### Lansweeper Host

`lansweeper_host` inherits from [Host](/data-model/schemas/Host.md)

---

### Lansweeper Site

`lansweeper_site` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetTypes` \*

 | `array` of `string`s |  |  |

---

### Lansweeper User

`lansweeper_user` inherits from [User](/data-model/schemas/User.md)

---

---

Source: /integrations/directory/lastpass

# LastPass

Visualize LastPass users, map Lastpass users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> Before configuring this integration in JupiterOne, you need to obtain API credentials from LastPass:
> 
> **Required in LastPass:**
> 
> -   Admin access to your LastPass Enterprise account
> -   Company ID (also called Account Number)
> -   Provisioning Hash generated through the Enterprise API
> 
> **Authentication:** This integration uses the LastPass Enterprise API with Company ID and Provisioning Hash for authentication.
> 
> **Permissions:** The Provisioning Hash grants access to user data and account information. Keep this value secure as it provides access to sensitive account data.
> 
> To obtain these credentials, log in to your LastPass admin console at `admin.lastpass.com` and navigate to **Advanced > Enterprise API**.

To use this integration, JupiterOne requires a LastPass Company ID and Provisioning Hash, created by a LastPass admin user.

### Configuration in LastPass

1.  Locate your **Company ID**:

-   Log in to `admin.lastpass.com` and go to the **Dashboard** tab. The **Company ID** (sometimes labeled Account number) is displayed at the top of the page.

2.  Generate a Provisioning Hash.

-   Go to **Advanced > Enterprise API** and create a provisioning hash. This value grants access to your data so it is important to keep it safe.

### Configuration in JupiterOne

To install the LastPass integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select LastPass. Click **New Instance** to begin configuring your integration and provide the following:

-   The **Account Name** used to identify the LastPass account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Enter the **Company ID** and **Provisioning Hash** acquired in LastPass.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `lastpass_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Lastpass User | `lastpass_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `lastpass_account` | **HAS** | `lastpass_user` |

### Lastpass User

`lastpass_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `admin` | `boolean` |  |  |
| `applicationCount` | `number` |  |  |
| `attachmentsCount` | `number` |  |  |
| `createdOn` | `number` |  |  |
| `duoUsername` | `string` |  |  |
| `formFillsCount` | `number` |  |  |
| `isActive` | `boolean` |  |  |
| `lastLogin` | `number` |  |  |
| `linkedAccount` | `string` |  |  |
| `masterPasswordStrength` | `number` |  |  |
| `mfaEnabled` | `boolean` |  |  |
| `mfaType` | `string` |  |  |
| `neverLoggedIn` | `boolean` |  |  |
| `notesCount` | `number` |  |  |
| `passwordChangedOn` | `number` |  |  |
| `passwordResetRequired` | `boolean` |  |  |
| `securityScore` | `number` |  |  |
| `sitesCount` | `number` |  |  |
| `webLink` | `string` |  |  |

---

---

Source: /integrations/directory/linear

# Linear

Visualize your Linear organization, projects, teams, and users in the JupiterOne graph and monitor changes to Linear entities by leveraging JupiterOne alerts.

## Installation

To use this integration, JupiterOne requires an API key created by a user that has permissions to generate a new API key.

### Configuration in Linear

1.  Generate an API key via the [settings page](https://linear.app/settings/api).
2.  Copy the API key and save it for use within JupiterOne.

### Configuration in JupiterOne

1.  From the top-bar menu, select **Integrations**.
    
2.  Scroll to, or search for, the **Linear** integration tile and click it.
    
3.  Click the **New Instance** button and configure the settings:
    
    -   Enter the **API Key** generated in Linear in the **Access Token** field.
    -   Enter the **Account Name** by which you'd like to identify this Linear account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
4.  Click the **Create** button to complete the integration.
    

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data about your Linear environment within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Issue | `linear_issue` | [Record](https://docs.jupiterone.io/data-model/schemas/Record), [Issue](https://docs.jupiterone.io/data-model/schemas/Issue) |
| Organization | `linear_organization` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Project | `linear_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Team | `linear_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team), [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| User | `linear_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `linear_issue` | **ASSIGNED** | `linear_user` |
| `linear_issue` | **CONTAINS** | `linear_issue` |
| `linear_organization` | **HAS** | `linear_team` |
| `linear_project` | **HAS** | `linear_user` |
| `linear_project` | **HAS** | `linear_issue` |
| `linear_team` | **HAS** | `linear_project` |
| `linear_team` | **HAS** | `linear_user` |
| `linear_team` | **HAS** | `linear_issue` |
| `linear_user` | **CREATED** | `linear_issue` |

### Linear User

`linear_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admin` | `boolean` |  |  |
| `guest` | `boolean` |  |  |
| `lastSeen` | `integer` |  |  |
| `organization` | `string` |  |  |
| `picture` | `string` |  |  |

---

---

Source: /integrations/directory/linkedin-learning

# LinkedIn Learning

Visualize LinkedIn Learning courses, learning paths, videos, content taxonomy, learners, and per-learner engagement (completions, views, progress) in the JupiterOne graph. Track training completion as compliance evidence, identify gaps in skill coverage, and map learners to the content they engage with through queries and alerts.

## Installation

> **INFO**
> 
> LinkedIn Learning credentials are scoped to two **key types** — `Content` (`learningAssets` + `learningClassifications`) and `Report` (`learningActivityReports`). The integration accepts up to two credential pairs, one per scope, but **only one pair is required**. See the [Authorization](/integrations/directory/linkedin-learning.md?integration-docs=authorization) tab for the full breakdown of how credential combinations behave.

### Prerequisites

-   A **LinkedIn Learning Enterprise** account.
-   An administrator with permission to **Generate LinkedIn Learning REST API Applications** from the LinkedIn Learning admin console.
-   Access to **JupiterOne** with permission to configure integrations.

### Generate API credentials in LinkedIn Learning

LinkedIn provisions credentials at the **application** level. You can either create one application with both key types selected (recommended for new installs) or create two separate applications, one per scope.

1.  Sign in to LinkedIn Learning as an administrator. If you are not already in the Admin area, click **Go to Admin**.
    
2.  In the side navigation, open **Access content and reports via API** and expand **Generate LinkedIn Learning REST API Application**.
    
3.  Click **Add application**.
    
4.  Enter an **Application Name** (e.g. _JupiterOne Integration_) and an **Application description** (e.g. _Reads LinkedIn Learning content and activity into JupiterOne for compliance reporting_).
    
5.  Under **Choose keys**, select **Content**, **Report**, or both depending on which data surface you want to ingest:
    
    -   **Content** authorizes the asset catalog: courses, learning paths, videos, and the content taxonomy.
    -   **Report** authorizes per-learner engagement: completions, views, progress, and seconds-viewed.
6.  Click **Next** and accept the **Terms and Conditions**.
    
7.  Copy the generated **Client ID** and **Client Secret** — save them securely. You will paste these values into JupiterOne in the next section.
    
    > **TIP**
    > 
    > If you create one application with **both** Content and Report keys selected, you only have to copy a single pair. The same `Client ID` / `Client Secret` authorizes every endpoint and you only need to fill one of the two pairs in JupiterOne.
    
8.  (Optional) Repeat the steps above if your organization requires separate applications for the two scopes (e.g. because Content and Report access are owned by different teams). You will end up with two distinct credential pairs, one per scope.
    

### Configure the integration in JupiterOne

To install the LinkedIn Learning integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **LinkedIn Learning**. Click **New Instance** to begin configuring your integration.

Creating a LinkedIn Learning instance requires the following:

-   The **Account Name** used to identify the LinkedIn Learning account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
-   **Description** to assist in identifying the integration instance, if desired.
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.

#### Authentication fields

Fill in **at least one** of the credential pairs below. For full guidance on which combination matches your application setup, see the [Authorization](/integrations/directory/linkedin-learning.md?integration-docs=authorization) tab.

| Field | Required | Description |
| --- | --- | --- |
| **Content Client ID** | Conditional — at least one pair is required. | OAuth Client ID for the LinkedIn Learning application authorized for the **Content** scope. If your application has both Content and Report keys selected, filling this pair alone authorizes every endpoint. |
| **Content Client Secret** | Required when **Content Client ID** is provided. | OAuth Client Secret paired with **Content Client ID**. |
| **Report Client ID** | Conditional — at least one pair is required. | OAuth Client ID for the LinkedIn Learning application authorized for the **Report** scope. Only set this when you generated a separate application for the Report keys. |
| **Report Client Secret** | Required when **Report Client ID** is provided. | OAuth Client Secret paired with **Report Client ID**. |

#### Advanced — Activity Lookback Days

The integration's user-activity steps query LinkedIn's `learningActivityReports` endpoint, which **caps each request at a 14-day window**. The integration transparently chunks longer lookback windows into multiple ≤14-day requests on each sync.

| Field | Default | Options | Description |
| --- | --- | --- | --- |
| **Activity Lookback Days** | `14` | `14`, `30`, `90`, `180`, `365` | How far back to fetch learning activity on each sync. Larger values increase the number of API calls per run: 14 days → 1 window per activity step; 365 days → 27 windows per activity step. |

**How it affects data volume:** Larger lookback windows ingest more historical engagement, which produces a denser `User -[:ASSIGNED]-> Training` relationship graph but multiplies the request count per sync. For day-to-day compliance reporting, `14` is sufficient on a daily polling cadence. Choose `90` or longer only when you need a historical backfill or when your polling cadence is weekly/monthly.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `linkedin_learning_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Classification | `linkedin_learning_classification` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Course | `linkedin_learning_course` | [Training](https://docs.jupiterone.io/data-model/schemas/Training) |
| LearningPath | `linkedin_learning_learning_path` | [Training](https://docs.jupiterone.io/data-model/schemas/Training) |
| User | `linkedin_learning_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Video | `linkedin_learning_video` | [Training](https://docs.jupiterone.io/data-model/schemas/Training) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `linkedin_learning_account` | **HAS** | `linkedin_learning_classification` |
| `linkedin_learning_account` | **HAS** | `linkedin_learning_course` |
| `linkedin_learning_account` | **HAS** | `linkedin_learning_learning_path` |
| `linkedin_learning_account` | **HAS** | `linkedin_learning_video` |
| `linkedin_learning_account` | **HAS** | `linkedin_learning_user` |
| `linkedin_learning_course` | **HAS** | `linkedin_learning_classification` |
| `linkedin_learning_learning_path` | **HAS** | `linkedin_learning_classification` |
| `linkedin_learning_user` | **ASSIGNED** | `linkedin_learning_course` |
| `linkedin_learning_user` | **ASSIGNED** | `linkedin_learning_learning_path` |
| `linkedin_learning_user` | **ASSIGNED** | `linkedin_learning_video` |
| `linkedin_learning_video` | **HAS** | `linkedin_learning_classification` |

### Linkedin Learning Account

`linkedin_learning_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountKeyRef` \*

 | `string` | The credential identifier (content or report client id) used to scope this account entity to its integration instance. |  |

---

### Linkedin Learning Classification

`linkedin_learning_classification` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`classificationType` \*

 | `string` **|** `null` | The taxonomy level of the classification (LIBRARY, SUBJECT, TOPIC, SKILL, CREDENTIALING\_PROGRAM). |  |
| 

`locale` \*

 | `string` **|** `null` | The locale of the classification name as language\_country (e.g. en\_US). |  |
| 

`ownerName` \*

 | `string` **|** `null` | The localized display name of the classification owner. |  |
| 

`ownerUrn` \*

 | `string` **|** `null` | The URN of the person or organization that owns/originally created this classification. |  |
| 

`urn` \*

 | `string` | The opaque LinkedIn URN identifying the classification (e.g. urn:li:lyndaCategory:7220 or urn:li:skill:1234). |  |

---

### Linkedin Learning Course

`linkedin_learning_course` inherits from [Training](/data-model/schemas/Training.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetType` \*

 | `string` | The LinkedIn-reported asset type (COURSE, LEARNING\_PATH, or VIDEO). |  |
| 

`availability` \*

 | `string` **|** `null` | The availability status of the asset (AVAILABLE, RETIRED). |  |
| 

`availableLanguages` \*

 | `array` **|** `null` | The list of language codes the asset is available in (e.g. en, de, es). |  |
| 

`contributorNames` \*

 | `array` **|** `null` | The names of contributors involved in producing the asset (authors and publishers). |  |
| 

`contributorUrns` \*

 | `array` **|** `null` | The URNs of contributors involved in producing the asset. |  |
| 

`durationSeconds` \*

 | `number` **|** `null` | The duration of the asset in seconds (computed from timeToComplete). |  |
| 

`isCuratedForLms` \*

 | `boolean` **|** `null` | Whether the asset was curated for Learning Management System consumption by an account administrator. |  |
| 

`isRetired` \*

 | `boolean` **|** `null` | Whether the asset has been retired from the LinkedIn catalog. |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the asset was last updated. |  |
| 

`level` \*

 | `string` **|** `null` | The difficulty level of the asset (BEGINNER, INTERMEDIATE, ADVANCED). |  |
| 

`primaryImageUrl` \*

 | `string` **|** `null` | The primary image URL used to represent the asset. |  |
| 

`publishedOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the asset was published in LinkedIn Learning. |  |
| 

`retiredOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the asset was retired, if applicable. |  |
| 

`shortDescription` \*

 | `string` **|** `null` | The plain-text short description of the asset, localized when available. |  |
| 

`ssoLaunchUrl` \*

 | `string` **|** `null` | The SSO launch URL of the asset, populated when an SSO connection is configured. |  |
| 

`titleLocale` \*

 | `string` **|** `null` | The locale of the asset title as language\_country (e.g. en\_US). |  |
| 

`urn` \*

 | `string` | The opaque LinkedIn URN identifying the learning asset (e.g. urn:li:lyndaCourse:563322). |  |
| 

`webLaunchUrl` \*

 | `string` **|** `null` | The LinkedIn Learning web URL used to launch the asset for an authenticated learner. |  |

---

### Linkedin Learning Learning Path

`linkedin_learning_learning_path` inherits from [Training](/data-model/schemas/Training.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetType` \*

 | `string` | The LinkedIn-reported asset type (COURSE, LEARNING\_PATH, or VIDEO). |  |
| 

`availability` \*

 | `string` **|** `null` | The availability status of the asset (AVAILABLE, RETIRED). |  |
| 

`availableLanguages` \*

 | `array` **|** `null` | The list of language codes the asset is available in (e.g. en, de, es). |  |
| 

`contributorNames` \*

 | `array` **|** `null` | The names of contributors involved in producing the asset (authors and publishers). |  |
| 

`contributorUrns` \*

 | `array` **|** `null` | The URNs of contributors involved in producing the asset. |  |
| 

`durationSeconds` \*

 | `number` **|** `null` | The duration of the asset in seconds (computed from timeToComplete). |  |
| 

`isCuratedForLms` \*

 | `boolean` **|** `null` | Whether the asset was curated for Learning Management System consumption by an account administrator. |  |
| 

`isRetired` \*

 | `boolean` **|** `null` | Whether the asset has been retired from the LinkedIn catalog. |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the asset was last updated. |  |
| 

`level` \*

 | `string` **|** `null` | The difficulty level of the asset (BEGINNER, INTERMEDIATE, ADVANCED). |  |
| 

`primaryImageUrl` \*

 | `string` **|** `null` | The primary image URL used to represent the asset. |  |
| 

`publishedOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the asset was published in LinkedIn Learning. |  |
| 

`retiredOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the asset was retired, if applicable. |  |
| 

`shortDescription` \*

 | `string` **|** `null` | The plain-text short description of the asset, localized when available. |  |
| 

`ssoLaunchUrl` \*

 | `string` **|** `null` | The SSO launch URL of the asset, populated when an SSO connection is configured. |  |
| 

`titleLocale` \*

 | `string` **|** `null` | The locale of the asset title as language\_country (e.g. en\_US). |  |
| 

`urn` \*

 | `string` | The opaque LinkedIn URN identifying the learning asset (e.g. urn:li:lyndaCourse:563322). |  |
| 

`webLaunchUrl` \*

 | `string` **|** `null` | The LinkedIn Learning web URL used to launch the asset for an authenticated learner. |  |

---

### Linkedin Learning User

`linkedin_learning_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`enterpriseGroupNames` \*

 | `array` **|** `null` | The enterprise group names the learner belongs to in LinkedIn Learning. |  |
| 

`profileUrn` \*

 | `string` **|** `null` | The enterprise profile URN of the learner (e.g. urn:li:enterpriseProfile:(urn:li:enterpriseAccount:99,12345)). |  |
| 

`uniqueUserId` \*

 | `string` **|** `null` | The customer-supplied unique identifier for the learner provisioned in LinkedIn Learning. |  |

---

### Linkedin Learning Video

`linkedin_learning_video` inherits from [Training](/data-model/schemas/Training.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetType` \*

 | `string` | The LinkedIn-reported asset type (COURSE, LEARNING\_PATH, or VIDEO). |  |
| 

`availability` \*

 | `string` **|** `null` | The availability status of the asset (AVAILABLE, RETIRED). |  |
| 

`availableLanguages` \*

 | `array` **|** `null` | The list of language codes the asset is available in (e.g. en, de, es). |  |
| 

`contributorNames` \*

 | `array` **|** `null` | The names of contributors involved in producing the asset (authors and publishers). |  |
| 

`contributorUrns` \*

 | `array` **|** `null` | The URNs of contributors involved in producing the asset. |  |
| 

`durationSeconds` \*

 | `number` **|** `null` | The duration of the asset in seconds (computed from timeToComplete). |  |
| 

`isCuratedForLms` \*

 | `boolean` **|** `null` | Whether the asset was curated for Learning Management System consumption by an account administrator. |  |
| 

`isRetired` \*

 | `boolean` **|** `null` | Whether the asset has been retired from the LinkedIn catalog. |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the asset was last updated. |  |
| 

`level` \*

 | `string` **|** `null` | The difficulty level of the asset (BEGINNER, INTERMEDIATE, ADVANCED). |  |
| 

`primaryImageUrl` \*

 | `string` **|** `null` | The primary image URL used to represent the asset. |  |
| 

`publishedOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the asset was published in LinkedIn Learning. |  |
| 

`retiredOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the asset was retired, if applicable. |  |
| 

`shortDescription` \*

 | `string` **|** `null` | The plain-text short description of the asset, localized when available. |  |
| 

`ssoLaunchUrl` \*

 | `string` **|** `null` | The SSO launch URL of the asset, populated when an SSO connection is configured. |  |
| 

`titleLocale` \*

 | `string` **|** `null` | The locale of the asset title as language\_country (e.g. en\_US). |  |
| 

`urn` \*

 | `string` | The opaque LinkedIn URN identifying the learning asset (e.g. urn:li:lyndaCourse:563322). |  |
| 

`webLaunchUrl` \*

 | `string` **|** `null` | The LinkedIn Learning web URL used to launch the asset for an authenticated learner. |  |

---

## Release Notes

-   **2026-06-26** — Added initial LinkedIn Learning integration, ingesting courses, learning asset classifications, and their relationships.

---

Source: /integrations/directory/logicmonitor

# LogicMonitor

Visualize LogicMonitor devices in the JupiterOne graph. Use this integration as part of a Unified Device use case.

## Installation

### Requirements

-   User requires Bearer token generated in LogicMonitor Account.
-   You must have permission in JupiterOne to install new integrations.

### Configuration in LogicMonitor

#### Create Bearer Token

1.  Follow the instructions found [here](https://www.logicmonitor.com/support/adding-a-bearer-token) to create a Bearer Token.
2.  Save the token in a secure location, following your organization's security policies.

### Configuration in JupiterOne

1.  From the top navigation of the J1 Search homepage, select **Integrations**
2.  Search for the **LogicMonitor** and select it.
3.  Click on the **Add Instance** button and configure the following settings:

-   Enter the **Account Name** by which you'd like to identify this LogicMonitor instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
-   Enter a **Description** that will further assist your team when identifying the integration instance.
-   Select a **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
-   Enter the **Company Subdomain**. If you log in in at `https://<company>.logicmonitor.com`, then `<company>` is the company subdomain.
-   Enter the **LogicMonitor Bearer Token** generated for use by JupiterOne.

4.  Click **Create Configuration** once all values are provided.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `logicmonitor_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device | `logicmonitor_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |

### Logicmonitor Account

`logicmonitor_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Logicmonitor Device

`logicmonitor_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`autoBalancedCollectorGroupId` \*

 | `number` | The Auto Balanced Collector Group id. 0 means not monitored by ABCG |  |
| 

`autoPropsAssignedOn` \*

 | `number` |  |  |
| `autoPropsUpdatedOn` | `number` | The time, in epoch seconds, that auto properties last ran and updated the properties table for this device |  |
| `awsDeviceDiedOn` | `number` | The timestamp when the AWS device went dead, or the AWS device was filtered out |  |
| 

`category` \*

 | `string` **|** `null` | Derived from the system property namee: "system.systemtype" |  |
| `cmdbUrl` | `string` | Included if found at sn.cmdb\_url in response |  |
| 

`collectorDescription` \*

 | `string` | The description/name of the collector for this device |  |
| 

`currentCollectorId` \*

 | `number` | The id of the collector currently monitoring the device and discovering instances |  |
| 

`currentLogCollectorId` \*

 | `number` | The id of the Log collector currently collecting logs. |  |
| 

`deviceType` \*

 | `string` | The type of device: Regular device, APPGROUP device, AWS device, Service device, Azure device, Biz Service device, GCP device, K8S device |  |
| `deviceWillBeDeletedOn` | `number` | The number of milliseconds until the device will be automatically deleted from your LogicMonitor account (if value is not present, this indicates that a future delete time/date has not been scheduled) |  |
| 

`disableAlerting` \*

 | `boolean` | Indicates whether alerting is disabled (true) or enabled (false) for this device |  |
| 

`displayName` \*

 | `string` | The display name of the device |  |
| 

`enableNetflow` \*

 | `boolean` | Indicates whether Netflow is enabled (true) or disabled (false) for the device |  |
| `endpointCaption` | `string` | Derived from the auto property named: "auto.endpoint.caption" |  |
| `externalResourceId` | `string` | Included if found at prefdef.externalResourceID in response |  |
| `hostGroupIds` | `array` of `string`s |  |  |
| 

`hostStatus` \*

 | `string` | The status of this device, where possible statuses are: normal, dead and dead-collector | **Any of**:

-   `normal`

-   `dead`

-   `dead-collector`

 |
| `instanceState` | `string` | The CSP (GCP, Azure, or AWS) instance state (if applicable): running, stopped and terminated. |  |
| 

`isPreferredLogCollectorConfigured` \*

 | `boolean` | Indicates whether Preferred Log Collector is configured (true) or not (false) for the device |  |
| `lastReportedNewflowDataOn` | `number` | The last time, in epoch seconds, that raw Netflow data was reported |  |
| 

`lastSeenOn` \*

 | `number` **|** `null` | The last time, in epoch seconds, that the device received Netflow data |  |
| 

`logCollectorDescription` \*

 | `string` | The description/name of the log collector for this device |  |
| 

`logCollectorGroupId` \*

 | `number` | The id of the Collector Group associated with the device's log collection |  |
| 

`logCollectorGroupName` \*

 | `string` | The name of the Collector Group associated with the device's. |  |
| 

`logCollectorId` \*

 | `number` | The Id of the netflow collector associated with the device |  |
| 

`netflowCollectorDescription` \*

 | `string` | The description/name of the netflow collector for this device |  |
| 

`netflowCollectorGroupId` \*

 | `number` | The id of the Collector Group associated with the device's netflow collector |  |
| 

`netflowCollectorGroupName` \*

 | `string` | The name of the Collector Group associated with the device's netflow collector |  |
| 

`netflowCollectorId` \*

 | `number` | The Id of the netflow collector associated with the device |  |
| `osArchitecture` | `string` | Derived from the auto property named: "auto.os.architecture" |  |
| `osComputerName` | `string` | Derived from the auto property named: "auto.os.computer\_name" |  |
| `osKernel` | `string` | Derived from "auto.linux.kernel.release" on Linux devices, or "auto.os.version" on Windows devices (NT kernel version format) |  |
| `osPrimaryOwnerName` | `string` | Derived from the auto property named: "auto.os.primary\_owner\_name" |  |
| 

`preferredCollectorGroupId` \*

 | `number` | The id of the Collector Group associated with the device's preferred collector |  |
| 

`preferredCollectorGroupName` \*

 | `string` | The name of the Collector Group associated with the device's preferred collector |  |
| 

`preferredCollectorId` \*

 | `number` | The Id of the preferred collector assigned to monitor the device |  |
| `relatedAwsEc2InstanceDeviceId` | `number` | The Id of the AWS EC2 instance related to this device, if one exists in the LogicMonitor account. This value defaults to -1, which indicates that there are no related devices |  |
| 

`rolePrivileges` \*

 | `array` of `string`s |  |  |
| `scanConfigId` | `number` | The Id of the netscan configuration which was used to discover this device. 0 indicates that the device was not discovered by a scan |  |
| `systemGroups` | `array` of `string`s |  |  |
| 

`userPermission` \*

 | `string` | The read and/or write permissions for this device that are granted to the user who made the API request |  |

---

## Release Notes

-   **2026-03-31** — Added OS kernel version property to LogicMonitor device entities.
-   **2025-04-17** — Added ServiceNow system ID as a device identifier on LogicMonitor device entities.

---

Source: /integrations/directory/malwarebytes

# Malwarebytes

Visualize Malwarebytes configurations and findings, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> JupiterOne requires a Malwarebytes account ID, API client ID and client secret to interact with the API. For more information on obtaining API credentials, refer to [Malwarebyte's API documentation](https://api.malwarebytes.com/nebula/v1/docs).

### Configuration in JupiterOne

To install the Malwarebytes integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Malwarebytes. Click **New Instance** to begin configuring your integration, providing the requires the following:

-   **Account Name** used to identify the Malwarebytes account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Account ID** of your Malwarebytes account.
    
-   Your MalwareBytes **Client ID** and **Client Seecret** configured for this integration.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `malwarebytes_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Configuration | `malwarebytes_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Finding | `malwarebytes_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Group | `malwarebytes_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| HostAgent | `malwarebytes_agent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `malwarebytes_account` | **HAS** | `malwarebytes_group` |
| `malwarebytes_account` | **HAS** | `malwarebytes_agent` |
| `malwarebytes_agent` | **PROTECTS** | `USER_ENDPOINT` |
| `malwarebytes_agent` | **IDENTIFIED** | `malwarebytes_finding` |
| `malwarebytes_group` | **HAS** | `malwarebytes_configuration` |
| `malwarebytes_group` | **HAS** | `malwarebytes_agent` |

---

Source: /integrations/directory/manage-engine-ec

# ManageEngine Endpoint Central

Visualize Manage Engine computers, patches and remote offices in the JupiterOne graph. Our guide provides step-by-step instructions on setting up the integration gaining visibility to your ManageEngine Endpoint Central environment.

## Installation

To install this integration, you will need to configure settings both within ManageEngine Endpoint Central and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your ManageEngine Endpoint Central's account.

### Configuration on ManageEngine Endpoint Central

First, follow the table in the [ManageEngine Endpoint Central documentation](https://www.manageengine.com/products/desktop-central/api/cloud_index.html#api-structure) to get correct Zoho Account and Endpoint Central API URLs, as well link to the Zoho Developer Console necessary to the next steps.

# ManageEngine Integration Setup Guide

This guide provides detailed, step-by-step instructions to set up an integration with ManageEngine Desktop Central. There are two integration options available: **On-Premises** and **Cloud**. Follow the instructions below to ensure your integration is configured correctly.

## Table of Contents

1.  [Prerequisites](#prerequisites)
2.  [On-Premises Integration Setup](#on-premises-integration-setup)
    -   [API Token Authentication](#api-token-authentication)
    -   [Username/Password Authentication (No Two-Factor)](#usernamepassword-authentication-no-two-factor)
3.  [Cloud Integration Setup](#cloud-integration-setup)
4.  [Support](#support)

## Prerequisites

Before you begin, ensure you have:

-   An active ManageEngine Desktop Central subscription.
-   API access enabled and necessary credentials obtained.
-   Basic knowledge of REST APIs and your current environment setup.
-   Network/firewall settings that allow outbound API requests.

## On-Premises Integration Setup

ManageEngine offers two methods for on-premises integration depending on your authentication method:

### API Token Authentication

1.  **Access the On-Premises API Documentation**  
    Familiarize yourself with the available endpoints and guidelines in the [ManageEngine On-Premises API Documentation](https://www.manageengine.com/products/desktop-central/api/).
    
2.  **Generate an API Token**
    
    -   Log in to your Desktop Central instance.
    -   Navigate to **Admin** → **Integrations** → **API Key Management**.
    -   Create or regenerate your API token.
    -   If two factor is enabled make sure to complete the steps providing the OTP.
    -   **Note:** Ensure that this token remains confidential.
3.  **Configure Your Integration**
    
    -   Update your JupiterOne integration settings. Select _On-Premise Token Authentication_.
    -   Input your Server URL and API Token.

### Username/Password Authentication (No Two-Factor)

If you are **not** using two-factor authentication, you can also integrate using your username and password.

1.  **Review Authentication Requirements**
    
    -   If two-factor authentication is disabled, you can use your ManageEngine username and password for integration.
    -   Consult the [ManageEngine On-Premises API Documentation](https://www.manageengine.com/products/desktop-central/api/) for details on the authentication endpoint.
2.  **Configure Your Integration**
    
    -   Update your JupiterOne integration settings. Select _On-Premise AD Authentication_ or _On-Premise Local Authentication_ depending on your setup.
    -   Input your Server URL, username, password and domain if needed.

## Cloud Integration Setup

Familiarize yourself with the cloud API by referring to the [ManageEngine Cloud API Documentation](https://www.manageengine.com/products/desktop-central/api/cloud_index.html).

**Steps:**

1.  **Log in to Zoho Developer Console**  
    Access the Zoho Developer Console with your credentials.
    
2.  **Create a "Self Client" Client Type**  
    Create a new client of type "Self Client".
    
3.  **Retrieve Client Credentials**
    
    -   Navigate to the "Client Secret" tab.
    -   Copy the "Client ID" and "Client Secret" and save them somewhere secure.
4.  **Generate an Authorization Code**
    
    -   Go to the "Generate Code" tab within your "Self Client" application.
    -   Set the **Scope** to:  
        `DesktopCentralCloud.Common.READ,DesktopCentralCloud.SOM.READ,DesktopCentralCloud.Inventory.READ,DesktopCentralCloud.PatchMgmt.READ`
    -   Optionally, set the **Time Duration** to 10 minutes.
    -   Provide a **Scope Description** (e.g., "JupiterOne Integration").
    -   Click **Create** to generate an authorization code.
5.  **Obtain the Refresh Token**
    
    -   Exchange the authorization code from the previous step for a refresh token using the following `curl` command. Replace `<code>`, `<client_id>`, and `<client_secret>` with your actual values, and `<region>` with the top-level domain of your Zoho data center (for example `com`, `eu`, `in`, `com.au`, `cn`, `jp`, `ca`, or `uk`) as listed in the [ManageEngine Cloud API region table](https://www.manageengine.com/products/desktop-central/api/cloud_index.html#api-structure):
        
        ```bash
        curl -X POST -H "Content-Type: application/x-www-form-urlencoded" \
        -d "grant_type=authorization_code&client_id=<client_id>&client_secret=<client_secret>&redirect_uri=https://api-console.zoho.<region>&code=<code>" \
        https://accounts.zoho.<region>/oauth/v2/token
        ```
        
    -   The response will include a JSON payload containing the `refresh_token`.
        
6.  **Save the Credentials**  
    Store the "refresh token", along with your "Client ID" and "Client Secret", securely. These credentials will be needed later when configuring JupiterOne.
    

## Support

For more details and assistance, refer to the official documentation:

-   [ManageEngine On-Premises API Documentation](https://www.manageengine.com/products/desktop-central/api/)
-   [ManageEngine Cloud API Documentation](https://www.manageengine.com/products/desktop-central/api/cloud_index.html)

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Computer | `manageengine_computer` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Patch | `manageengine_patch` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| RemoteOffice | `manageengine_remote_office` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `manageengine_computer` | **HAS** | `manageengine_patch` |
| `manageengine_remote_office` | **MANAGES** | `manageengine_computer` |
| `manageengine_remote_office` | **ENFORCES** | `manageengine_patch` |

### Manageengine Computer

`manageengine_computer` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentLoggedOnUsers` | `string` |  |  |
| `agentVersion` | `string` |  |  |
| `assetTag` | `array` of `string`s |  |  |
| `customerName` | `string` |  |  |
| `deviceName` | `string` |  |  |
| `hardwareModel` | `string` |  |  |
| `hardwareSerial` | `string` |  |  |
| `hardwareVendor` | `string` |  |  |
| `hardwareVersion` | `string` |  |  |
| `id` | `string` |  |  |
| `ipAddresses` | `array` of `string`s |  |  |
| `macAddress` | `array` of `string`s |  |  |
| `officeName` | `string` |  |  |
| `owner` | `string` |  |  |
| `ownerEmailId` | `string` |  |  |
| `platform` | `string` |  |  |
| `status` | `string` |  |  |
| `systemVersion` | `string` |  |  |
| `type` | `string` |  |  |
| `vendor` | `string` |  |  |
| `version` | `string` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS details for ManageEngine Endpoint Central device entities to include both OS name and version.
-   **2025-06-03** — Added customer name, owner, owner email, and logged-on user properties to ManageEngine Endpoint Central device entities.

---

Source: /integrations/directory/mandiant-asm

# Mandiant ASM

Visualize Mandiant Attack Surface Management assets, monitor external-facing hosts, domains, certificates, and security issues, and track changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need API credentials from the Mandiant ASM platform. These can be generated by any user under their account settings. See the [Mandiant ASM API documentation](https://asm-help.advantage.mandiant.com/docs/authenticating) for more information.

### Prerequisites

1.  Access to the Mandiant ASM platform at `https://asm-api.advantage.mandiant.com`
2.  An **Intrigue Access Key** and **Intrigue Secret Key** generated from your account settings
3.  At least one ASM project configured in the platform

### Configuration in JupiterOne

To install the Mandiant ASM integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Mandiant ASM. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Mandiant ASM account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Mandiant ASM **Intrigue Access Key** (INTRIGUE\_ACCESS\_KEY) used to authenticate with the API.
    
-   Your Mandiant ASM **Intrigue Secret Key** (INTRIGUE\_SECRET\_KEY) used to authenticate with the API.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `mandiant_asm_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| ApplicationEndpoint | `mandiant_asm_application_endpoint` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| Certificate | `mandiant_asm_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| CodeRepo | `mandiant_asm_code_repo` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Collection | `mandiant_asm_collection` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| DataStore | `mandiant_asm_data_store` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| DnsRecord | `mandiant_asm_dns_record` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |
| Domain | `mandiant_asm_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| Host | `mandiant_asm_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Issue | `mandiant_asm_issue` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Network | `mandiant_asm_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| NetworkService | `mandiant_asm_network_service` | [NetworkInterface](https://docs.jupiterone.io/data-model/schemas/NetworkInterface) |
| Project | `mandiant_asm_project` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Resource | `mandiant_asm_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Technology | `mandiant_asm_technology` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `mandiant_asm_account` | **HAS** | `mandiant_asm_project` |
| `mandiant_asm_application_endpoint` | **HAS** | `mandiant_asm_issue` |
| `mandiant_asm_application_endpoint` | **USES** | `mandiant_asm_technology` |
| `mandiant_asm_certificate` | **HAS** | `mandiant_asm_issue` |
| `mandiant_asm_code_repo` | **HAS** | `mandiant_asm_issue` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_host` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_domain` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_dns_record` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_network_service` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_certificate` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_application_endpoint` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_network` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_data_store` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_code_repo` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_resource` |
| `mandiant_asm_data_store` | **HAS** | `mandiant_asm_issue` |
| `mandiant_asm_dns_record` | **HAS** | `mandiant_asm_issue` |
| `mandiant_asm_domain` | **HAS** | `mandiant_asm_issue` |
| `mandiant_asm_domain` | **USES** | `mandiant_asm_technology` |
| `mandiant_asm_host` | **HAS** | `mandiant_asm_issue` |
| `mandiant_asm_host` | **USES** | `mandiant_asm_technology` |
| `mandiant_asm_network` | **HAS** | `mandiant_asm_issue` |
| `mandiant_asm_network_service` | **HAS** | `mandiant_asm_issue` |
| `mandiant_asm_network_service` | **USES** | `mandiant_asm_technology` |
| `mandiant_asm_project` | **HAS** | `mandiant_asm_collection` |
| `mandiant_asm_resource` | **HAS** | `mandiant_asm_issue` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `mandiant_asm_code_repo` | **IS** | `github_repo` | FORWARD |
| `mandiant_asm_data_store` | **IS** | `aws_s3_bucket` | FORWARD |
| `mandiant_asm_data_store` | **IS** | `azure_storage_account` | FORWARD |
| `mandiant_asm_data_store` | **IS** | `google_storage_bucket` | FORWARD |
| `mandiant_asm_host` | **IS** | `aws_instance` | FORWARD |
| `mandiant_asm_host` | **IS** | `azure_vm` | FORWARD |
| `mandiant_asm_host` | **IS** | `google_compute_instance` | FORWARD |

### Mandiant Asm Account

`mandiant_asm_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`vendor` \*

 | `string` | The vendor name for the account |  |

---

### Mandiant Asm Application Endpoint

`mandiant_asm_application_endpoint` inherits from [ApplicationEndpoint](/data-model/schemas/ApplicationEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`address` \*

 | `string` **|** `null` | The address of the application endpoint |  |
| 

`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |

---

### Mandiant Asm Certificate

`mandiant_asm_certificate` inherits from [Certificate](/data-model/schemas/Certificate.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |

---

### Mandiant Asm Code Repo

`mandiant_asm_code_repo` inherits from [CodeRepo](/data-model/schemas/CodeRepo.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |

---

### Mandiant Asm Collection

`mandiant_asm_collection` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` | The workflow category of the collection |  |
| 

`entityCount` \*

 | `number` **|** `null` | The number of entities in the collection |  |
| 

`internal` \*

 | `boolean` | Whether this is an internal collection |  |
| 

`summary` \*

 | `string` | A summary description of the collection |  |

---

### Mandiant Asm Data Store

`mandiant_asm_data_store` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`classification` \*

 | `string` **|** `null` | The data classification level |  |
| 

`encrypted` \*

 | `boolean` **|** `null` | Whether the data store is encrypted |  |
| 

`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |

---

### Mandiant Asm Dns Record

`mandiant_asm_dns_record` inherits from [DomainRecord](/data-model/schemas/DomainRecord.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |
| 

`TTL` \*

 | `number` | Time-to-live of the DNS record (defaults to 0 when not provided by API) |  |
| 

`type` \*

 | `string` | The DNS record type (defaults to A when not provided by API) |  |

---

### Mandiant Asm Domain

`mandiant_asm_domain` inherits from [Domain](/data-model/schemas/Domain.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainName` \*

 | `string` | The domain name |  |
| 

`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |

---

### Mandiant Asm Host

`mandiant_asm_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `null` | The Mandiant ASM category of the host |  |
| 

`deviceId` \*

 | `array` **|** `null` | Device identifiers for the host |  |
| 

`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`fqdn` \*

 | `array` **|** `null` | Fully qualified domain names for the host |  |
| 

`hostname` \*

 | `string` **|** `null` | The hostname of the host |  |
| 

`ipv4Addresses` \*

 | `array` **|** `null` | IPv4 addresses of the host |  |
| 

`ipv6Addresses` \*

 | `array` **|** `null` | IPv6 addresses of the host |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |
| 

`lastSeenOn` \*

 | `integer` **|** `null` | Timestamp when the host was last seen |  |
| 

`macAddresses` \*

 | `array` **|** `null` | MAC addresses of the host |  |
| 

`make` \*

 | `string` **|** `null` | The manufacturer of the host |  |
| 

`model` \*

 | `string` **|** `null` | The model of the host |  |
| 

`osDetails` \*

 | `string` **|** `null` | Detailed OS information |  |
| 

`osName` \*

 | `string` **|** `null` | The OS name |  |
| 

`osType` \*

 | `string` **|** `null` | The OS type |  |
| 

`osVersion` \*

 | `string` **|** `null` | The OS version |  |
| 

`platform` \*

 | `string` **|** `null` | The cloud platform (AWS, Azure, GCP) |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses of the host |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses of the host |  |
| 

`serial` \*

 | `string` **|** `null` | The serial number of the host |  |

---

### Mandiant Asm Issue

`mandiant_asm_issue` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `null` | The category of the issue |  |
| 

`entityUid` \*

 | `string` **|** `null` | The UID of the parent entity this issue belongs to |  |
| 

`isConfidence` \*

 | `string` **|** `null` | The confidence level of the finding |  |
| 

`numericSeverity` \*

 | `number` **|** `null` | Numeric severity on a 0-10 scale |  |
| 

`open` \*

 | `boolean` **|** `null` | Whether the issue is currently open |  |
| 

`severity` \*

 | `string` **|** `null` | Severity level (critical, high, medium, low, informational) |  |
| 

`source` \*

 | `string` **|** `null` | The collection source of the issue |  |
| 

`upstream` \*

 | `string` **|** `null` | The upstream source of the issue |  |

---

### Mandiant Asm Network

`mandiant_asm_network` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`CIDR` \*

 | `string` **|** `null` | The CIDR notation for the network block |  |
| 

`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`internal` \*

 | `boolean` **|** `null` | Whether this is an internal network |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |
| 

`public` \*

 | `boolean` **|** `null` | Whether this is a public network |  |

---

### Mandiant Asm Network Service

`mandiant_asm_network_service` inherits from [NetworkInterface](/data-model/schemas/NetworkInterface.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |

---

### Mandiant Asm Project

`mandiant_asm_project` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`organizationUuid` \*

 | `string` **|** `null` | The UUID of the organization this project belongs to |  |

---

### Mandiant Asm Resource

`mandiant_asm_resource` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |

---

### Mandiant Asm Technology

`mandiant_asm_technology` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`entityUid` \*

 | `string` **|** `null` | The UID of the parent entity this technology belongs to |  |

---

## Release Notes

-   **2026-04-09** — New Mandiant ASM integration: ingests projects, collections, assets including hosts, domains, DNS records, network services, certificates, application endpoints, and networks, plus issues and technology inventory.

---

Source: /integrations/directory/markmonitor

# MarkMonitor

Visualize MarkMonitor domains, DNS zones, DNS records, contacts, and domain groups, and monitor changes through queries and alerts including domain audit logs for compliance tracking.

## Installation

### Prerequisites in MarkMonitor

To use this integration, you need API credentials from MarkMonitor. These credentials are not self-service and must be obtained through your MarkMonitor account representative or Designated Partner Administrator (DPA).

#### Required Credentials

You will need the following credentials from your MarkMonitor account:

1.  **API Key** - Used for the `X-API-KEY` header in all API requests
2.  **Username** - Your MarkMonitor API username (typically an email or service account)
3.  **Password** - Your MarkMonitor API password

#### Obtaining API Credentials

1.  Log in to the [MarkMonitor Customer Portal](https://corp.markmonitor.com)
2.  Contact your MarkMonitor account representative or DPA to request API access
3.  Once approved, you will receive:
    -   An API key for authentication
    -   API username and password credentials
4.  Ensure your account has appropriate permissions to access the Domain API

For more information about the MarkMonitor APIs, refer to the [MarkMonitor API Documentation](https://api.markmonitor.com/).

#### Optional: DNS API Access

The integration can also ingest DNS records if your account has access to the MarkMonitor DNS API. This requires separate authentication and may not be available for all customers. Contact your MarkMonitor representative to verify DNS API access.

### Configuration in JupiterOne

To install the MarkMonitor integration in JupiterOne, navigate to the **Integrations** tab and select MarkMonitor. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **Account Name** used to identify the MarkMonitor account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **Tag with Account Name** option is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **API Key** - Your MarkMonitor API key for X-API-KEY header authentication.
    
-   **Username** - Your MarkMonitor API username.
    
-   **Password** - Your MarkMonitor API password.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `markmonitor_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AuditLog | `markmonitor_audit_log` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Contact | `markmonitor_contact` | [Person](https://docs.jupiterone.io/data-model/schemas/Person) |
| DnsRecord | `markmonitor_dns_record` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |
| Domain | `markmonitor_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| DomainZone | `markmonitor_domain_zone` | [DomainZone](https://docs.jupiterone.io/data-model/schemas/DomainZone) |
| Group | `markmonitor_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Nameserver | `markmonitor_nameserver` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `markmonitor_account` | **HAS** | `markmonitor_group` |
| `markmonitor_account` | **HAS** | `markmonitor_domain` |
| `markmonitor_account` | **HAS** | `markmonitor_contact` |
| `markmonitor_domain` | **HAS** | `markmonitor_domain_zone` |
| `markmonitor_domain` | **HAS** | `markmonitor_audit_log` |
| `markmonitor_domain_zone` | **USES** | `markmonitor_nameserver` |
| `markmonitor_domain_zone` | **HAS** | `markmonitor_dns_record` |
| `markmonitor_group` | **HAS** | `markmonitor_domain` |

### Markmonitor Account

`markmonitor_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |

---

### Markmonitor Audit Log

`markmonitor_audit_log` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainName` \*

 | `string` |  |  |
| 

`userName` \*

 | `string` **|** `null` |  |  |

---

### Markmonitor Contact

`markmonitor_contact` inherits from [Person](/data-model/schemas/Person.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`contactId` \*

 | `string` |  |  |
| 

`contactType` \*

 | `string` **|** `null` |  |  |
| 

`organization` \*

 | `string` **|** `null` |  |  |

---

### Markmonitor Dns Record

`markmonitor_dns_record` inherits from [DomainRecord](/data-model/schemas/DomainRecord.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`comment` \*

 | `string` **|** `null` |  |  |
| 

`port` \*

 | `number` **|** `null` |  |  |
| 

`priority` \*

 | `number` **|** `null` |  |  |
| 

`recordId` \*

 | `number` |  |  |
| 

`weight` \*

 | `number` **|** `null` |  |  |
| 

`zoneId` \*

 | `string` |  |  |
| 

`zoneName` \*

 | `string` **|** `null` |  |  |

---

### Markmonitor Domain

`markmonitor_domain` inherits from [Domain](/data-model/schemas/Domain.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`adminId` \*

 | `string` **|** `null` |  |  |
| 

`billingId` \*

 | `string` **|** `null` |  |  |
| 

`group` \*

 | `string` **|** `null` |  |  |
| 

`paidThroughDate` \*

 | `number` **|** `null` |  |  |
| 

`registrantId` \*

 | `string` **|** `null` |  |  |
| 

`renewalStatus` \*

 | `string` **|** `null` |  |  |
| 

`techId` \*

 | `string` **|** `null` |  |  |

---

### Markmonitor Domain Zone

`markmonitor_domain_zone` inherits from [DomainZone](/data-model/schemas/DomainZone.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`dnssecAlgorithm` \*

 | `string` **|** `null` |  |  |
| 

`dnssecDigest` \*

 | `string` **|** `null` |  |  |
| 

`dnssecDigestType` \*

 | `number` **|** `null` |  |  |
| `dnssecEnabled` | `boolean` |  |  |
| 

`dnssecKeyTag` \*

 | `number` **|** `null` |  |  |
| `dnssecRecords` | `array` of `undefined`s |  |  |
| `nameservers` | `array` of `string`s |  |  |

---

### Markmonitor Group

`markmonitor_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainCount` \*

 | `number` **|** `null` |  |  |
| 

`groupId` \*

 | `string` |  |  |

---

### Markmonitor Nameserver

`markmonitor_nameserver` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`fqdn` \*

 | `string` |  |  |

---

## Release Notes

-   **2026-01-29** — New MarkMonitor integration: ingests domains, DNS records, contacts, domain zones, nameservers, and audit logs with full relationship mapping.

---

Source: /integrations/directory/microsoft-365

# Microsoft 365

Visualize Microsoft 365 services, groups, and users, and monitor changes through queries and alerts.

## Installation

To use this integration, you must have:

-   An organizational Active Directory tenant to target for ingestion. The integration does not support the use of other tenant types.
-   An account in the tenant you want to target for ingestion that has global administrator access. You will log in with this account to grant the JupiterOne application API permissions that can read data across all users (admin consent).

### Configuration in JupiterOne

To install the Microsoft 365 integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Microsoft 365. Click **New Instance** to begin configuring your integration, providing the following:

-   The **Account Name** used to identify the Microsoft 365 account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

After completing the authorization flow, the **Tenant ID** is automatically populated with the identifier for the Microsoft Active Directory tenant you authorized. This field is read-only.

## Data Volume Configuration

Control how much data is ingested from Microsoft 365 to manage storage and processing.

### Data Filtering Options

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Included Vulnerability Severities** | Vulnerability severity levels to ingest. Filtering out lower severities reduces the volume of noncompliance findings. | Low, Medium, High, Critical | Unknown, Informational, Low, Medium, High, Critical |

### Advanced Configuration

| Field | Description | Default |
| --- | --- | --- |
| **Include Advanced Device Details** | When enabled, ingests additional device properties: `physicalMemoryInBytes`, `iccid`, and `ethernetMacAddress`. Additional API requests may extend ingestion duration. | Disabled |

Click **Create** after you have provided all the values.

When prompted, click **Begin Authorization**.

You are then directed to the Microsoft identity platform where you must log in as a global administrator of the organizational Active Directory tenant you intend to integrate with.

You must select an account belonging to an organizational tenant. When you are already logged into an account, the badge icons indicate the nature of the tenant the account belongs to. Do not select a personal account.

Review the requested permissions (described below) and grant consent. Once you proceed through the authorization, you will have successfully completed the integration setup process.

#### Granted permissions

1.  `DeviceManagementApps.Read.All`
    -   Read Microsoft Intune apps
    -   Needed for creating `Application` entities
2.  `DeviceManagementConfiguration.Read.All`
    -   Read Microsoft Intune device configuration and policies
    -   Needed for creating `Configuration` and `ControlPolicy` entities
3.  `DeviceManagementManagedDevices.Read.All`
    -   Read Microsoft Intune devices
    -   Needed for creating `Device` and `HostAgent` entities
4.  `Organization.Read.All`
    -   Read organization information
    -   Needed for creating the `Account` entity
5.  `DeviceManagementServiceConfig.Read.All`
    -   Read Microsoft Intune configuration
    -   Needed for enriching the `Account` entity with Intune subscription information and ingesting Windows Autopilot device identities
6.  `DeviceManagementScripts.Read.All`
    -   Read Microsoft Intune device health scripts and their assignments
    -   Needed for creating `intune_device_health_script` entities
7.  `User.Read.All`
    -   Read all users' full profiles
    -   Needed for creating `User` entities
8.  `Group.Read.All`
    -   Read all groups
    -   Needed for creating `Group` entities
9.  `GroupMember.Read.All`
    -   Read the members of all groups
    -   Needed for creating group membership relationships and resolving Intune policy assignments to devices
10.  `Team.ReadBasic.All`
     -   Read the names and descriptions of Teams
     -   Needed for creating `microsoft_teams_team` entities
11.  `TeamsAppInstallation.ReadForTeam.All`
     -   Read the apps installed in all Teams
     -   Needed for creating `microsoft_teams_app_installation` entities
12.  `AuditLog.Read.All`
     -   Read audit log data
     -   Always requested; on tenants with a Microsoft Entra ID P1 or P2 license, the integration will include `signInActivity` in the `User` entity.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (12)

-   `AuditLog.Read.All`
-   `DeviceManagementApps.Read.All`
-   `DeviceManagementConfiguration.Read.All`
-   `DeviceManagementManagedDevices.Read.All`
-   `DeviceManagementScripts.Read.All`
-   `DeviceManagementServiceConfig.Read.All`
-   `Group.Read.All`
-   `GroupMember.Read.All`
-   `Organization.Read.All`
-   `Team.ReadBasic.All`
-   `TeamsAppInstallation.ReadForTeam.All`
-   `User.Read.All`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (27)

-   `https://graph.microsoft.com/beta/deviceAppManagement/mobileApps`
-   `https://graph.microsoft.com/beta/deviceManagement/configurationPolicies`
-   `https://graph.microsoft.com/beta/deviceManagement/configurationPolicies/{policyId}/deviceStatuses`
-   `https://graph.microsoft.com/beta/deviceManagement/configurationPolicies/{policyId}/settings`
-   `https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies/{policyId}/deviceStatuses`
-   `https://graph.microsoft.com/beta/deviceManagement/deviceHealthScripts`
-   `https://graph.microsoft.com/beta/deviceManagement/deviceHealthScripts/{scriptId}/assignments`
-   `https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations`
-   `https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/{policyId}/assignments`
-   `https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/{policyId}/definitionValues`
-   `https://graph.microsoft.com/beta/deviceManagement/manageddevices/{deviceId}`
-   `https://graph.microsoft.com/beta/deviceManagement/subscriptionState`
-   `https://graph.microsoft.com/v1.0/deviceManagement`
-   `https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies`
-   `https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations`
-   `https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations/{configurationId}/deviceStatuses`
-   `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices`
-   `https://graph.microsoft.com/v1.0/deviceManagement/reports/microsoft.graph.retrieveDeviceAppInstallationStatusReport`
-   `https://graph.microsoft.com/v1.0/deviceManagement/windowsAutopilotDeviceIdentities`
-   `https://graph.microsoft.com/v1.0/groups`
-   `https://graph.microsoft.com/v1.0/groups/{groupId}/members`
-   `https://graph.microsoft.com/v1.0/groups/{groupId}/transitiveMembers`
-   `https://graph.microsoft.com/v1.0/organization`
-   `https://graph.microsoft.com/v1.0/organization/{organizationId}`
-   `https://graph.microsoft.com/v1.0/teams`
-   `https://graph.microsoft.com/v1.0/teams/{teamId}/installedApps`
-   `https://graph.microsoft.com/v1.0/users`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (21)

-   [https://learn.microsoft.com/en-us/graph/api/group-list-members?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-list-members?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/group-list-transitivemembers?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-list-transitivemembers?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/group-list?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-list?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/intune-deviceconfig-devicecompliancedevicestatus-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-deviceconfig-devicecompliancedevicestatus-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-deviceconfig-deviceconfigurationdevicestatus-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-deviceconfig-deviceconfigurationdevicestatus-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-deviceconfigv2-devicemanagementconfigurationpolicy-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-deviceconfigv2-devicemanagementconfigurationpolicy-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-devices-devicehealthscript-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-devices-devicehealthscript-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-devices-devicehealthscriptassignment-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-devices-devicehealthscriptassignment-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-devices-manageddevice-list?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/intune-devices-manageddevice-list?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/intune-enrollment-windowsautopilotdeviceidentity-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-enrollment-windowsautopilotdeviceidentity-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-grouppolicy-grouppolicyconfiguration-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-grouppolicy-grouppolicyconfiguration-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-grouppolicy-grouppolicyconfigurationassignment-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-grouppolicy-grouppolicyconfigurationassignment-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-grouppolicy-grouppolicydefinitionvalue-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-grouppolicy-grouppolicydefinitionvalue-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-shared-devicecompliancepolicy-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-shared-devicecompliancepolicy-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-shared-deviceconfiguration-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-shared-deviceconfiguration-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-shared-mobileapp-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-shared-mobileapp-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/organization-get?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/organization-get?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/resources/intune-reporting-devicemanagementreports?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/resources/intune-reporting-devicemanagementreports?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/team-list-installedapps?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/team-list-installedapps?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/teams-list?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/teams-list?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (9)

| Step | OAuth Scopes | Endpoints |
| --- | --- | --- |
| Active Directory Group Members | `GroupMember.Read.All` | `https://graph.microsoft.com/v1.0/groups/{groupId}/members` |
| Compliance Policies and Related Findings | `DeviceManagementConfiguration.Read.All` | `https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies`, `https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies/{policyId}/deviceStatuses` |
| Detected Applications | `DeviceManagementManagedDevices.Read.All` | `https://graph.microsoft.com/beta/deviceManagement/manageddevices/{deviceId}` |
| Device Configurations and Related Findings | `DeviceManagementConfiguration.Read.All` | `https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations`, `https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations/{configurationId}/deviceStatuses` |
| Device Health Scripts | `DeviceManagementScripts.Read.All`, `GroupMember.Read.All` | `https://graph.microsoft.com/beta/deviceManagement/deviceHealthScripts`, `https://graph.microsoft.com/beta/deviceManagement/deviceHealthScripts/{scriptId}/assignments`, `https://graph.microsoft.com/v1.0/groups/{groupId}/transitiveMembers` |
| Group Policy Configurations | `DeviceManagementConfiguration.Read.All`, `GroupMember.Read.All` | `https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations`, `https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/{policyId}/definitionValues`, `https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/{policyId}/assignments`, `https://graph.microsoft.com/v1.0/groups/{groupId}/transitiveMembers` |
| Managed Applications | `DeviceManagementApps.Read.All` | `https://graph.microsoft.com/beta/deviceAppManagement/mobileApps`, `https://graph.microsoft.com/v1.0/deviceManagement/reports/microsoft.graph.retrieveDeviceAppInstallationStatusReport` |
| Microsoft 365 Teams App Installations | `TeamsAppInstallation.ReadForTeam.All` | `https://graph.microsoft.com/v1.0/teams/{teamId}/installedApps` |
| Settings Catalog Policies | `DeviceManagementConfiguration.Read.All` | `https://graph.microsoft.com/beta/deviceManagement/configurationPolicies`, `https://graph.microsoft.com/beta/deviceManagement/configurationPolicies/{policyId}/settings`, `https://graph.microsoft.com/beta/deviceManagement/configurationPolicies/{policyId}/deviceStatuses` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| \[AD\] Account | `microsoft_365_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| \[AD\] Group | `azure_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| \[AD\] User | `azure_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| \[Teams\] App Installation | `microsoft_365_teams_app_installation` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| \[Teams\] Team | `microsoft_365_team` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Autopilot Device Identity | `intune_autopilot_device_identity` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Compliance Policy | `intune_compliance_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Detected Application | `intune_detected_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Device Configuration | `intune_device_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Device Health Script | `intune_device_health_script` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Group Policy Configuration | `intune_group_policy_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Intune Host Agent | `intune_host_agent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Managed Application | `intune_managed_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Managed Device | `user_endpoint` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Managed Device | `workstation` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Managed Device | `laptop` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Managed Device | `desktop` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Managed Device | `server` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Managed Device | `server` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Managed Device | `smartphone` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Noncompliance Finding | `intune_noncompliance_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Settings Catalog Policy | `intune_settings_catalog_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `azure_user` | **HAS** | `user_endpoint` |
| `azure_user` | **HAS** | `workstation` |
| `azure_user` | **HAS** | `laptop` |
| `azure_user` | **HAS** | `desktop` |
| `azure_user` | **HAS** | `computer` |
| `azure_user` | **HAS** | `server` |
| `azure_user` | **HAS** | `smartphone` |
| `azure_user` | **USES** | `user_endpoint` |
| `azure_user` | **USES** | `workstation` |
| `azure_user` | **USES** | `laptop` |
| `azure_user` | **USES** | `desktop` |
| `azure_user` | **USES** | `computer` |
| `azure_user` | **USES** | `server` |
| `azure_user` | **USES** | `smartphone` |
| `azure_user_group` | **HAS** | `azure_user` |
| `azure_user_group` | **HAS** | `azure_user_group` |
| `azure_user_group` | **HAS** | `user_endpoint` |
| `azure_user_group` | **HAS** | `workstation` |
| `azure_user_group` | **HAS** | `laptop` |
| `azure_user_group` | **HAS** | `desktop` |
| `azure_user_group` | **HAS** | `computer` |
| `azure_user_group` | **HAS** | `server` |
| `azure_user_group` | **HAS** | `smartphone` |
| `computer` | **HAS** | `intune_noncompliance_finding` |
| `computer` | **ASSIGNED** | `intune_managed_application` |
| `computer` | **INSTALLED** | `intune_detected_application` |
| `desktop` | **HAS** | `intune_noncompliance_finding` |
| `desktop` | **ASSIGNED** | `intune_managed_application` |
| `desktop` | **INSTALLED** | `intune_detected_application` |
| `intune_autopilot_device_identity` | **ASSIGNED** | `azure_user` |
| `intune_compliance_policy` | **IDENTIFIED** | `intune_noncompliance_finding` |
| `intune_device_configuration` | **IDENTIFIED** | `intune_noncompliance_finding` |
| `intune_host_agent` | **MANAGES** | `user_endpoint` |
| `intune_host_agent` | **MANAGES** | `workstation` |
| `intune_host_agent` | **MANAGES** | `laptop` |
| `intune_host_agent` | **MANAGES** | `desktop` |
| `intune_host_agent` | **MANAGES** | `computer` |
| `intune_host_agent` | **MANAGES** | `server` |
| `intune_host_agent` | **MANAGES** | `smartphone` |
| `intune_host_agent` | **ASSIGNED** | `intune_compliance_policy` |
| `intune_host_agent` | **ASSIGNED** | `intune_device_configuration` |
| `intune_host_agent` | **ASSIGNED** | `intune_settings_catalog_policy` |
| `intune_host_agent` | **ASSIGNED** | `intune_group_policy_configuration` |
| `intune_host_agent` | **ASSIGNED** | `intune_device_health_script` |
| `laptop` | **HAS** | `intune_noncompliance_finding` |
| `laptop` | **ASSIGNED** | `intune_managed_application` |
| `laptop` | **INSTALLED** | `intune_detected_application` |
| `microsoft_365_account` | **HAS** | `azure_user` |
| `microsoft_365_account` | **HAS** | `azure_user_group` |
| `microsoft_365_account` | **HAS** | `microsoft_365_team` |
| `microsoft_365_team` | **HAS** | `microsoft_365_teams_app_installation` |
| `server` | **HAS** | `intune_noncompliance_finding` |
| `server` | **ASSIGNED** | `intune_managed_application` |
| `server` | **INSTALLED** | `intune_detected_application` |
| `smartphone` | **HAS** | `intune_noncompliance_finding` |
| `smartphone` | **ASSIGNED** | `intune_managed_application` |
| `smartphone` | **INSTALLED** | `intune_detected_application` |
| `user_endpoint` | **HAS** | `intune_noncompliance_finding` |
| `user_endpoint` | **ASSIGNED** | `intune_managed_application` |
| `user_endpoint` | **INSTALLED** | `intune_detected_application` |
| `workstation` | **HAS** | `intune_noncompliance_finding` |
| `workstation` | **ASSIGNED** | `intune_managed_application` |
| `workstation` | **INSTALLED** | `intune_detected_application` |

### Azure User

`azure_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountEnabled` \*

 | `boolean` |  |  |
| `givenName` | `string` **|** `null` |  |  |
| `jobTitle` | `string` **|** `null` |  |  |
| `mail` | `string` | The SMTP address for the user |  |
| `mobilePhone` | `string` **|** `null` |  |  |
| `officeLocation` | `string` **|** `null` |  |  |
| `preferredLanguage` | `string` **|** `null` |  |  |
| `surname` | `string` **|** `null` |  |  |
| `usageLocation` | `string` **|** `null` |  |  |
| `userPrincipalName` | `string` **|** `null` |  |  |
| `userType` | `string` **|** `null` |  |  |

---

### Azure User Group

`azure_user_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isMailEnabled` \*

 | `boolean` |  |  |
| 

`isSecurityEnabled` \*

 | `boolean` |  |  |
| `mail` | `string` **|** `null` |  |  |
| 

`mailEnabled` \*

 | `boolean` | Please use `isMailEnabled` instead | **deprecated**: true |
| `mailNickname` | `string` **|** `null` |  |  |
| `renewedOn` | `number` |  |  |
| 

`securityEnabled` \*

 | `boolean` | Please use `isSecurityEnabled` instead | **deprecated**: true |

---

### Desktop

`desktop` inherits from [Device](/data-model/schemas/Device.md), [Host](/data-model/schemas/Host.md)

---

### Intune Autopilot Device Identity

`intune_autopilot_device_identity` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `addressableUserName` | `string` **|** `null` |  |  |
| `azureAdDeviceId` | `string` **|** `null` |  |  |
| `deploymentProfileAssignedDateTime` | `number` |  |  |
| `deploymentProfileAssignmentDetailedStatus` | `string` |  | **Any of**:
-   `none`

-   `hardwareRequirementsNotMet`

-   `surfaceHubProfileNotSupported`

-   `holoLensProfileNotSupported`

-   `windowsPcProfileNotSupported`

-   `surfaceHub2SProfileNotSupported`

-   `unknownFutureValue`

 |
| `deploymentProfileAssignmentStatus` | `string` |  | **Any of**:

-   `unknown`

-   `assignedInSync`

-   `assignedOutOfSync`

-   `assignedUnkownSyncState`

-   `notAssigned`

-   `pending`

-   `failed`

 |
| `deviceFriendlyName` | `string` **|** `null` |  |  |
| `enrollmentState` | `string` |  | **Any of**:

-   `unknown`

-   `enrolled`

-   `pendingReset`

-   `failed`

-   `notContacted`

-   `blocked`

 |
| `groupTag` | `string` **|** `null` |  |  |
| `lastContactedDateTime` | `number` |  |  |
| `managedDeviceId` | `string` **|** `null` |  |  |
| `productKey` | `string` **|** `null` |  |  |
| `purchaseOrderIdentifier` | `string` **|** `null` |  |  |
| `skuNumber` | `string` **|** `null` |  |  |
| `userPrincipalName` | `string` **|** `null` |  |  |

---

### Intune Compliance Policy

`intune_compliance_policy` inherits from [Configuration](/data-model/schemas/Configuration.md), [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appLockerApplicationControl` | `string` **|** `null` | AppLocker application control mode. Example values: `notConfigured`, `enforceComponentsAndStoreApps`, `auditComponentsAndStoreApps`, `enforceComponentsStoreAppsAndSmartlocker`, `auditComponentsStoreAppsAndSmartlocker`. |  |
| `bitlockerRemovableDriveEncryptionMethod` | `string` **|** `null` | Encryption algorithm applied to removable drives. Example values: `aesCbc128`, `aesCbc256`, `xtsAes128`, `xtsAes256`. |  |
| `bitlockerSystemDriveEncryptionMethod` | `string` **|** `null` | Encryption algorithm applied to the operating-system drive. Example values: `aesCbc128`, `aesCbc256`, `xtsAes128`, `xtsAes256`. |  |
| 
`category` \*

 | `string` |  | **const**: compliance |
| `defenderCloudBlockLevel` | `string` **|** `null` | Microsoft Defender cloud-block level. Example values: `notConfigured`, `high`, `highPlus`, `zeroTolerance`. |  |
| `diagnosticsDataSubmissionMode` | `string` **|** `null` | Telemetry/diagnostics data submission level. Example values: `userDefined`, `none`, `basic`, `enhanced`, `full`. |  |
| `firewallDomainFirewallState` | `string` **|** `null` | Domain-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| `firewallPrivateFirewallState` | `string` **|** `null` | Private-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| `firewallPublicFirewallState` | `string` **|** `null` | Public-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| 

`function` \*

 | `string` |  | **const**: endpoint-compliance |
| `isActiveFirewallRequired` | `boolean` **|** `null` | Whether an active firewall (any profile) is required for compliance. |  |
| `isAntiSpywareRequired` | `boolean` **|** `null` | Whether an anti-spyware product must be installed and active for compliance. |  |
| `isAntivirusRequired` | `boolean` **|** `null` | Whether an antivirus product (any vendor) must be installed and active for compliance. |  |
| `isApplicationGuardEnabled` | `boolean` **|** `null` | Whether Windows Defender Application Guard is enabled. |  |
| `isAppStoreBlocked` | `boolean` **|** `null` | Whether the platform App Store is blocked entirely (no app install/update from the store). |  |
| `isAppStoreRequirePassword` | `boolean` **|** `null` | Whether the App Store is required to prompt for a password before every purchase / install. |  |
| `isBitlockerEncryptDevice` | `boolean` **|** `null` | Whether BitLocker disk encryption is required on the device. |  |
| `isBitlockerRemovableDriveBlockCrossOrganizationWriteAccess` | `boolean` **|** `null` | Whether the device blocks write access to BitLocker-encrypted drives that were encrypted by another organization. |  |
| `isBitlockerRemovableDriveRequireEncryptionForWriteAccess` | `boolean` **|** `null` | Whether the device blocks write access to removable drives that are not BitLocker-encrypted. |  |
| `isBluetoothBlocked` | `boolean` **|** `null` | Whether Bluetooth is blocked. |  |
| `isCameraBlocked` | `boolean` **|** `null` | Whether the device camera is blocked. |  |
| `isCertificatesBlockUntrustedTlsCertificates` | `boolean` **|** `null` | Whether the device is blocked from accepting untrusted TLS certificates. |  |
| `isCodeIntegrityEnabled` | `boolean` **|** `null` | Whether Windows code integrity (HVCI) is required. |  |
| `isCommercialDataSharingDisabled` | `boolean` **|** `null` | Whether sharing of commercial telemetry data with Microsoft is disabled. |  |
| `isDefenderEnabled` | `boolean` **|** `null` | Whether Microsoft Defender must be enabled (compliance gate). |  |
| `isDefenderRequireBehaviorMonitoring` | `boolean` **|** `null` | Whether Microsoft Defender behavior monitoring is required. |  |
| `isDefenderRequireCloudProtection` | `boolean` **|** `null` | Whether Microsoft Defender cloud-delivered protection is required. |  |
| `isDefenderRequireRealTimeMonitoring` | `boolean` **|** `null` | Whether Microsoft Defender real-time monitoring is required. |  |
| `isDefenderSecurityCenterBlockExploitProtectionOverride` | `boolean` **|** `null` | Whether users are blocked from overriding the configured exploit-protection settings via the Defender Security Center. |  |
| `isEdgeRequireSmartScreen` | `boolean` **|** `null` | Whether Microsoft Edge is required to have SmartScreen enabled. |  |
| `isFileVaultEnabled` | `boolean` **|** `null` | Whether FileVault disk encryption is required on macOS. |  |
| `isFirewallDomainInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Domain firewall profile. |  |
| `isFirewallDomainIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Domain firewall profile. |  |
| `isFirewallDomainOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Domain firewall profile. |  |
| `isFirewallDomainStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Domain firewall profile. |  |
| `isFirewallPrivateInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Private firewall profile. |  |
| `isFirewallPrivateIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Private firewall profile. |  |
| `isFirewallPrivateOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Private firewall profile. |  |
| `isFirewallPrivateStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Private firewall profile. |  |
| `isFirewallPublicInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Public firewall profile. |  |
| `isFirewallPublicIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Public firewall profile. |  |
| `isFirewallPublicOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Public firewall profile. |  |
| `isFirewallPublicStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Public firewall profile. |  |
| `isHealthyDeviceReportRequired` | `boolean` **|** `null` | Whether a recent Windows Health Attestation report is required for compliance. |  |
| `isICloudRequireEncryptedBackup` | `boolean` **|** `null` | Whether iCloud backups must be encrypted (iOS). |  |
| `isLocationServicesBlocked` | `boolean` **|** `null` | Whether device location services are blocked. |  |
| `isMicrophoneBlocked` | `boolean` **|** `null` | Whether the device microphone (or voice recording) is blocked. |  |
| `isMicrosoftAccountBlocked` | `boolean` **|** `null` | Whether sign-in with personal Microsoft accounts is blocked on the device. |  |
| `isOneDriveDisableFileSync` | `boolean` **|** `null` | Whether OneDrive file-sync is disabled on the device. |  |
| `isPasswordBlockFingerprint` | `boolean` **|** `null` | Whether fingerprint unlock (biometric) is blocked. |  |
| `isPasswordBlockSimple` | `boolean` **|** `null` | Whether simple passwords (e.g. repeating or sequential characters such as `1234`, `aaaa`) are blocked. |  |
| `isPasswordBlockSmartCard` | `boolean` **|** `null` | Whether smart-card sign-in is blocked. |  |
| `isPasswordRequired` | `boolean` **|** `null` | Whether the device or user must set a password/passcode to unlock the device. |  |
| `isSafariRequireFraudWarning` | `boolean` **|** `null` | Whether Safari is required to show fraudulent-website warnings (iOS). |  |
| `isScreenCaptureBlocked` | `boolean` **|** `null` | Whether screen capture / screenshots are blocked. |  |
| `isSecureBootEnabled` | `boolean` **|** `null` | Whether UEFI Secure Boot is required to be enabled. |  |
| `isSignatureOutOfDateRequired` | `boolean` **|** `null` | Whether the policy requires AV signatures to be up to date for the device to be considered compliant. |  |
| `isSiriBlockedWhenLocked` | `boolean` **|** `null` | Whether Siri is blocked from being invoked while the device is locked (iOS). |  |
| `isSmartScreenBlockOverrideForFiles` | `boolean` **|** `null` | Whether users are blocked from overriding SmartScreen warnings for files. |  |
| `isSmartScreenEnableInShell` | `boolean` **|** `null` | Whether Windows SmartScreen is enabled in the shell (file open / download warnings). |  |
| `isStorageRequireDeviceEncryption` | `boolean` **|** `null` | Whether device storage (full-disk) encryption is required, regardless of provider (BitLocker on Windows, FileVault on macOS, native on mobile). |  |
| `isTpmRequired` | `boolean` **|** `null` | Whether a Trusted Platform Module (TPM) is required for compliance. |  |
| `isUsbBlocked` | `boolean` **|** `null` | Whether USB connections / mass-storage are blocked. |  |
| `omaSettingCount` | `number` **|** `null` | Number of OMA-URI custom settings present on the policy (Windows custom configurations only). |  |
| `omaUris` | `array` **|** `null` | List of OMA-URI paths configured by the policy (e.g. `./Vendor/MSFT/BitLocker/...`). Useful for grepping which OMA-URIs are managed without inspecting the per-setting values. |  |
| `osMaximumVersion` | `string` **|** `null` | Maximum operating-system version the device may run to be considered compliant. |  |
| `osMinimumVersion` | `string` **|** `null` | Minimum operating-system version the device must run to be considered compliant. |  |
| `passwordExpirationDays` | `number` **|** `null` | Number of days after which the password must be changed. A value of 0 typically means no expiration. |  |
| `passwordMinimumCharacterSetCount` | `number` **|** `null` | Minimum number of distinct character sets (uppercase, lowercase, digits, symbols) the password must include. |  |
| `passwordMinimumLength` | `number` **|** `null` | Minimum number of characters required in the password/passcode. |  |
| `passwordMinutesOfInactivityBeforeLock` | `number` **|** `null` | Minutes of idle time before the device locks automatically. |  |
| `passwordMinutesOfInactivityBeforeScreenTimeout` | `number` **|** `null` | Minutes of idle time before the screen times out (display sleep). |  |
| `passwordPreviousPasswordBlockCount` | `number` **|** `null` | Number of previous passwords the user is blocked from reusing. |  |
| `passwordRequiredType` | `string` **|** `null` | The complexity class the password must satisfy. Example values: `deviceDefault`, `alphanumeric`, `numeric`, `alphabetic`, `alphanumericWithSymbols`. |  |
| `passwordSignInFailureCountBeforeFactoryReset` | `number` **|** `null` | Number of consecutive failed sign-in attempts that triggers an automatic factory reset of the device. |  |
| `policyType` | `string` | **Examples**: iosCompliancePolicy |  |
| `version` | `number` |  |  |

---

### Intune Detected Application

`intune_detected_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `sizeInByte` | `number` |  |  |
| `version` | `string` **|** `null` |  |  |

---

### Intune Device Configuration

`intune_device_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md), [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appLockerApplicationControl` | `string` **|** `null` | AppLocker application control mode. Example values: `notConfigured`, `enforceComponentsAndStoreApps`, `auditComponentsAndStoreApps`, `enforceComponentsStoreAppsAndSmartlocker`, `auditComponentsStoreAppsAndSmartlocker`. |  |
| `bitlockerRemovableDriveEncryptionMethod` | `string` **|** `null` | Encryption algorithm applied to removable drives. Example values: `aesCbc128`, `aesCbc256`, `xtsAes128`, `xtsAes256`. |  |
| `bitlockerSystemDriveEncryptionMethod` | `string` **|** `null` | Encryption algorithm applied to the operating-system drive. Example values: `aesCbc128`, `aesCbc256`, `xtsAes128`, `xtsAes256`. |  |
| 
`category` \*

 | `string` |  | **const**: config |
| `configurationType` | `string` | **Examples**: iosCustomConfiguration, windows10GeneralConfiguration, iosWiFiConfiguration |  |
| `defenderCloudBlockLevel` | `string` **|** `null` | Microsoft Defender cloud-block level. Example values: `notConfigured`, `high`, `highPlus`, `zeroTolerance`. |  |
| `diagnosticsDataSubmissionMode` | `string` **|** `null` | Telemetry/diagnostics data submission level. Example values: `userDefined`, `none`, `basic`, `enhanced`, `full`. |  |
| `firewallDomainFirewallState` | `string` **|** `null` | Domain-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| `firewallPrivateFirewallState` | `string` **|** `null` | Private-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| `firewallPublicFirewallState` | `string` **|** `null` | Public-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| 

`function` \*

 | `string` |  | **const**: endpoint-configuration |
| `isActiveFirewallRequired` | `boolean` **|** `null` | Whether an active firewall (any profile) is required for compliance. |  |
| `isAntiSpywareRequired` | `boolean` **|** `null` | Whether an anti-spyware product must be installed and active for compliance. |  |
| `isAntivirusRequired` | `boolean` **|** `null` | Whether an antivirus product (any vendor) must be installed and active for compliance. |  |
| `isApplicationGuardEnabled` | `boolean` **|** `null` | Whether Windows Defender Application Guard is enabled. |  |
| `isAppStoreBlocked` | `boolean` **|** `null` | Whether the platform App Store is blocked entirely (no app install/update from the store). |  |
| `isAppStoreRequirePassword` | `boolean` **|** `null` | Whether the App Store is required to prompt for a password before every purchase / install. |  |
| `isBitlockerEncryptDevice` | `boolean` **|** `null` | Whether BitLocker disk encryption is required on the device. |  |
| `isBitlockerRemovableDriveBlockCrossOrganizationWriteAccess` | `boolean` **|** `null` | Whether the device blocks write access to BitLocker-encrypted drives that were encrypted by another organization. |  |
| `isBitlockerRemovableDriveRequireEncryptionForWriteAccess` | `boolean` **|** `null` | Whether the device blocks write access to removable drives that are not BitLocker-encrypted. |  |
| `isBluetoothBlocked` | `boolean` **|** `null` | Whether Bluetooth is blocked. |  |
| `isCameraBlocked` | `boolean` **|** `null` | Whether the device camera is blocked. |  |
| `isCertificatesBlockUntrustedTlsCertificates` | `boolean` **|** `null` | Whether the device is blocked from accepting untrusted TLS certificates. |  |
| `isCodeIntegrityEnabled` | `boolean` **|** `null` | Whether Windows code integrity (HVCI) is required. |  |
| `isCommercialDataSharingDisabled` | `boolean` **|** `null` | Whether sharing of commercial telemetry data with Microsoft is disabled. |  |
| `isDefenderEnabled` | `boolean` **|** `null` | Whether Microsoft Defender must be enabled (compliance gate). |  |
| `isDefenderRequireBehaviorMonitoring` | `boolean` **|** `null` | Whether Microsoft Defender behavior monitoring is required. |  |
| `isDefenderRequireCloudProtection` | `boolean` **|** `null` | Whether Microsoft Defender cloud-delivered protection is required. |  |
| `isDefenderRequireRealTimeMonitoring` | `boolean` **|** `null` | Whether Microsoft Defender real-time monitoring is required. |  |
| `isDefenderSecurityCenterBlockExploitProtectionOverride` | `boolean` **|** `null` | Whether users are blocked from overriding the configured exploit-protection settings via the Defender Security Center. |  |
| `isEdgeRequireSmartScreen` | `boolean` **|** `null` | Whether Microsoft Edge is required to have SmartScreen enabled. |  |
| `isFileVaultEnabled` | `boolean` **|** `null` | Whether FileVault disk encryption is required on macOS. |  |
| `isFirewallDomainInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Domain firewall profile. |  |
| `isFirewallDomainIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Domain firewall profile. |  |
| `isFirewallDomainOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Domain firewall profile. |  |
| `isFirewallDomainStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Domain firewall profile. |  |
| `isFirewallPrivateInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Private firewall profile. |  |
| `isFirewallPrivateIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Private firewall profile. |  |
| `isFirewallPrivateOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Private firewall profile. |  |
| `isFirewallPrivateStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Private firewall profile. |  |
| `isFirewallPublicInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Public firewall profile. |  |
| `isFirewallPublicIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Public firewall profile. |  |
| `isFirewallPublicOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Public firewall profile. |  |
| `isFirewallPublicStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Public firewall profile. |  |
| `isHealthyDeviceReportRequired` | `boolean` **|** `null` | Whether a recent Windows Health Attestation report is required for compliance. |  |
| `isICloudRequireEncryptedBackup` | `boolean` **|** `null` | Whether iCloud backups must be encrypted (iOS). |  |
| `isLocationServicesBlocked` | `boolean` **|** `null` | Whether device location services are blocked. |  |
| `isMicrophoneBlocked` | `boolean` **|** `null` | Whether the device microphone (or voice recording) is blocked. |  |
| `isMicrosoftAccountBlocked` | `boolean` **|** `null` | Whether sign-in with personal Microsoft accounts is blocked on the device. |  |
| `isOneDriveDisableFileSync` | `boolean` **|** `null` | Whether OneDrive file-sync is disabled on the device. |  |
| `isPasswordBlockFingerprint` | `boolean` **|** `null` | Whether fingerprint unlock (biometric) is blocked. |  |
| `isPasswordBlockSimple` | `boolean` **|** `null` | Whether simple passwords (e.g. repeating or sequential characters such as `1234`, `aaaa`) are blocked. |  |
| `isPasswordBlockSmartCard` | `boolean` **|** `null` | Whether smart-card sign-in is blocked. |  |
| `isPasswordRequired` | `boolean` **|** `null` | Whether the device or user must set a password/passcode to unlock the device. |  |
| `isSafariRequireFraudWarning` | `boolean` **|** `null` | Whether Safari is required to show fraudulent-website warnings (iOS). |  |
| `isScreenCaptureBlocked` | `boolean` **|** `null` | Whether screen capture / screenshots are blocked. |  |
| `isSecureBootEnabled` | `boolean` **|** `null` | Whether UEFI Secure Boot is required to be enabled. |  |
| `isSignatureOutOfDateRequired` | `boolean` **|** `null` | Whether the policy requires AV signatures to be up to date for the device to be considered compliant. |  |
| `isSiriBlockedWhenLocked` | `boolean` **|** `null` | Whether Siri is blocked from being invoked while the device is locked (iOS). |  |
| `isSmartScreenBlockOverrideForFiles` | `boolean` **|** `null` | Whether users are blocked from overriding SmartScreen warnings for files. |  |
| `isSmartScreenEnableInShell` | `boolean` **|** `null` | Whether Windows SmartScreen is enabled in the shell (file open / download warnings). |  |
| `isStorageRequireDeviceEncryption` | `boolean` **|** `null` | Whether device storage (full-disk) encryption is required, regardless of provider (BitLocker on Windows, FileVault on macOS, native on mobile). |  |
| `isTpmRequired` | `boolean` **|** `null` | Whether a Trusted Platform Module (TPM) is required for compliance. |  |
| `isUsbBlocked` | `boolean` **|** `null` | Whether USB connections / mass-storage are blocked. |  |
| `omaSettingCount` | `number` **|** `null` | Number of OMA-URI custom settings present on the policy (Windows custom configurations only). |  |
| `omaUris` | `array` **|** `null` | List of OMA-URI paths configured by the policy (e.g. `./Vendor/MSFT/BitLocker/...`). Useful for grepping which OMA-URIs are managed without inspecting the per-setting values. |  |
| `osMaximumVersion` | `string` **|** `null` | Maximum operating-system version the device may run to be considered compliant. |  |
| `osMinimumVersion` | `string` **|** `null` | Minimum operating-system version the device must run to be considered compliant. |  |
| `passwordExpirationDays` | `number` **|** `null` | Number of days after which the password must be changed. A value of 0 typically means no expiration. |  |
| `passwordMinimumCharacterSetCount` | `number` **|** `null` | Minimum number of distinct character sets (uppercase, lowercase, digits, symbols) the password must include. |  |
| `passwordMinimumLength` | `number` **|** `null` | Minimum number of characters required in the password/passcode. |  |
| `passwordMinutesOfInactivityBeforeLock` | `number` **|** `null` | Minutes of idle time before the device locks automatically. |  |
| `passwordMinutesOfInactivityBeforeScreenTimeout` | `number` **|** `null` | Minutes of idle time before the screen times out (display sleep). |  |
| `passwordPreviousPasswordBlockCount` | `number` **|** `null` | Number of previous passwords the user is blocked from reusing. |  |
| `passwordRequiredType` | `string` **|** `null` | The complexity class the password must satisfy. Example values: `deviceDefault`, `alphanumeric`, `numeric`, `alphabetic`, `alphanumericWithSymbols`. |  |
| `passwordSignInFailureCountBeforeFactoryReset` | `number` **|** `null` | Number of consecutive failed sign-in attempts that triggers an automatic factory reset of the device. |  |
| `version` | `number` |  |  |

---

### Intune Device Health Script

`intune_device_health_script` inherits from [Configuration](/data-model/schemas/Configuration.md), [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` |  | **const**: config |
| `detectionScriptParameterCount` | `number` **|** `null` | Number of parameters defined on the detection script. The parameter values themselves are intentionally not surfaced. |  |
| `deviceHealthScriptType` | `string` **|** `null` | Microsoft-assigned type discriminator for the health script. Example values: `deviceHealthScript`, `managedInstallerScript`. |  |
| 

`function` \*

 | `string` |  | **const**: endpoint-configuration |
| `isGlobalScript` | `boolean` **|** `null` | Whether this is a Microsoft-published global script (visible to all tenants) vs a tenant-authored script. |  |
| `isRunAs32Bit` | `boolean` **|** `null` | Whether the script is executed as a 32-bit process (vs the native 64-bit PowerShell host) on 64-bit Windows. |  |
| `isSignatureCheckEnforced` | `boolean` **|** `null` | Whether the script must be code-signed and validated against an Intune-configured signing certificate before the device will execute it. |  |
| `publisher` | `string` **|** `null` | Publisher of the Device Health Script (Proactive Remediation). For Microsoft-shipped scripts, this is typically `Microsoft`; for custom scripts, the org that authored them. |  |
| `remediationScriptParameterCount` | `number` **|** `null` | Number of parameters defined on the remediation script. The parameter values themselves are intentionally not surfaced. |  |
| `roleScopeTagIds` | `array` **|** `null` | Intune RBAC scope tag IDs associated with this Device Health Script. Used to limit which administrators can view/edit the script. |  |
| `runAsAccount` | `string` **|** `null` | Account context the script runs under on the endpoint. Example values: `system`, `user`. |  |
| `version` | `string` **|** `null` | Version string declared by the script author for this Device Health Script. |  |

---

### Intune Group Policy Configuration

`intune_group_policy_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md), [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appLockerApplicationControl` | `string` **|** `null` | AppLocker application control mode. Example values: `notConfigured`, `enforceComponentsAndStoreApps`, `auditComponentsAndStoreApps`, `enforceComponentsStoreAppsAndSmartlocker`, `auditComponentsStoreAppsAndSmartlocker`. |  |
| `bitlockerRemovableDriveEncryptionMethod` | `string` **|** `null` | Encryption algorithm applied to removable drives. Example values: `aesCbc128`, `aesCbc256`, `xtsAes128`, `xtsAes256`. |  |
| `bitlockerSystemDriveEncryptionMethod` | `string` **|** `null` | Encryption algorithm applied to the operating-system drive. Example values: `aesCbc128`, `aesCbc256`, `xtsAes128`, `xtsAes256`. |  |
| 
`category` \*

 | `string` |  | **const**: config |
| `defenderCloudBlockLevel` | `string` **|** `null` | Microsoft Defender cloud-block level. Example values: `notConfigured`, `high`, `highPlus`, `zeroTolerance`. |  |
| `definitionValueCount` | `number` **|** `null` | Number of ADMX `definitionValue` settings configured by this Group Policy configuration. Each `definitionValue` corresponds to one Group Policy setting that has been set. |  |
| `diagnosticsDataSubmissionMode` | `string` **|** `null` | Telemetry/diagnostics data submission level. Example values: `userDefined`, `none`, `basic`, `enhanced`, `full`. |  |
| `firewallDomainFirewallState` | `string` **|** `null` | Domain-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| `firewallPrivateFirewallState` | `string` **|** `null` | Private-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| `firewallPublicFirewallState` | `string` **|** `null` | Public-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| 

`function` \*

 | `string` |  | **const**: endpoint-configuration |
| `isActiveFirewallRequired` | `boolean` **|** `null` | Whether an active firewall (any profile) is required for compliance. |  |
| `isAntiSpywareRequired` | `boolean` **|** `null` | Whether an anti-spyware product must be installed and active for compliance. |  |
| `isAntivirusRequired` | `boolean` **|** `null` | Whether an antivirus product (any vendor) must be installed and active for compliance. |  |
| `isApplicationGuardEnabled` | `boolean` **|** `null` | Whether Windows Defender Application Guard is enabled. |  |
| `isAppStoreBlocked` | `boolean` **|** `null` | Whether the platform App Store is blocked entirely (no app install/update from the store). |  |
| `isAppStoreRequirePassword` | `boolean` **|** `null` | Whether the App Store is required to prompt for a password before every purchase / install. |  |
| `isBitlockerEncryptDevice` | `boolean` **|** `null` | Whether BitLocker disk encryption is required on the device. |  |
| `isBitlockerRemovableDriveBlockCrossOrganizationWriteAccess` | `boolean` **|** `null` | Whether the device blocks write access to BitLocker-encrypted drives that were encrypted by another organization. |  |
| `isBitlockerRemovableDriveRequireEncryptionForWriteAccess` | `boolean` **|** `null` | Whether the device blocks write access to removable drives that are not BitLocker-encrypted. |  |
| `isBluetoothBlocked` | `boolean` **|** `null` | Whether Bluetooth is blocked. |  |
| `isCameraBlocked` | `boolean` **|** `null` | Whether the device camera is blocked. |  |
| `isCertificatesBlockUntrustedTlsCertificates` | `boolean` **|** `null` | Whether the device is blocked from accepting untrusted TLS certificates. |  |
| `isCodeIntegrityEnabled` | `boolean` **|** `null` | Whether Windows code integrity (HVCI) is required. |  |
| `isCommercialDataSharingDisabled` | `boolean` **|** `null` | Whether sharing of commercial telemetry data with Microsoft is disabled. |  |
| `isDefenderEnabled` | `boolean` **|** `null` | Whether Microsoft Defender must be enabled (compliance gate). |  |
| `isDefenderRequireBehaviorMonitoring` | `boolean` **|** `null` | Whether Microsoft Defender behavior monitoring is required. |  |
| `isDefenderRequireCloudProtection` | `boolean` **|** `null` | Whether Microsoft Defender cloud-delivered protection is required. |  |
| `isDefenderRequireRealTimeMonitoring` | `boolean` **|** `null` | Whether Microsoft Defender real-time monitoring is required. |  |
| `isDefenderSecurityCenterBlockExploitProtectionOverride` | `boolean` **|** `null` | Whether users are blocked from overriding the configured exploit-protection settings via the Defender Security Center. |  |
| `isEdgeRequireSmartScreen` | `boolean` **|** `null` | Whether Microsoft Edge is required to have SmartScreen enabled. |  |
| `isFileVaultEnabled` | `boolean` **|** `null` | Whether FileVault disk encryption is required on macOS. |  |
| `isFirewallDomainInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Domain firewall profile. |  |
| `isFirewallDomainIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Domain firewall profile. |  |
| `isFirewallDomainOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Domain firewall profile. |  |
| `isFirewallDomainStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Domain firewall profile. |  |
| `isFirewallPrivateInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Private firewall profile. |  |
| `isFirewallPrivateIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Private firewall profile. |  |
| `isFirewallPrivateOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Private firewall profile. |  |
| `isFirewallPrivateStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Private firewall profile. |  |
| `isFirewallPublicInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Public firewall profile. |  |
| `isFirewallPublicIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Public firewall profile. |  |
| `isFirewallPublicOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Public firewall profile. |  |
| `isFirewallPublicStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Public firewall profile. |  |
| `isHealthyDeviceReportRequired` | `boolean` **|** `null` | Whether a recent Windows Health Attestation report is required for compliance. |  |
| `isICloudRequireEncryptedBackup` | `boolean` **|** `null` | Whether iCloud backups must be encrypted (iOS). |  |
| `isLocationServicesBlocked` | `boolean` **|** `null` | Whether device location services are blocked. |  |
| `isMicrophoneBlocked` | `boolean` **|** `null` | Whether the device microphone (or voice recording) is blocked. |  |
| `isMicrosoftAccountBlocked` | `boolean` **|** `null` | Whether sign-in with personal Microsoft accounts is blocked on the device. |  |
| `isOneDriveDisableFileSync` | `boolean` **|** `null` | Whether OneDrive file-sync is disabled on the device. |  |
| `isPasswordBlockFingerprint` | `boolean` **|** `null` | Whether fingerprint unlock (biometric) is blocked. |  |
| `isPasswordBlockSimple` | `boolean` **|** `null` | Whether simple passwords (e.g. repeating or sequential characters such as `1234`, `aaaa`) are blocked. |  |
| `isPasswordBlockSmartCard` | `boolean` **|** `null` | Whether smart-card sign-in is blocked. |  |
| `isPasswordRequired` | `boolean` **|** `null` | Whether the device or user must set a password/passcode to unlock the device. |  |
| `isSafariRequireFraudWarning` | `boolean` **|** `null` | Whether Safari is required to show fraudulent-website warnings (iOS). |  |
| `isScreenCaptureBlocked` | `boolean` **|** `null` | Whether screen capture / screenshots are blocked. |  |
| `isSecureBootEnabled` | `boolean` **|** `null` | Whether UEFI Secure Boot is required to be enabled. |  |
| `isSignatureOutOfDateRequired` | `boolean` **|** `null` | Whether the policy requires AV signatures to be up to date for the device to be considered compliant. |  |
| `isSiriBlockedWhenLocked` | `boolean` **|** `null` | Whether Siri is blocked from being invoked while the device is locked (iOS). |  |
| `isSmartScreenBlockOverrideForFiles` | `boolean` **|** `null` | Whether users are blocked from overriding SmartScreen warnings for files. |  |
| `isSmartScreenEnableInShell` | `boolean` **|** `null` | Whether Windows SmartScreen is enabled in the shell (file open / download warnings). |  |
| `isStorageRequireDeviceEncryption` | `boolean` **|** `null` | Whether device storage (full-disk) encryption is required, regardless of provider (BitLocker on Windows, FileVault on macOS, native on mobile). |  |
| `isTpmRequired` | `boolean` **|** `null` | Whether a Trusted Platform Module (TPM) is required for compliance. |  |
| `isUsbBlocked` | `boolean` **|** `null` | Whether USB connections / mass-storage are blocked. |  |
| `omaSettingCount` | `number` **|** `null` | Number of OMA-URI custom settings present on the policy (Windows custom configurations only). |  |
| `omaUris` | `array` **|** `null` | List of OMA-URI paths configured by the policy (e.g. `./Vendor/MSFT/BitLocker/...`). Useful for grepping which OMA-URIs are managed without inspecting the per-setting values. |  |
| `osMaximumVersion` | `string` **|** `null` | Maximum operating-system version the device may run to be considered compliant. |  |
| `osMinimumVersion` | `string` **|** `null` | Minimum operating-system version the device must run to be considered compliant. |  |
| `passwordExpirationDays` | `number` **|** `null` | Number of days after which the password must be changed. A value of 0 typically means no expiration. |  |
| `passwordMinimumCharacterSetCount` | `number` **|** `null` | Minimum number of distinct character sets (uppercase, lowercase, digits, symbols) the password must include. |  |
| `passwordMinimumLength` | `number` **|** `null` | Minimum number of characters required in the password/passcode. |  |
| `passwordMinutesOfInactivityBeforeLock` | `number` **|** `null` | Minutes of idle time before the device locks automatically. |  |
| `passwordMinutesOfInactivityBeforeScreenTimeout` | `number` **|** `null` | Minutes of idle time before the screen times out (display sleep). |  |
| `passwordPreviousPasswordBlockCount` | `number` **|** `null` | Number of previous passwords the user is blocked from reusing. |  |
| `passwordRequiredType` | `string` **|** `null` | The complexity class the password must satisfy. Example values: `deviceDefault`, `alphanumeric`, `numeric`, `alphabetic`, `alphanumericWithSymbols`. |  |
| `passwordSignInFailureCountBeforeFactoryReset` | `number` **|** `null` | Number of consecutive failed sign-in attempts that triggers an automatic factory reset of the device. |  |
| `policyConfigurationIngestionType` | `string` **|** `null` | How the Group Policy configuration was authored or imported. Example values: `unknown`, `builtIn`, `custom`, `mixed`. |  |
| `roleScopeTagIds` | `array` **|** `null` | Intune RBAC scope tag IDs associated with this Group Policy configuration. Used to limit which administrators can view/edit the policy. |  |

---

### Intune Host Agent

`intune_host_agent` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `complianceState` | `string` |  | **Any of**:
-   `unknown`

-   `compliant`

-   `noncompliant`

-   `conflict`

-   `error`

-   `inGracePeriod`

-   `configManager`

 |
| `compliant` | `boolean` | Please use `isCompliant` instead | **deprecated**: true |
| `isCompliant` | `boolean` |  |  |
| `managementAgent` | `string` | Management channel of the device.  
  
**Examples**: eas, mdm, easMdm, intuneClient, easIntuneClient, jamf, googleCloudDevicePolicyController |  |
| `registrationState` | `string` |  | **Any of**:

-   `notRegistered`

-   `registered`

-   `revoked`

-   `keyConflict`

-   `approvalPending`

-   `certificateReset`

-   `notRegisteredPendingEnrollment`

-   `unknown`

 |
| `state` | `string` |  | **Any of**:

-   `managed`

-   `retirePending`

-   `retireFailed`

-   `wipePending`

-   `wipeFailed`

-   `unhealthy`

-   `deletePending`

-   `retireIssued`

-   `wipeIssued`

-   `wipeCanceled`

-   `retireCanceled`

-   `discovered`

 |

---

### Intune Managed Application

`intune_managed_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `committedContentVersion` | `string` **|** `null` |  |  |
| `developer` | `string` **|** `null` | Most often the same as the owner |  |
| `featured` | `boolean` | Please use `isFeatured` instead | **deprecated**: true |
| `informationURL` | `string` **|** `null` |  |  |
| `isFeatured` | `boolean` | Indicates that this app is being featured on the Company Portal |  |
| 
`isPublished` \*

 | `boolean` |  |  |
| `lastUpdatedOn` | `number` |  |  |
| `packageId` | `string` **|** `null` |  |  |
| `privacyInformationURL` | `string` **|** `null` |  |  |
| `publisher` | `string` **|** `null` |  |  |
| `version` | `string` **|** `null` |  |  |

---

### Intune Noncompliance Finding

`intune_noncompliance_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` |  | **const**: endpoint |
| `id` | `string` |  |  |
| `lastProcessedOn` | `number` |  |  |
| `lastTestedOn` | `number` |  |  |
| `lastUpdatedOn` | `number` |  |  |
| `status` | `string` |  | **Any of**:

-   `unknown`

-   `notApplicable`

-   `compliant`

-   `remediated`

-   `nonCompliant`

-   `error`

-   `conflict`

-   `notAssigned`

 |

---

### Intune Settings Catalog Policy

`intune_settings_catalog_policy` inherits from [Configuration](/data-model/schemas/Configuration.md), [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appLockerApplicationControl` | `string` **|** `null` | AppLocker application control mode. Example values: `notConfigured`, `enforceComponentsAndStoreApps`, `auditComponentsAndStoreApps`, `enforceComponentsStoreAppsAndSmartlocker`, `auditComponentsStoreAppsAndSmartlocker`. |  |
| `bitlockerRemovableDriveEncryptionMethod` | `string` **|** `null` | Encryption algorithm applied to removable drives. Example values: `aesCbc128`, `aesCbc256`, `xtsAes128`, `xtsAes256`. |  |
| `bitlockerSystemDriveEncryptionMethod` | `string` **|** `null` | Encryption algorithm applied to the operating-system drive. Example values: `aesCbc128`, `aesCbc256`, `xtsAes128`, `xtsAes256`. |  |
| 
`category` \*

 | `string` |  | **const**: config |
| `creationSource` | `string` **|** `null` | How the policy was created (e.g. via the Settings Catalog UI, imported template, or via the API). |  |
| `defenderCloudBlockLevel` | `string` **|** `null` | Microsoft Defender cloud-block level. Example values: `notConfigured`, `high`, `highPlus`, `zeroTolerance`. |  |
| `diagnosticsDataSubmissionMode` | `string` **|** `null` | Telemetry/diagnostics data submission level. Example values: `userDefined`, `none`, `basic`, `enhanced`, `full`. |  |
| `firewallDomainFirewallState` | `string` **|** `null` | Domain-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| `firewallPrivateFirewallState` | `string` **|** `null` | Private-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| `firewallPublicFirewallState` | `string` **|** `null` | Public-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| 

`function` \*

 | `string` |  | **const**: endpoint-configuration |
| `isActiveFirewallRequired` | `boolean` **|** `null` | Whether an active firewall (any profile) is required for compliance. |  |
| `isAntiSpywareRequired` | `boolean` **|** `null` | Whether an anti-spyware product must be installed and active for compliance. |  |
| `isAntivirusRequired` | `boolean` **|** `null` | Whether an antivirus product (any vendor) must be installed and active for compliance. |  |
| `isApplicationGuardEnabled` | `boolean` **|** `null` | Whether Windows Defender Application Guard is enabled. |  |
| `isAppStoreBlocked` | `boolean` **|** `null` | Whether the platform App Store is blocked entirely (no app install/update from the store). |  |
| `isAppStoreRequirePassword` | `boolean` **|** `null` | Whether the App Store is required to prompt for a password before every purchase / install. |  |
| `isAssigned` | `boolean` **|** `null` | Whether the policy currently has at least one assignment defined in Intune. |  |
| `isBitlockerEncryptDevice` | `boolean` **|** `null` | Whether BitLocker disk encryption is required on the device. |  |
| `isBitlockerRemovableDriveBlockCrossOrganizationWriteAccess` | `boolean` **|** `null` | Whether the device blocks write access to BitLocker-encrypted drives that were encrypted by another organization. |  |
| `isBitlockerRemovableDriveRequireEncryptionForWriteAccess` | `boolean` **|** `null` | Whether the device blocks write access to removable drives that are not BitLocker-encrypted. |  |
| `isBluetoothBlocked` | `boolean` **|** `null` | Whether Bluetooth is blocked. |  |
| `isCameraBlocked` | `boolean` **|** `null` | Whether the device camera is blocked. |  |
| `isCertificatesBlockUntrustedTlsCertificates` | `boolean` **|** `null` | Whether the device is blocked from accepting untrusted TLS certificates. |  |
| `isCodeIntegrityEnabled` | `boolean` **|** `null` | Whether Windows code integrity (HVCI) is required. |  |
| `isCommercialDataSharingDisabled` | `boolean` **|** `null` | Whether sharing of commercial telemetry data with Microsoft is disabled. |  |
| `isDefenderEnabled` | `boolean` **|** `null` | Whether Microsoft Defender must be enabled (compliance gate). |  |
| `isDefenderRequireBehaviorMonitoring` | `boolean` **|** `null` | Whether Microsoft Defender behavior monitoring is required. |  |
| `isDefenderRequireCloudProtection` | `boolean` **|** `null` | Whether Microsoft Defender cloud-delivered protection is required. |  |
| `isDefenderRequireRealTimeMonitoring` | `boolean` **|** `null` | Whether Microsoft Defender real-time monitoring is required. |  |
| `isDefenderSecurityCenterBlockExploitProtectionOverride` | `boolean` **|** `null` | Whether users are blocked from overriding the configured exploit-protection settings via the Defender Security Center. |  |
| `isEdgeRequireSmartScreen` | `boolean` **|** `null` | Whether Microsoft Edge is required to have SmartScreen enabled. |  |
| `isFileVaultEnabled` | `boolean` **|** `null` | Whether FileVault disk encryption is required on macOS. |  |
| `isFirewallDomainInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Domain firewall profile. |  |
| `isFirewallDomainIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Domain firewall profile. |  |
| `isFirewallDomainOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Domain firewall profile. |  |
| `isFirewallDomainStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Domain firewall profile. |  |
| `isFirewallPrivateInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Private firewall profile. |  |
| `isFirewallPrivateIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Private firewall profile. |  |
| `isFirewallPrivateOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Private firewall profile. |  |
| `isFirewallPrivateStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Private firewall profile. |  |
| `isFirewallPublicInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Public firewall profile. |  |
| `isFirewallPublicIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Public firewall profile. |  |
| `isFirewallPublicOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Public firewall profile. |  |
| `isFirewallPublicStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Public firewall profile. |  |
| `isHealthyDeviceReportRequired` | `boolean` **|** `null` | Whether a recent Windows Health Attestation report is required for compliance. |  |
| `isICloudRequireEncryptedBackup` | `boolean` **|** `null` | Whether iCloud backups must be encrypted (iOS). |  |
| `isLocationServicesBlocked` | `boolean` **|** `null` | Whether device location services are blocked. |  |
| `isMicrophoneBlocked` | `boolean` **|** `null` | Whether the device microphone (or voice recording) is blocked. |  |
| `isMicrosoftAccountBlocked` | `boolean` **|** `null` | Whether sign-in with personal Microsoft accounts is blocked on the device. |  |
| `isOneDriveDisableFileSync` | `boolean` **|** `null` | Whether OneDrive file-sync is disabled on the device. |  |
| `isPasswordBlockFingerprint` | `boolean` **|** `null` | Whether fingerprint unlock (biometric) is blocked. |  |
| `isPasswordBlockSimple` | `boolean` **|** `null` | Whether simple passwords (e.g. repeating or sequential characters such as `1234`, `aaaa`) are blocked. |  |
| `isPasswordBlockSmartCard` | `boolean` **|** `null` | Whether smart-card sign-in is blocked. |  |
| `isPasswordRequired` | `boolean` **|** `null` | Whether the device or user must set a password/passcode to unlock the device. |  |
| `isSafariRequireFraudWarning` | `boolean` **|** `null` | Whether Safari is required to show fraudulent-website warnings (iOS). |  |
| `isScreenCaptureBlocked` | `boolean` **|** `null` | Whether screen capture / screenshots are blocked. |  |
| `isSecureBootEnabled` | `boolean` **|** `null` | Whether UEFI Secure Boot is required to be enabled. |  |
| `isSignatureOutOfDateRequired` | `boolean` **|** `null` | Whether the policy requires AV signatures to be up to date for the device to be considered compliant. |  |
| `isSiriBlockedWhenLocked` | `boolean` **|** `null` | Whether Siri is blocked from being invoked while the device is locked (iOS). |  |
| `isSmartScreenBlockOverrideForFiles` | `boolean` **|** `null` | Whether users are blocked from overriding SmartScreen warnings for files. |  |
| `isSmartScreenEnableInShell` | `boolean` **|** `null` | Whether Windows SmartScreen is enabled in the shell (file open / download warnings). |  |
| `isStorageRequireDeviceEncryption` | `boolean` **|** `null` | Whether device storage (full-disk) encryption is required, regardless of provider (BitLocker on Windows, FileVault on macOS, native on mobile). |  |
| `isTpmRequired` | `boolean` **|** `null` | Whether a Trusted Platform Module (TPM) is required for compliance. |  |
| `isUsbBlocked` | `boolean` **|** `null` | Whether USB connections / mass-storage are blocked. |  |
| `omaSettingCount` | `number` **|** `null` | Number of OMA-URI custom settings present on the policy (Windows custom configurations only). |  |
| `omaUris` | `array` **|** `null` | List of OMA-URI paths configured by the policy (e.g. `./Vendor/MSFT/BitLocker/...`). Useful for grepping which OMA-URIs are managed without inspecting the per-setting values. |  |
| `osMaximumVersion` | `string` **|** `null` | Maximum operating-system version the device may run to be considered compliant. |  |
| `osMinimumVersion` | `string` **|** `null` | Minimum operating-system version the device must run to be considered compliant. |  |
| `passwordExpirationDays` | `number` **|** `null` | Number of days after which the password must be changed. A value of 0 typically means no expiration. |  |
| `passwordMinimumCharacterSetCount` | `number` **|** `null` | Minimum number of distinct character sets (uppercase, lowercase, digits, symbols) the password must include. |  |
| `passwordMinimumLength` | `number` **|** `null` | Minimum number of characters required in the password/passcode. |  |
| `passwordMinutesOfInactivityBeforeLock` | `number` **|** `null` | Minutes of idle time before the device locks automatically. |  |
| `passwordMinutesOfInactivityBeforeScreenTimeout` | `number` **|** `null` | Minutes of idle time before the screen times out (display sleep). |  |
| `passwordPreviousPasswordBlockCount` | `number` **|** `null` | Number of previous passwords the user is blocked from reusing. |  |
| `passwordRequiredType` | `string` **|** `null` | The complexity class the password must satisfy. Example values: `deviceDefault`, `alphanumeric`, `numeric`, `alphabetic`, `alphanumericWithSymbols`. |  |
| `passwordSignInFailureCountBeforeFactoryReset` | `number` **|** `null` | Number of consecutive failed sign-in attempts that triggers an automatic factory reset of the device. |  |
| `platforms` | `string` **|** `null` | Platforms the Settings Catalog policy targets. Example values: `windows10`, `macOS`, `iOS`, `android`, `androidEnterprise`. |  |
| `priority` | `number` **|** `null` | Priority assigned to this policy by Intune for conflict resolution. Lower numeric values typically indicate higher priority. |  |
| `roleScopeTagIds` | `array` **|** `null` | Intune RBAC scope tag IDs associated with this policy. Used to limit which administrators can view/edit the policy. |  |
| `settingCount` | `number` **|** `null` | Number of settings configured by this Settings Catalog policy. |  |
| `technologies` | `string` **|** `null` | Comma-separated list of management technologies the policy applies through. Example values: `mdm`, `windows10XManagement`, `configManager`, `microsoftSense`. |  |
| `templateDisplayName` | `string` **|** `null` | Display name of the Settings Catalog template this policy was instantiated from, when applicable. |  |
| `templateDisplayVersion` | `string` **|** `null` | Display version of the Settings Catalog template this policy was instantiated from, when applicable. |  |
| `templateFamily` | `string` **|** `null` | Template family the policy was derived from, when applicable. Example values: `endpointSecurityAntivirus`, `endpointSecurityDiskEncryption`, `endpointSecurityFirewall`. |  |
| `templateId` | `string` **|** `null` | Microsoft identifier of the Settings Catalog template this policy was instantiated from, when applicable. |  |

---

### Laptop

`laptop` inherits from [Device](/data-model/schemas/Device.md), [Host](/data-model/schemas/Host.md)

---

### Microsoft 365 Account

`microsoft_365_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `defaultDomain` | `string` |  |  |
| `intuneAccountId` | `string` |  |  |
| `intuneSubscriptionState` | `string` |  |  |
| `mobileDeviceManagementAuthority` | `string` |  |  |
| `organizationName` | `string` **|** `null` |  |  |
| `verifiedDomains` | `array` of `string`s |  |  |

---

### Microsoft 365 Team

`microsoft_365_team` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `description` | `string` | Free-text description of the team |  |
| `isArchived` | `boolean` | True if the team has been archived by an admin |  |
| `visibility` | `string` | Visibility scope of the team (private / public / hiddenMembership) |  |
| `webUrl` | `string` | Deep link to the team in the Microsoft Teams client |  |

---

### Microsoft 365 Teams App Installation

`microsoft_365_teams_app_installation` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appVersion` | `string` | teamsAppDefinition.version installed in this team |  |
| `distributionMethod` | `string` | How the app was published: store (Teams public app store), organization (tenant-published), or sideloaded (highest-risk; an admin manually uploaded the package) |  |
| `externalAppId` | `string` | teamsApp.externalId set by the app publisher when the app was registered |  |
| `publishingState` | `string` | teamsAppDefinition.publishingState (e.g. published, submitted, rejected) |  |
| `teamsAppId` | `string` | Microsoft Graph teamsApp.id of the catalog entry this installation references |  |

---

### Server

`server` inherits from [Host](/data-model/schemas/Host.md)

---

### Server

`server` inherits from [Device](/data-model/schemas/Device.md), [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aadDeviceId` | `string` |  |  |
| `assetTag` | `array` of `string`s |  |  |
| `BYOD` | `boolean` |  |  |
| `deviceCategoryDisplayName` | `string` |  |  |
| `deviceName` | `string` |  |  |
| `deviceType` | `string` |  |  |
| `easDeviceId` | `string` |  |  |
| `encrypted` | `boolean` |  |  |
| `enrolledDateTime` | `number` |  |  |
| `ethernetMacAddress` | `string` |  |  |
| `freeStorageSpace` | `string` |  |  |
| `freeStorageSpaceInBytes` | `number` |  |  |
| `hardwareManufacturer` | `string` |  |  |
| `hardwareModel` | `string` |  |  |
| `hardwareSerial` | `string` |  |  |
| `hardwareVendor` | `string` |  |  |
| `hardwareVersion` | `string` |  |  |
| `iccid` | `string` |  |  |
| `id` | `string` |  |  |
| `imei` | `string` |  |  |
| `ipAddress` | `string` |  |  |
| `jailBroken` | `string` |  |  |
| `lastSyncDateTime` | `number` |  |  |
| `lastUpdateDateTime` | `number` |  |  |
| `macAddress` | `array` of `string`s |  |  |
| `managed` | `boolean` |  |  |
| `meid` | `string` |  |  |
| `name` | `string` |  |  |
| `ownerType` | `string` |  |  |
| `phoneNumber` | `string` |  |  |
| `physical` | `boolean` |  |  |
| `processorArchitecture` | `string` |  |  |
| `serialNumber` | `string` |  |  |
| `supervised` | `boolean` |  |  |
| `totalPhysicalMemory` | `string` |  |  |
| `totalPhysicalMemoryInBytes` | `number` |  |  |
| `totalStorageSpace` | `string` |  |  |
| `totalStorageSpaceInBytes` | `number` |  |  |
| `udid` | `string` |  |  |
| `userDisplayName` | `string` |  |  |
| `userEmails` | `array` of `string`s |  |  |
| `userId` | `string` |  |  |
| `username` | `string` |  |  |
| `version` | `string` |  |  |
| `wifiMacAddress` | `string` |  |  |

---

### Smartphone

`smartphone` inherits from [Device](/data-model/schemas/Device.md), [Host](/data-model/schemas/Host.md)

---

### User Endpoint

`user_endpoint` inherits from [Device](/data-model/schemas/Device.md), [Host](/data-model/schemas/Host.md)

---

### Workstation

`workstation` inherits from [Device](/data-model/schemas/Device.md), [Host](/data-model/schemas/Host.md)

---

## Release Notes

-   **2026-04-08** — Improved OS type and detail accuracy for Microsoft 365 Intune managed device entities.
-   **2026-02-12** — Added raw data properties to Windows Autopilot device identity entities, including deployment profile assignment timestamps and last contact time.
-   **2025-10-21** — Added Windows Autopilot device identity ingestion, exposing enrollment state, deployment profile assignment, and last contact time.
-   **2025-07-01** — Added direct group membership relationships for Microsoft 365 group members when the user exists in JupiterOne, improving relationship accuracy over mapped relationships.

---

Source: /integrations/directory/microsoft-active-directory

# Microsoft Active Directory

Visualize Microsoft Active Directory users, groups, and devices, and monitor changes through queries and alerts.

## Installation

To use this integration, you must create a Microsoft Active Directory account capable of executing Active Directory read queries (It is strongly recommended to create a new account that is used strictly for this integration and not over-provisioned), and open the LDAP port on your server to allow queries to be executed.

> **INFO**
> 
> You can find additional information on managing Active Directory accounts on Microsoft's documentation, [here](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-default-user-accounts). Additionally, information on LDAP configuration can be found, [here](https://learn.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-configure-ldaps).

### Configuration in JupiterOne

To install the Microsoft Active Directory integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Microsoft Active Directory. Click **New Instance** to begin configuring your integration.

1.  Create an Active Directory user capable of executing read queries. It is strongly recommended to create a new account that is used strictly for this integration and not over-provisioned.
2.  Obtain the following information:
    -   **Client Username** - the username created in previous step, such as `user@corp.example.com`.
    -   **Client Password** - the password for the Client Username.
    -   **LDAP URL** - the URL of the LDAP server, such as `ldaps://dc01.corp.example.com` for LDAP over TLS or `ldap://dc01.corp.example.com` for unencrypted LDAP. Use the fully qualified domain name of the domain controller rather than an IP address, for the reasons described in [LDAP over TLS (LDAPS)](#ldap-over-tls-ldaps).
    -   **Base DN** - The base Distinguished Name of the subtree to be used in authentication and searches, such as `dc=corp`,`dc=example`,`dc=com`.

-   The **Account Name** used to identify the Microsoft Active Directory account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Microsoft Active Directry information** (username, password, LDAP URL, base DN) obtained in the previous section.
    

Click **Create** once all values are provided to finalize the integration.

## LDAP over TLS (LDAPS)

LDAP traffic is unencrypted over port 389. LDAPS wraps the same protocol in TLS over port 636, which keeps the bind credentials and directory queries from crossing the network in the clear. Microsoft's [LDAPS certificate documentation](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/configure-ldap-signing-certificates) describes how to install a certificate on the domain controller.

To use LDAPS, set the **LDAP URL** to `ldaps://dc01.corp.example.com`. The port defaults to 636 and does not need to be included.

Two requirements of the domain controller's certificate decide whether the connection succeeds, and both are checked by the client, which in this case is your integration collector:

-   **The host in the LDAP URL must match the certificate.** Microsoft requires the domain controller's Active Directory fully qualified domain name to appear either in the certificate's Subject common name or as a DNS entry in its Subject Alternative Name extension. Because certificates issued from the Domain Controller template identify the domain controller by name and not by address, an LDAP URL that uses an IP address fails this check even when the address is correct.
-   **The collector must trust the certificate authority that issued it.** Certificates issued by a public authority are trusted automatically. Certificates issued by your own enterprise or internal authority are not, and must be supplied to the integration.

### Trusting an internal certificate authority

If the domain controller's certificate was issued by an internal certificate authority, upload that authority's certificate in the **Certificate Authority Certificate** field, under **TLS Configuration**.

Provide the issuing authority's certificate together with every certificate above it in its chain, up to and including the root, concatenated into a single PEM file:

```text
-----BEGIN CERTIFICATE-----
(the authority that issued the domain controller certificate)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(each authority above it, ending with the root)
-----END CERTIFICATE-----
```

The full chain matters because a domain controller usually presents only its own certificate and leaves the client to supply the rest. Uploading only part of the chain leaves the collector unable to verify the certificate, and the integration fails in the same way as uploading nothing at all.

To read the chain the domain controller presents, run the following from the host where your collector is installed:

```bash
openssl s_client -connect dc01.corp.example.com:636 -showcerts
```

> **CAUTION**
> 
> Only supply a certificate authority when the **LDAP URL** uses `ldaps://`. Uploading one alongside an `ldap://` URL makes the integration attempt a TLS handshake against port 389, where the domain controller is not expecting one, and the connection fails.

### Mutual TLS

If your domain controller requires the client to present its own certificate, upload it in **Client Certificate** and its private key in **Client Certificate Private Key**, both under **TLS Configuration**. Most deployments do not require this.

### Troubleshooting LDAPS connections

| Message in the job event | Cause and resolution |
| --- | --- |
| The LDAPS server certificate could not be verified | The collector cannot build a trust chain to the certificate. Upload the issuing certificate authority and the certificates above it in **Certificate Authority Certificate**. |
| The LDAPS server certificate does not identify the host used in the LDAP URL | The **LDAP URL** uses a name or address that is absent from the certificate. Use the fully qualified domain name that appears in its Subject or Subject Alternative Name. |
| The server did not complete a TLS handshake | The scheme and the port disagree. Use `ldaps://` for port 636 and `ldap://` for port 389, and remove any uploaded certificate authority when connecting over `ldap://`. |
| The server refused the connection | Port 636 is not reachable from the collector. Open it inbound on the domain controller. |
| The server requires the session to be protected before it accepts these credentials | The domain controller declines simple binds over an unprotected connection. Connect over `ldaps://`. |
| The server rejected the credentials | Active Directory rejected the bind. The diagnostic that accompanies the message identifies the reason, where `data 52e` is an incorrect password, `data 525` an unknown user, `data 532` an expired password, `data 533` a disabled account and `data 775` a locked-out account. |

## Data Volume Configuration

The Microsoft Active Directory integration provides configuration options to control the volume and scope of data ingested into JupiterOne:

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| Page Size | Controls the number of records returned per page from the Microsoft Active Directory LDAP server. This setting should be set below the server's maximum response size limit to avoid errors. Lower values reduce memory usage but may increase query time. | 100 | Any positive integer below your server's max response size limit |
| User Extension Attributes | Specifies which user extension attributes should be included on the `ad_user` entity. This allows you to selectively ingest custom Active Directory attributes that are relevant to your organization. | None | Comma-separated list of extension attribute names (e.g., 'extensionAttribute1,extensionAttribute2') |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `ad_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Contact | `ad_contact` | [Person](https://docs.jupiterone.io/data-model/schemas/Person) |
| Device | `ad_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| User | `ad_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| UserGroup | `ad_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `ad_account` | **HAS** | `ad_user` |
| `ad_account` | **HAS** | `ad_group` |
| `ad_account` | **MANAGES** | `ad_device` |
| `ad_device` | **HAS** | `ad_user` |
| `ad_group` | **HAS** | `ad_user` |
| `ad_group` | **HAS** | `ad_group` |
| `ad_group` | **HAS** | `ad_device` |
| `ad_group` | **HAS** | `ad_contact` |

### Ad Contact

`ad_contact` inherits from [Person](/data-model/schemas/Person.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `company` | `string` | The company recorded on the contact's directory object. |  |
| `department` | `string` | The department recorded on the contact's directory object. |  |
| `memberOf` | `array` of `string`s |  |  |
| `ou` | `array` of `string`s |  |  |

---

### Ad Device

`ad_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountExpiresOn` | `number` |  |  |
| `accountIsLockedOut` | `boolean` | Indicates whether the account is locked out |  |
| `accountNeverExpires` | `boolean` | Indicates if the account never expires |  |
| `doesNotRequirePreauth` | `boolean` | Indicates whether the device does not require preauthentication |  |
| `enabled` | `boolean` | Indicates whether the device account is enabled |  |
| `hasLoginScript` | `boolean` | Indicates whether the device has a login script |  |
| `isCriticalSystemObject` | `boolean` |  |  |
| `isTrustedForDelegation` | `boolean` | Indicates whether the device is trusted for delegation |  |
| `isTrustedToAuthForDelegation` | `boolean` | Indicates whether the device is trusted to authenticate for delegation |  |
| `logonCount` | `number` |  |  |
| `memberOf` | `array` of `string`s |  |  |
| `objectClass` | `array` of `string`s |  |  |
| `operatingSystem` | `string` | Please use osName instead | **deprecated**: true |
| `operatingSystemVersion` | `string` | Please use osVersion instead | **deprecated**: true |
| `ou` | `array` of `string`s |  |  |
| `passwordNotRequired` | `boolean` | Indicates whether the password is not required |  |
| `pwdLastSetOn` | `number` |  |  |

---

### Ad User

`ad_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountExpiresOn` | `number` | Indicates when the account expires |  |
| `accountNeverExpires` | `boolean` | Indicates if the account never expires |  |
| `active` | `boolean` |  |  |
| `createdOn` | `number` |  |  |
| `description` | `string` |  |  |
| 
`lastLogOn` \*

 | `number` **|** `null` |  |  |
| `memberOf` | `array` of `string`s |  |  |
| `pwdLastSetOn` | `number` |  |  |
| `updatedOn` | `number` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS details for Active Directory computer entities to include both operating system name and version.
-   **2026-01-23** — Improved accuracy of user active status by deriving it from the Active Directory User Account Control flags.
-   **2025-10-30** — Added support for CA certificate, client certificate, and client certificate key configuration options for mutual TLS authentication with Active Directory servers.
-   **2025-07-31** — Added Active Directory User Account Control flags as queryable properties on user and device entities, exposing account status details including lockout, password expiry, and delegation settings.
-   **2025-07-17** — Added account expiry date and password last set timestamps to Active Directory user and device entities; added group membership list to user entities.
-   **2025-07-04** — Added relationships linking Active Directory devices to their associated users based on login workstation assignments.
-   **2025-06-02** — Added configurable filters to limit Active Directory user and device ingestion to accounts with recent login activity, controlled by the number of days since last logon.

---

Source: /integrations/directory/microsoft-configuration-manager

# Microsoft Configuration Manager (SCCM)

Visualize Microsoft Configuration Manager (SCCM) devices, device collections, and local users in the JupiterOne graph. Use this integration to also monitor changes to Microsoft Configuration Manager entities using JupiterOne alerts.

## Installation

> **INFO**
> 
> JupiterOne uses a connection to the Microsoft SQL server that hosts data for Microsoft Configuration Manager to pull data. If you have the ability to log into the database, it is strongly recommended that a user create an account specifically for JupiterOne to use. At a minimum, login credentials for an account that includes `public` and `db_datareader` permissions will be needed.

### Configuration in Microsoft Configuration Manager

1.  In the object explorer, open the "Security" folder.
2.  Right-click on "Logins" and select "New Login..."
3.  Create a user using the following steps:
    -   Enter the login name `j1int`.
    -   Select "SQL Server Authentication".
    -   Create a password.
    -   Set the default database to your Microsoft Configuration Manager database
    -   Navigate to the "User Mapping" page.
    -   Check the "Map" box for the Microsoft Configuration Manager database row.
    -   Ensure that both `public` and `db_datareader` are checked under "Database role membership for: " the Microsoft Configuration Manager database.
    -   Click "OK".

### Configuration in JupiterOne

1.  From the top-bar menu, select Integrations.
2.  Scroll to, or search for, the Microsoft Configuration Manager (SCCM) integration tile and click it.
3.  Click the New Instance button and configure the settings:
    -   Enter the Host for the Microsoft Configuration Manager database.
    -   Enter the Database name.
    -   Enter the login name for the account to be used for SQL data retrieval. (the suggested name is `j1int`).
    -   Enter the password for the account to be used for SQL data retrieval.
    -   Enter in a name and description for the integration instance.
4.  Click the Create button to complete the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `microsoft_configuration_manager_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `microsoft_configuration_manager_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Device | `microsoft_configuration_manager_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Device Collection | `microsoft_configuration_manager_device_collection` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Local User | `microsoft_configuration_manager_local_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `microsoft_configuration_manager_account` | **HAS** | `microsoft_configuration_manager_device` |
| `microsoft_configuration_manager_device` | **INSTALLED** | `microsoft_configuration_manager_application` |
| `microsoft_configuration_manager_device_collection` | **HAS** | `microsoft_configuration_manager_device` |
| `microsoft_configuration_manager_local_user` | **OWNS** | `microsoft_configuration_manager_device` |

### Microsoft Configuration Manager Device

`microsoft_configuration_manager_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aadDeviceId` | `string` **|** `null` | The Microsoft Entra ID (Azure AD) device identifier. |  |
| `aadTenantId` | `string` **|** `null` | The Microsoft Entra ID (Azure AD) tenant identifier. |  |
| `adSiteName` | `string` **|** `null` | The Active Directory site name that is assigned to the client. |  |
| `agentEdition` | `number` **|** `null` | The edition of the installed Configuration Manager client agent. |  |
| `clientType` | `string` **|** `null` | The type of client installed on the computer. Derived from the numeric source value: `0` -> `legacy`, `1` -> `advanced`, `3` -> `device`. |  |
| `clientVersion` | `string` **|** `null` | Version of the installed client software. |  |
| `cpuType` | `string` **|** `null` | The CPU type, for example `StrongARM`. Only device clients report this value. |  |
| `distinguishedName` | `string` **|** `null` | The Active Directory distinguished name of the computer account, e.g. `CN=host01,OU=Servers,DC=contoso,DC=com`. |  |
| `domainName` | `string` **|** `null` | The fully qualified Active Directory domain name the resource belongs to. |  |
| `easDeviceId` | `string` **|** `null` | The Exchange ActiveSync device ID used for mobile device management. |  |
| `hardwareId` | `string` **|** `null` | An ID that uniquely describes the hardware the client is installed on. Remains unchanged through re-imaging or successive operating system installations, unlike the Configuration Manager unique ID. |  |
| `isAlwaysInternet` | `boolean` | Indicates whether the client always behaves like an internet-based client. |  |
| `isAoacCapable` | `boolean` | Indicates whether the resource supports Always On/Always Connected (modern standby). |  |
| `isAssignedToUser` | `boolean` | Indicates whether the resource is assigned to a user. |  |
| `isClientInstalled` | `boolean` | Indicates whether the computer has the Configuration Manager client software installed. |  |
| `isDecommissioned` | `boolean` | Indicates whether the resource is decommissioned. |  |
| `isInternetEnabled` | `boolean` | Indicates whether the device is enabled as an internet device. |  |
| `isObsolete` | `boolean` | Indicates the record has been superseded by another record for the same computer. When several records share the same hardware ID, the older records are marked obsolete. |  |
| `isPortableOperatingSystem` | `boolean` | Indicates whether the resource runs a portable operating system, such as Windows To Go. |  |
| `isVirtualMachine` | `boolean` | Indicates whether the resource is a virtual machine. |  |
| `lastLogonUserDomain` | `string` **|** `null` | Domain used by the last logged-on user at the time the discovery agent ran. |  |
| `lastLogonUserName` | `string` **|** `null` | Name of the last logged-on user at the time the discovery agent ran. |  |
| `managementAuthority` | `number` **|** `null` | The authority that manages the device, used to distinguish Configuration Manager, Intune and co-managed devices. |  |
| `mdmDeviceCategoryId` | `string` **|** `null` | The GUID of the device category assigned to the device, if any. |  |
| `mdmStatus` | `string` **|** `null` | The mobile device management enrollment status of the device. |  |
| `netbiosName` | `string` **|** `null` | Name used by the NetBIOS protocol. |  |
| `objectGuid` | `string` **|** `null` | Object GUID of the resource, retrieved from Active Directory. |  |
| `previousSmsUuid` | `string` **|** `null` | The prior Configuration Manager GUID, reported when the client determines the hardware changed significantly enough that it likely moved to a different computer. |  |
| `primaryGroupId` | `number` **|** `null` | Primary group of the resource, retrieved from Active Directory. |  |
| `resourceDomainOrWorkgroup` | `string` **|** `null` | Domain or workgroup to which the resource belongs. |  |
| `senseId` | `string` **|** `null` | The Microsoft Defender for Endpoint (SENSE) device identifier. |  |
| `serialNumber` | `string` **|** `null` | Please use `serial` instead. | **deprecated**: true |
| `sid` | `string` **|** `null` | The security identifier (SID) of the resource, retrieved from Active Directory. |  |
| `smbiosGuid` | `string` **|** `null` | BIOS GUID of the client computer. |  |
| `smsUniqueIdentifier` | `string` **|** `null` | Unique ID that comes from the client computer. This ID is unique across Configuration Manager sites. |  |
| `smsUuidChangedOn` | `number` **|** `null` | The timestamp (in milliseconds since epoch) when the client generated a new Configuration Manager GUID. |  |
| `userAccountControl` | `number` **|** `null` | User account control value retrieved from Active Directory. |  |
| `virtualMachineHostName` | `string` **|** `null` | Virtual machine host name. |  |

---

### Microsoft Configuration Manager Local User

`microsoft_configuration_manager_local_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `localPath` | `string` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name, type, and version accuracy for Microsoft Configuration Manager device entities, stripping trailing version numbers from raw OS strings.

---

Source: /integrations/directory/microsoft-purview

# Microsoft Purview

The Microsoft Purview integration enhances data governance and compliance management capabilities. This integration empowers JupiterOne users to more efficiently govern their data landscape, manage compliance across various regulations, and mitigate risks through Purview's advanced data discovery and classification tools.

## Installation

> **INFO**
> 
> To use this integration, JupiterOne requires registering an app on portal.azure.com, and providing the created app's API credentials in JupiterOne.

### Configuration in Microsoft Purview

1.  **Azure Portal Setup:**

-   Navigate to the Azure Portal at [portal.azure.com](https://portal.azure.com) and sign in.
-   Go to **App Registrations** to create a new application. During this process, take note of the **Application (client) ID** and **Directory (tenant) ID**; these will be important for further configurations.

2.  **Authentication Credentials:**

-   Within your app's settings, visit **Certificates & secrets** to generate a new client secret. Record its value securely, as it will be required later.

3.  **Microsoft Purview Configuration:**

-   Access the [Microsoft Purview governance portal](https://web.purview.azure.com/resource/) and log in.
-   From the left-side menu, choose **Data Map** followed by **Collections**.
-   Identify and select the root collection, which is named after your Microsoft Purview account and appears at the top of the list.

4.  **Role Assignment:**

-   In the collections menu, navigate to the **Role assignments** tab.
-   Assign the newly created service principal (from the Azure portal steps) to the following roles:
    -   **Data Source Admins**: This role is essential even though only read operations will be performed.
    -   **Data Readers**: Grants read access necessary for integration.

### Configuration in JupiterOne

-   The **Account Name** used to identify the Microsoft Purview account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Provide your Microsoft Purview **Account Name**, **Tenant ID**, **Client ID**, and **Client Secret**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `microsoft_purview_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Classification | `microsoft_purview_classification` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Collection | `microsoft_purview_collection` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| Data Source | `microsoft_purview_data_source` | [DataObject](https://docs.jupiterone.io/data-model/schemas/DataObject) |
| Entity | `microsoft_purview_entity` | [Entity](https://docs.jupiterone.io/data-model/schemas/Entity) |
| Scan | `microsoft_purview_scan` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `microsoft_purview_account` | **HAS** | `microsoft_purview_collection` |
| `microsoft_purview_classification` | **HAS** | `microsoft_purview_entity` |
| `microsoft_purview_collection` | **HAS** | `microsoft_purview_collection` |
| `microsoft_purview_collection` | **HAS** | `microsoft_purview_data_source` |
| `microsoft_purview_scan` | **SCANS** | `microsoft_purview_data_source` |
| `microsoft_purview_scan` | **IDENTIFIED** | `microsoft_purview_entity` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `microsoft_purview_account` | **HAS** | `azure_resource_group` | REVERSE |
| `microsoft_purview_data_source` | **CONNECTS** | `azure_resource` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_sql_server` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_sql_database` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_postgresql_server` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_postgresql_database` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_mysql_server` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_mysql_database` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_cosmosdb_account` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_cosmosdb_sql_database` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_storage_account` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_mariadb_server` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_mariadb_database` | FORWARD |

---

Source: /integrations/directory/microsoft-teams

# Microsoft Teams

Visualize Microsoft Teams users, teams, and channels, map Microsoft Teams users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> To use this integration, JupiterOne requires a registering an app on portal.azure.com, and providing the created app's API credentials in JupiterOne.

### Configuration in Microsoft Teams

Before configuring the integration, ensure that you have, at minimum, a Microsoft 365 Business Standard account, and have the login credentials at hand.

1.  Sign in at [portal.azure.com](https://portal.azure.com).
2.  Go to **App Registrations** and register for a new app. Note the **client ID** and **tenant ID** for use in JupiterOne.
3.  Go to **Certificates and Secrets** and register a client secret and retain the value for JupiterOne.
4.  Go to **API permissions** and add the following permissions for Microsoft Graph (application permission):
    -   Group.Read.All - allows getting the teams data
    -   TeamMember.Read.All - allows getting all the teams' members' data
    -   User.Read.All - allows getting user's data
5.  Grant admin consent for all above permissions for your organization.

### Configuration in JupiterOne

-   The **Account Name** used to identify the Addigy account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Provide your Microsoft Teams **Client ID**, **Tenant ID**, and **Client Secret**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `microsoft_teams_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Channel | `microsoft_teams_channel` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| Team | `microsoft_teams_team` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| User | `microsoft_teams_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `microsoft_teams_account` | **HAS** | `microsoft_teams_user` |
| `microsoft_teams_account` | **HAS** | `microsoft_teams_team` |
| `microsoft_teams_team` | **HAS** | `microsoft_teams_user` |
| `microsoft_teams_team` | **HAS** | `microsoft_teams_channel` |

### Microsoft Teams User

`microsoft_teams_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `jobTitle` | `string` |  |  |
| `userPrincipalName` | `string` |  |  |

---

---

Source: /integrations/directory/mimecast

# Mimecast

Visualize Mimecast accounts, domains, users, map Mimecast users to employees, and monitor changes through queries and alerts.

## Installation

The Mimecast integration ingests account details, internal domains, users, and awareness-training campaigns using the Mimecast API 1.0. Before configuring the integration in JupiterOne, you must create a registered API Application in the Mimecast Administration Console.

### Prerequisites

-   A Mimecast account with **admin access** — you must have a Mimecast Administrator role to register API applications and generate credentials.
-   Access to JupiterOne with permission to configure integrations.

### Creating credentials in Mimecast

1.  Log in to the Mimecast Administration Console as an administrator.
2.  Navigate to **Administration > Services > API and Platform Integrations**.
3.  Select the **Your Application Integrations** category.
4.  Click **Add API Application**, or open an existing enabled application.
5.  Note the **Application ID** and **Application Key** shown on the application page.
6.  If you have not already generated access keys, click **Create Keys** to generate an **Access Key** and a **Secret Key**. Save both values — they are shown only once.

### Configuration in JupiterOne

To install the Mimecast integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Mimecast. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Mimecast account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Mimecast Access Key** — the Access Key generated in the **Create Keys** step above. This value is used to sign API requests.
    
-   **Mimecast Secret Key** — the Secret Key generated in the **Create Keys** step above. Used together with the Access Key to authenticate requests.
    
-   **Mimecast Application Key** — the Application Key for your registered API Application.
    
-   **Mimecast Application ID** — the Application ID for your registered API Application.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `Mimecast Administrator`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (5)

-   `https://us-api.mimecast.com/api/account/get-account`
-   `https://us-api.mimecast.com/api/awareness-training/campaign/get-campaigns`
-   `https://us-api.mimecast.com/api/awareness-training/campaign/get-user-data`
-   `https://us-api.mimecast.com/api/domain/get-internal-domain`
-   `https://us-api.mimecast.com/api/user/get-internal-users`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (6)

-   [https://developer.services.mimecast.com/docs/accountmanagement/1/routes/api%2Faccount%2Fget-account/post](https://developer.services.mimecast.com/docs/accountmanagement/1/routes/api%2Faccount%2Fget-account/post)
-   [https://developer.services.mimecast.com/docs/awarenesstraining/1/routes/api%2Fawareness-training%2Fcampaign%2Fget-campaigns/post](https://developer.services.mimecast.com/docs/awarenesstraining/1/routes/api%2Fawareness-training%2Fcampaign%2Fget-campaigns/post)
-   [https://developer.services.mimecast.com/docs/awarenesstraining/1/routes/api%2Fawareness-training%2Fcampaign%2Fget-user-data/post](https://developer.services.mimecast.com/docs/awarenesstraining/1/routes/api%2Fawareness-training%2Fcampaign%2Fget-user-data/post)
-   [https://developer.services.mimecast.com/docs/userandgroupmanagement/1/routes/api%2Fdomain%2Fget-internal-domain/post](https://developer.services.mimecast.com/docs/userandgroupmanagement/1/routes/api%2Fdomain%2Fget-internal-domain/post)
-   [https://developer.services.mimecast.com/docs/userandgroupmanagement/1/routes/api%2Fuser%2Fget-internal-users/post](https://developer.services.mimecast.com/docs/userandgroupmanagement/1/routes/api%2Fuser%2Fget-internal-users/post)
-   [https://mimecastsupport.zendesk.com/hc/en-us/articles/53486642898195](https://mimecastsupport.zendesk.com/hc/en-us/articles/53486642898195)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (2)

| Step | Roles | Endpoints |
| --- | --- | --- |
| Fetch Awareness Campaigns Enrollment Data | `Mimecast Administrator` | `https://us-api.mimecast.com/api/awareness-training/campaign/get-user-data` |
| Fetch Users | `Mimecast Administrator` | `https://us-api.mimecast.com/api/user/get-internal-users` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `mimecast_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Awareness\_Campaign | `mimecast_awareness_campaign` | [Training](https://docs.jupiterone.io/data-model/schemas/Training) |
| Domain | `mimecast_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| User | `mimecast_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `mimecast_account` | **HAS** | `mimecast_domain` |
| `mimecast_account` | **HAS** | `mimecast_awareness_campaign` |
| `mimecast_domain` | **HAS** | `mimecast_user` |
| `mimecast_user` | **ASSIGNED** | `mimecast_awareness_campaign` |
| `mimecast_user` | **COMPLETED** | `mimecast_awareness_campaign` |

### Mimecast User

`mimecast_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`addressType` \*

 | `string` |  |  |
| 

`alias` \*

 | `boolean` |  |  |
| 

`source` \*

 | `string` |  |  |

---

---

Source: /integrations/directory/mongodb

# MongoDB

Visualize MongoDB users, projects, teams, API keys, clusters, and roles in the JupiterOne graph. Our guide provides step-by-step instructions on setting up the integration and utilizing its data model to gain visibility into your MongoDB Atlas environment.

## Installation

To use this integration, JupiterOne requires an API public key and corresponding private key from MongoDB Atlas.

### Configuration in MongoDB Atlas (UI)

> **NOTE**
> 
> In order to create an API Key, you must have Organization Owner access to Atlas.
> 
> Each API Key is associated with an organization. If you have multiple organizations in your MongoDB environment that you'd like to integrate with JupiterOne, you'll need to create an API Key for each organization and set up a separate integration instance for each organization/API Key.

1.  Log in to your MongoDB Atlas account.
2.  Follow the detailed instructions in the [MongoDB Atlas documentation](https://www.mongodb.com/docs/atlas/configure-api-access/#create-an-api-key-in-an-organization) to create both a public and private key. Note that the private key will only be shown once, so be sure to save it in a secure location.

By default, MongoDB Atlas turns on the setting to require an IP Access List on the organization level. In order for JupiterOne to successfully connect to your MongoDB Atlas environment, you will need to toggle the setting `Require IP Access List for the Atlas Administration API` to `OFF`. You can find this under Organization settings.

### Configuration in JupiterOne

1.  From the top-bar menu, select **Integrations**.
2.  Scroll to, or search for, the **MongoDB Atlas** integration tile and click it.
3.  Click the **New Instance** button and configure the settings:
    -   Enter the **public key** into the **Public Key** field.
    -   Enter the **private key** into the **Private Key** field.
    -   Test your credentials and configuration by clicking the **Test Credentials** button.
    -   Enter the **Account Name** by which you'd like to identify this MongoDB instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
4.  Click the **Create** button to complete the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data about your MongoDB environment within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| API Key | `mongodb_api_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Cluster | `mongodb_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Organization | `mongodb_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Project | `mongodb_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Role | `mongodb_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Team | `mongodb_team` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup), [Team](https://docs.jupiterone.io/data-model/schemas/Team) |
| User | `mongodb_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `mongodb_api_key` | **HAS** | `mongodb_role` |
| `mongodb_organization` | **HAS** | `mongodb_project` |
| `mongodb_organization` | **HAS** | `mongodb_user` |
| `mongodb_organization` | **HAS** | `mongodb_team` |
| `mongodb_organization` | **HAS** | `mongodb_api_key` |
| `mongodb_project` | **HAS** | `mongodb_user` |
| `mongodb_project` | **OWNS** | `mongodb_role` |
| `mongodb_project` | **HAS** | `mongodb_cluster` |
| `mongodb_project` | **HAS** | `mongodb_team` |
| `mongodb_project` | **HAS** | `mongodb_api_key` |
| `mongodb_team` | **HAS** | `mongodb_user` |
| `mongodb_team` | **HAS** | `mongodb_role` |
| `mongodb_user` | **ASSIGNED** | `mongodb_role` |

---

Source: /integrations/directory/mosyle-mdm

# Mosyle MDM

Visualize Mosyle MDM devices, groups, and users, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need your Mosyle MDM email, password, and an access token to set up this integration. Access tokens can be created in the integrations settings of your Mosyle MDM console.

### Configuration in Mosyle MDM

1.  Log in to your Mosyle MDM console.
2.  Navigate to the integrations settings page.
3.  Create a new Access Token for JupiterOne integration.
4.  Keep your email and password credentials ready, as they are required for authentication along with the access token.

### Configuration in JupiterOne

To install the Mosyle MDM integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Mosyle MDM. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Mosyle MDM account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Mosyle MDM **Email** address that you use to log in.
    
-   Your Mosyle MDM **Password** that you use to log in.
    
-   Your Mosyle MDM **Access Token** created in the integrations settings.
    
-   Optionally, enable **Use Manager API** if you want to use the Manager API ([https://managerapi.mosyle.com/v2](https://managerapi.mosyle.com/v2)) instead of the Business API ([https://businessapi.mosyle.com/v1](https://businessapi.mosyle.com/v1)).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Device | `mosyle_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Device Group | `mosyle_device_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| User | `mosyle_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Group | `mosyle_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `mosyle_device_group` | **HAS** | `mosyle_device` |
| `mosyle_user` | **ASSIGNED** | `mosyle_device` |
| `mosyle_user_group` | **HAS** | `mosyle_user` |

### Mosyle Device

`mosyle_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `AssetTag` | `string` |  | **deprecated**: true |
| `deviceStatus` | `string` |  |  |
| `DeviceStatus` | `string` |  | **deprecated**: true |

---

### Mosyle User

`mosyle_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `name` | `string` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name accuracy for Mosyle MDM device entities, using human-readable names for macOS, iOS, iPadOS, and tvOS devices.
-   **2025-04-29** — Added normalized email, short login ID, and email domain properties to Mosyle MDM user entities.

---

Source: /integrations/directory/netbox

# Netbox

## Installation

> **INFO**
> 
> You will need your Netbox instance hostname and an API Key to set up this integration. See [Netbox's documentation](https://docs.netbox.dev/en/stable/integrations/rest-api/#authentication) for more information on creating API tokens.

### Configuration in Netbox

1.  Log in to your Netbox instance.
2.  Navigate to your user profile or the admin panel.
3.  Create a new API token with appropriate permissions to read the resources you want to ingest into JupiterOne.
4.  Note your Netbox instance hostname (e.g., `https://netbox.example.com`).

### Configuration in JupiterOne

To install the Netbox integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Netbox. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Netbox account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Netbox **Host** location (e.g., `https://netbox.example.com`).
    
-   Your Netbox **API Key** secret to access your Netbox instance.
    
-   Optionally, you can enable **Disable TLS Verification** to disable TLS certificate verification. This is NOT RECOMMENDED. Please install a valid TLS certificate on your Netbox server instead.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Device | `netbox_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| NetBox IP Address | `netbox_ip_address` | [IpAddress](https://docs.jupiterone.io/data-model/schemas/IpAddress) |
| NetBox IP Prefix | `netbox_ip_prefix` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Service | `netbox_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `netbox_device` | **HAS** | `netbox_ip_address` |
| `netbox_service` | **MANAGES** | `netbox_device` |
| `netbox_service` | **MANAGES** | `netbox_ip_address` |
| `netbox_service` | **MANAGES** | `netbox_ip_prefix` |

### Netbox Ip Address

`netbox_ip_address` inherits from [IpAddress](/data-model/schemas/IpAddress.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`address` \*

 | `string` |  |  |
| 

`assignedObjectId` \*

 | `number` **|** `null` |  |  |
| 

`assignedObjectName` \*

 | `string` **|** `null` |  |  |
| 

`assignedObjectType` \*

 | `string` **|** `null` |  |  |
| 

`assignedToDeviceId` \*

 | `number` **|** `null` |  |  |
| 

`assignedToDeviceName` \*

 | `string` **|** `null` |  |  |
| 

`comments` \*

 | `string` **|** `null` |  |  |
| 

`description` \*

 | `string` **|** `null` |  |  |
| 

`dnsName` \*

 | `string` **|** `null` |  |  |
| 

`family` \*

 | `number` **|** `null` |  |  |
| 

`familyLabel` \*

 | `string` **|** `null` |  |  |
| 

`ipAddress` \*

 | `string` |  |  |
| 

`isActive` \*

 | `boolean` |  |  |
| 

`natInsideAddress` \*

 | `string` **|** `null` |  |  |
| 

`natInsideId` \*

 | `number` **|** `null` |  |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` |  |  |
| 

`publicIpAddress` \*

 | `string` **|** `null` |  |  |
| 

`role` \*

 | `string` **|** `null` |  |  |
| 

`roleLabel` \*

 | `string` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`statusLabel` \*

 | `string` **|** `null` |  |  |
| 

`tenantId` \*

 | `number` **|** `null` |  |  |
| 

`tenantName` \*

 | `string` **|** `null` |  |  |
| 

`vrfId` \*

 | `number` **|** `null` |  |  |
| 

`vrfName` \*

 | `string` **|** `null` |  |  |
| 

`vrfRd` \*

 | `string` **|** `null` |  |  |

---

### Netbox Ip Prefix

`netbox_ip_prefix` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`children` \*

 | `number` **|** `null` |  |  |
| 

`CIDR` \*

 | `string` |  |  |
| 

`comments` \*

 | `string` **|** `null` |  |  |
| 

`depth` \*

 | `number` **|** `null` |  |  |
| 

`description` \*

 | `string` **|** `null` |  |  |
| 

`family` \*

 | `number` **|** `null` |  |  |
| 

`familyLabel` \*

 | `string` **|** `null` |  |  |
| 

`internal` \*

 | `boolean` |  |  |
| 

`isActive` \*

 | `boolean` |  |  |
| 

`isMarkUtilized` \*

 | `boolean` |  |  |
| 

`isPool` \*

 | `boolean` |  |  |
| 

`prefix` \*

 | `string` |  |  |
| 

`public` \*

 | `boolean` |  |  |
| 

`roleId` \*

 | `number` **|** `null` |  |  |
| 

`roleName` \*

 | `string` **|** `null` |  |  |
| 

`roleSlug` \*

 | `string` **|** `null` |  |  |
| 

`scopeId` \*

 | `number` **|** `null` |  |  |
| 

`scopeName` \*

 | `string` **|** `null` |  |  |
| 

`scopeSlug` \*

 | `string` **|** `null` |  |  |
| 

`scopeType` \*

 | `string` **|** `null` |  |  |
| 

`siteId` \*

 | `number` **|** `null` |  |  |
| 

`siteName` \*

 | `string` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`statusLabel` \*

 | `string` **|** `null` |  |  |
| 

`tenantId` \*

 | `number` **|** `null` |  |  |
| 

`tenantName` \*

 | `string` **|** `null` |  |  |
| 

`vlanId` \*

 | `number` **|** `null` |  |  |
| 

`vlanName` \*

 | `string` **|** `null` |  |  |
| 

`vlanVid` \*

 | `number` **|** `null` |  |  |
| 

`vrfId` \*

 | `number` **|** `null` |  |  |
| 

`vrfName` \*

 | `string` **|** `null` |  |  |
| 

`vrfRd` \*

 | `string` **|** `null` |  |  |

---

## Release Notes

-   **2026-02-11** — Added ingestion of NetBox IP addresses and network prefixes as new entity types, with configurable status filtering for each.

---

Source: /integrations/directory/netskope

# Netskope

Visualize Netskope devices, users, and app instances, map Netskope users to employee entities, and monitor changes through queries and alerts.

## Prerequisites

The Netskope integration authenticates with two separate tokens:

-   **API V1 Token** (required) — grants access to devices, users, and app instances.
-   **API V2 Token** (optional) — unlocks additional data types including NPA private apps, publishers, NPA policies, URL lists, discovered/shadow-AI apps, DLP incidents, and SCIM users.

### Generate an API V1 Token

1.  Log in to the Netskope admin console.
2.  Navigate to **Settings** > **Tools** > **REST API v1**.
3.  Click **New Token**, give it a name, and click **Generate**.
4.  Copy the token value — you will not be able to view it again.

### Generate an API V2 Token (optional)

The V2 token uses RBAC V3 service-account credentials. Grant it read access to the API domains you want to ingest.

1.  Navigate to **Settings** > **Administration** > **Administrators**.
2.  Select the **Service Accounts** tab.
3.  Click **New Service Account**, enter a name, and select **Read** access for each API domain you want to enable (for example: Steering, Infrastructure, Policy, Events, SCIM).
4.  Click **Save**, then copy the generated token.

For more information see the [Netskope REST API v1 overview](https://docs.netskope.com/en/netskope-help/rest-api-v1-overview/) and [REST API v2 token management](https://docs.netskope.com/en/netskope-help/rest-api-v2-overview-312207/rest-api-v2-token-management-312226/).

## Configuration in JupiterOne

To install the Netskope integration in JupiterOne, navigate to the **Integrations** tab and select **Netskope**. Click **New Instance** to begin configuring your integration.

1.  Enter an **Account Name** to identify this Netskope integration instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the toggle is enabled.
2.  (Optional) Enter a **Description** to help identify the instance.
3.  Set a **Polling Interval** for automatic data refresh, or leave it as `DISABLED` to run manually.
4.  Enter your **Tenant Name** — the subdomain portion of your Netskope tenant URL (`example` from `example.goskope.com`).
5.  Enter your **API V1 Token**.
6.  (Optional) Enter your **API V2 Token** to enable additional data ingestion (NPA private apps, publishers, NPA policies, URL lists, discovered apps, and DLP incidents).

Click **Create** to save the instance.

## Data Volume Configuration

Control how much data is ingested from Netskope to manage storage and processing.

### Ingestion Windows

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Event Lookback (days)** | Rolling lookback window for event-derived steps (DLP incidents and discovered/shadow-AI apps). Longer windows increase the number of events ingested. | 7 days | 7 days, 30 days, 90 days |

## Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (14)

-   `https://{tenantName}.goskope.com/api/v1/app_instances`
-   `https://{tenantName}.goskope.com/api/v1/clients`
-   `https://{tenantName}.goskope.com/api/v1/userconfig`
-   `https://{tenantName}.goskope.com/api/v2/events/datasearch/application`
-   `https://{tenantName}.goskope.com/api/v2/events/datasearch/incident`
-   `https://{tenantName}.goskope.com/api/v2/infrastructure/publishers`
-   `https://{tenantName}.goskope.com/api/v2/infrastructure/publisherupgradeprofiles`
-   `https://{tenantName}.goskope.com/api/v2/platform/administration/scim/Users`
-   `https://{tenantName}.goskope.com/api/v2/policy/npa/policygroups`
-   `https://{tenantName}.goskope.com/api/v2/policy/npa/rules`
-   `https://{tenantName}.goskope.com/api/v2/policy/urllist`
-   `https://{tenantName}.goskope.com/api/v2/rbac/roles`
-   `https://{tenantName}.goskope.com/api/v2/scim/Users`
-   `https://{tenantName}.goskope.com/api/v2/steering/apps/private`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (5)

-   [https://docs.netskope.com/en/administrators-rbac-v3/](https://docs.netskope.com/en/administrators-rbac-v3/)
-   [https://docs.netskope.com/en/netskope-help/rest-api-v1-overview/](https://docs.netskope.com/en/netskope-help/rest-api-v1-overview/)
-   [https://docs.netskope.com/en/netskope-help/rest-api-v2-overview-312207/](https://docs.netskope.com/en/netskope-help/rest-api-v2-overview-312207/)
-   [https://docs.netskope.com/en/netskope-help/rest-api-v2-overview-312207/rest-api-v2-token-management-312226/](https://docs.netskope.com/en/netskope-help/rest-api-v2-overview-312207/rest-api-v2-token-management-312226/)
-   [https://docs.netskope.com/en/netskope-rbac-v3-overview/](https://docs.netskope.com/en/netskope-rbac-v3-overview/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (15)

| Step | Endpoints |
| --- | --- |
| Fetch Admin Roles | `https://{tenantName}.goskope.com/api/v2/rbac/roles` |
| Fetch Admins | `https://{tenantName}.goskope.com/api/v2/platform/administration/scim/Users` |
| Fetch and Build User Configuration | `https://{tenantName}.goskope.com/api/v1/userconfig` |
| Fetch App Instances | `https://{tenantName}.goskope.com/api/v1/app_instances` |
| Fetch Devices | `https://{tenantName}.goskope.com/api/v1/clients` |
| Fetch Discovered Apps | `https://{tenantName}.goskope.com/api/v2/events/datasearch/application` |
| Fetch DLP Incidents | `https://{tenantName}.goskope.com/api/v2/events/datasearch/incident` |
| Fetch NPA Policies | `https://{tenantName}.goskope.com/api/v2/policy/npa/rules` |
| Fetch NPA Policy Groups | `https://{tenantName}.goskope.com/api/v2/policy/npa/policygroups` |
| Fetch OAuth Apps (SSPM) | \- |
| Fetch Private Apps | `https://{tenantName}.goskope.com/api/v2/steering/apps/private` |
| Fetch Publisher Upgrade Profiles | `https://{tenantName}.goskope.com/api/v2/infrastructure/publisherupgradeprofiles` |
| Fetch Publishers | `https://{tenantName}.goskope.com/api/v2/infrastructure/publishers` |
| Fetch URL Lists | `https://{tenantName}.goskope.com/api/v2/policy/urllist` |
| Fetch Users and Build Device Relationships | `https://{tenantName}.goskope.com/api/v2/scim/Users` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Admin | `netskope_admin` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Admin Role | `netskope_admin_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| App Instance | `netskope_app_instance` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Device | `netskope_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Discovered App | `netskope_discovered_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| DLP Incident | `netskope_dlp_incident` | [Incident](https://docs.jupiterone.io/data-model/schemas/Incident) |
| NPA Policy | `netskope_npa_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| NPA Policy Group | `netskope_npa_policy_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| OAuth App | `netskope_oauth_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Private App | `netskope_private_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Publisher | `netskope_publisher` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Publisher Upgrade Profile | `netskope_publisher_upgrade_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Service Account | `netskope_service_account` | [User](https://docs.jupiterone.io/data-model/schemas/User), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Tenant | `netskope_tenant` | [Account](https://docs.jupiterone.io/data-model/schemas/Account), [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| URL List | `netskope_url_list` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| User | `netskope_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Configuration | `netskope_user_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `netskope_admin` | **ASSIGNED** | `netskope_admin_role` |
| `netskope_device` | **HAS** | `netskope_user` |
| `netskope_device` | **HAS** | `netskope_dlp_incident` |
| `netskope_npa_policy` | **PROTECTS** | `netskope_private_app` |
| `netskope_publisher` | **CONNECTS** | `netskope_private_app` |
| `netskope_publisher` | **USES** | `netskope_publisher_upgrade_profile` |
| `netskope_service_account` | **ASSIGNED** | `netskope_admin_role` |
| `netskope_tenant` | **HAS** | `netskope_device` |
| `netskope_tenant` | **HAS** | `netskope_app_instance` |
| `netskope_tenant` | **HAS** | `netskope_private_app` |
| `netskope_tenant` | **HAS** | `netskope_publisher` |
| `netskope_tenant` | **HAS** | `netskope_npa_policy` |
| `netskope_tenant` | **HAS** | `netskope_npa_policy_group` |
| `netskope_tenant` | **HAS** | `netskope_url_list` |
| `netskope_tenant` | **HAS** | `netskope_discovered_app` |
| `netskope_tenant` | **HAS** | `netskope_oauth_app` |
| `netskope_tenant` | **HAS** | `netskope_admin_role` |
| `netskope_tenant` | **HAS** | `netskope_admin` |
| `netskope_tenant` | **HAS** | `netskope_service_account` |
| `netskope_user` | **HAS** | `netskope_user_configuration` |
| `netskope_user` | **HAS** | `netskope_dlp_incident` |

### Netskope Admin

`netskope_admin` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authType` | `string` | Authentication method configured for the administrator (e.g. API\_KEY). |  |
| `isLocked` | `boolean` | Whether the administrator account is locked out. |  |
| `isPasswordResetPending` | `boolean` | Whether a password reset is outstanding for the account. |  |
| `isVerified` | `boolean` | Whether the administrator has accepted their invitation and verified the account. |  |
| `lastLoginOn` | `number` | Epoch (ms) of the last console login. |  |
| `provisionedBy` | `string` | How the administrator was created in Netskope: LOCAL, SAML or SCIM. |  |

---

### Netskope Admin Role

`netskope_admin_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isObfuscated` | `boolean` | Whether the role obfuscates sensitive data (e.g. user identifiers) from its holders. |  |
| `isScoped` | `boolean` | Whether the role restricts its holders to a subset of objects (Label Based Access Control). |  |
| `userCount` | `number` | Number of administrators currently holding the role. |  |

---

### Netskope App Instance

`netskope_app_instance` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `app` | `string` | Name of the application this is an instance of. |  |
| `appId` | `string` | Netskope application identifier. |  |
| `instanceTags` | `array` of `string`s | Tags applied to the instance (e.g. Sanctioned, Untagged). |  |
| `lastModifiedOn` | `number` | Epoch (ms) when the instance was last modified. |  |
| `type` | `string` | Instance type (e.g. Custom, Sanctioned). |  |

---

### Netskope Device

`netskope_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `asn` | `string` | Autonomous system number of the device connection. |  |
| `asName` | `string` | Autonomous system name of the device connection. |  |
| `city` | `string` | City geolocated from the connection. |  |
| `clientConfig` | `string` | Name of the client configuration applied to the device. |  |
| `clientInstallTime` | `number` | Epoch (seconds) when the Netskope client was installed. |  |
| `clientVersion` | `string` | Version of the installed Netskope client. |  |
| `continent` | `string` | Continent geolocated from the connection. |  |
| `country` | `string` | Country code geolocated from the connection. |  |
| `deviceClassificationStatus` | `string` | Netskope device classification status (e.g. Managed, Unmanaged). |  |
| `isp` | `string` | Internet service provider of the device connection. |  |
| `lastConnectedFromPrivateIp` | `string` | Private IP the device last connected from. |  |
| `lastConnectedFromPublicIp` | `string` | Public IP the device last connected from. |  |
| `lastEvent` | `string` | The device's most recent client event name. |  |
| `lastEventActor` | `string` | Actor that triggered the most recent client event. |  |
| `lastEventNpaStatus` | `string` | Netskope Private Access status reported with the most recent event. |  |
| `lastEventOccurredOn` | `number` | Epoch (ms) when the most recent client event occurred. |  |
| `lastEventStatus` | `string` | Status reported with the most recent client event. |  |
| `latitude` | `number` | Latitude geolocated from the connection. |  |
| `longitude` | `number` | Longitude geolocated from the connection. |  |
| `managementId` | `string` | Device management identifier reported by the client. |  |
| `netskopePop` | `string` | Netskope point of presence the device connected through. |  |
| `organizationUnit` | `string` | Organization unit of the device user. |  |
| `os` | `string` | Raw operating system value as reported by Netskope. |  |
| `region` | `string` | Region/state geolocated from the connection. |  |
| `steeringConfig` | `string` | Name of the steering configuration applied to the device. |  |
| `userGroups` | `array` of `string`s | Groups of the users associated with the device. |  |
| `username` | `string` | Primary username associated with the device. |  |

---

### Netskope Discovered App

`netskope_discovered_app` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appCategory` | `string` | Netskope application category (e.g. Generative AI, Collaboration). |  |
| `cci` | `number` | Cloud Confidence Index score (0-100). |  |
| `ccl` | `string` | Cloud Confidence Level (poor, low, medium, high, excellent). |  |
| `isGenAI` | `boolean` | Whether the app is categorised as Generative AI by Netskope. |  |
| `usesAI` | `boolean` | Whether the app is an AI/GenAI application. |  |

---

### Netskope Dlp Incident

`netskope_dlp_incident` inherits from [Incident](/data-model/schemas/Incident.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessMethod` | `string` | Access method used (e.g. Client, Clientless, CASB API). |  |
| `activity` | `string` | Activity that triggered the incident (e.g. Upload). |  |
| `app` | `string` | Application the incident occurred in. |  |
| `appCategory` | `string` | Category of the application the incident occurred in (e.g. Generative AI). |  |
| `assignee` | `string` | Assignee of the incident. |  |
| `dlpPolicies` | `array` of `string`s | DLP policy names that matched. |  |
| `dlpProfiles` | `array` of `string`s | DLP profile names that matched. |  |
| `dlpRules` | `array` of `string`s | DLP rule names that matched. |  |
| `fileSize` | `number` | Size of the object in bytes. |  |
| `fileType` | `string` | MIME/file type of the object involved. |  |
| `incidentId` | `string` | Netskope DLP incident identifier. |  |
| `md5` | `string` | MD5 hash of the object. |  |
| `objectName` | `string` | Name of the file/object involved in the incident. |  |
| `objectType` | `string` | Type of the object involved (e.g. File). |  |
| `occurredOn` | `number` | Epoch (ms) when the incident occurred. |  |
| `sha256` | `string` | SHA-256 hash of the object. |  |
| `status` | `string` | Incident status (e.g. new, in-progress, closed). |  |
| `url` | `string` | URL associated with the incident. |  |

---

### Netskope Npa Policy

`netskope_npa_policy` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessMethod` | `array` of `string`s | Access methods the rule applies to (Client, Clientless). |  |
| `action` | `string` | Action taken when the rule matches (e.g. allow, block). |  |
| `isEnabled` | `boolean` | Whether the policy rule is enabled. |  |
| `policyType` | `string` | Policy type (e.g. private-app). |  |
| `privateApps` | `array` of `string`s | Names of the private apps referenced by the rule (a PROTECTS relationship is created for each ingested app). |  |
| `users` | `array` of `string`s | User or group identifiers the rule targets. |  |
| `userType` | `string` | Subject type the rule targets (e.g. user, group). |  |

---

### Netskope Npa Policy Group

`netskope_npa_policy_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdBy` | `string` | Identifier of the admin that created the group. |  |
| `groupType` | `string` | Group type identifier reported by Netskope. |  |
| `isEditableDeletable` | `boolean` | Whether the group can be edited or deleted (false for system-managed groups). |  |

---

### Netskope Oauth App

`netskope_oauth_app` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appDisplayName` | `string` | Human-readable name of the OAuth application. |  |
| `appId` | `string` | Netskope identifier for the app. Mirrored on `clientId` to maximise the AIASM nhiAi enricher match surface. |  |
| `clientId` | `string` | OAuth client identifier of the application. |  |
| `lastActivityOn` | `number` | Epoch (ms) of the last observed activity. |  |
| `scopes` | `array` of `string`s | OAuth scopes granted to the application. |  |
| `status` | `string` | Status of the OAuth application. |  |

---

### Netskope Private App

`netskope_private_app` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appTags` | `array` of `string`s | Tag names applied to the private app. |  |
| `host` | `string` | Reachability target of the app (FQDN, wildcard, IP, or subnet). |  |
| `isClientlessAccess` | `boolean` | Whether clientless (browser) access is enabled. |  |
| `isReachable` | `boolean` | Whether Netskope last reported the app as reachable via a publisher. |  |
| `ports` | `array` of `string`s | Transport:port pairs exposed by the app (e.g. tcp:80). |  |
| `privateAppProtocol` | `string` | Application-layer protocol (e.g. http, https). |  |
| `protocols` | `array` of `string`s | Transport protocols exposed by the app (e.g. tcp, udp). |  |
| `publicHost` | `string` | Public proxy host assigned for clientless access. |  |
| `steeringConfigs` | `array` of `string`s | Steering configurations the app is included in. |  |

---

### Netskope Publisher

`netskope_publisher` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appsCount` | `number` | Number of private apps served by the publisher. |  |
| `commonName` | `string` | Common name presented by the publisher certificate. |  |
| `connectedApps` | `array` of `string`s | Names of the private apps the publisher serves. |  |
| `ipAddress` | `string` | IP address of the publisher host. |  |
| `isLbrokerConnect` | `boolean` | Whether the publisher connects via a local broker. |  |
| `isRegistered` | `boolean` | Whether the publisher has completed registration. |  |
| `publisherStatus` | `string` | Connection status (e.g. connected, disconnected, not registered). |  |
| `version` | `string` | Publisher software version. |  |

---

### Netskope Publisher Upgrade Profile

`netskope_publisher_upgrade_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `dockerTag` | `string` | Docker image tag the profile upgrades publishers to. |  |
| `externalId` | `number` | Stable external identifier of the profile (referenced by publishers). |  |
| `frequency` | `string` | Cron expression describing the upgrade schedule. |  |
| `isEnabled` | `boolean` | Whether the upgrade profile is enabled. |  |
| `nextUpdateOn` | `number` | Epoch (ms) of the next scheduled upgrade. |  |
| `numAssociatedPublisher` | `number` | Number of publishers associated with the profile. |  |
| `releaseType` | `string` | Release channel the profile upgrades to (e.g. Latest). |  |
| `timezone` | `string` | Timezone the upgrade schedule is evaluated in. |  |

---

### Netskope Service Account

`netskope_service_account` inherits from [User](/data-model/schemas/User.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiTokenIssuedOn` | `number` | Epoch (ms) when the REST API token was issued. Its expiry is on `expiresOn`. |  |
| `appDisplayName` | `string` | Human-readable name of the service account. |  |
| `appId` | `string` | Netskope identifier for the service account. Mirrored on `clientId` to maximise the AIASM nhiAi enricher match surface. |  |
| `authType` | `string` | Authentication method configured for the administrator (e.g. API\_KEY). |  |
| `clientId` | `string` | Identifier the service account authenticates with. |  |
| `isLocked` | `boolean` | Whether the administrator account is locked out. |  |
| `isPasswordResetPending` | `boolean` | Whether a password reset is outstanding for the account. |  |
| `isVerified` | `boolean` | Whether the administrator has accepted their invitation and verified the account. |  |
| `lastActivityOn` | `number` | Epoch (ms) of the last observed activity. |  |
| `lastLoginOn` | `number` | Epoch (ms) of the last console login. |  |
| 
`nhiType` \*

 | `string` |  | **const**: service\_account |
| `provisionedBy` | `string` | How the administrator was created in Netskope: LOCAL, SAML or SCIM. |  |

---

### Netskope Tenant

`netskope_tenant` inherits from [Account](/data-model/schemas/Account.md), [Organization](/data-model/schemas/Organization.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `region` | `string` | Region suffix of the tenant host (e.g. "eu" for a `<tenant>.eu.goskope.com` host). |  |

---

### Netskope Url List

`netskope_url_list` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isPending` | `boolean` | Whether the list has pending (not yet applied) modifications. |  |
| `listType` | `string` | How entries are matched (e.g. exact, regex). |  |
| `urlCount` | `number` | Number of entries in the list. |  |
| `urls` | `array` of `string`s | URL/host/IP entries in the list. |  |

---

### Netskope User

`netskope_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `userAddedTime` | `number` | Epoch (seconds) when the user was added in Netskope. |  |
| `userSource` | `string` | Source that provisioned the user (e.g. Manual, SCIM, IdP). |  |

---

### Netskope User Configuration

`netskope_user_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `addonCheckerHost` | `string` | Addon checker host for the client. |  |
| `addonCheckerResponseCode` | `string` | Expected addon checker response code. |  |
| `addonManagerHost` | `string` | Addon manager host for the client. |  |
| `email` | `string` | Email address the configuration belongs to. |  |
| `orgName` | `string` | Netskope organization name. |  |
| `SFCheckerHost` | `string` | Steering-forward checker host. |  |
| `SFCheckerIP` | `string` | Steering-forward checker IP. |  |

---

## Release Notes

-   **2026-07-10** — Added API v2 support with new entity types including private applications, publishers, URL lists, network access policies and policy groups, discovered applications, and OAuth applications (disabled by default).
-   **2026-04-08** — Improved OS name accuracy for Netskope client device entities, using human-readable names for Windows, macOS, Linux, iOS, Android, and ChromeOS devices.

---

Source: /integrations/directory/nexthink

# Nexthink

Visualize Nexthink-managed endpoints, the users and installed applications on them, and the alerts raised by Nexthink monitors. This integration ingests data through pre-created NQL queries via the Nexthink Infinity API, mapping devices to their users, installed software, and alerts so you can monitor your endpoint estate through queries and alerts in JupiterOne.

## Installation

> **INFO**
> 
> Before configuring the integration you will need:
> 
> -   **Nexthink API credentials** — an OAuth 2.0 client (Client ID and Client Secret) with the `service:integration` scope. In your Nexthink tenant, go to **Administration → Integrations → API credentials**, create a new API client, and note the **Client ID** and **Client Secret**. See [Nexthink's authentication documentation](https://docs.nexthink.com/api/getting-authentication-token) for more information.
>     
> -   **Your tenant ID and region** — the tenant ID is the subdomain of your Nexthink URL (e.g. `acme` from `acme.api.us.nexthink.cloud`). The region is one of `us`, `eu`, `pac`, or `meta`.
>     
> -   **Pre-created NQL queries** — Nexthink exposes no resource-level REST endpoints; all data is retrieved through pre-created NQL queries that you save in your tenant. Create one query per data type you want to ingest before running the integration (see **NQL query setup** below).
>     

To install the Nexthink integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Nexthink. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Nexthink account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Nexthink **Client ID** and **Client Secret** used to authenticate with the Nexthink Infinity API.
    
-   Your **Tenant ID** and **Region**.
    
-   The **NQL Query IDs** for each data type you want to ingest (see below). Each query ID is optional — leave one blank to skip ingesting that data type.
    

### NQL query setup

Because Nexthink has no resource-level REST endpoints, the integration retrieves data by running NQL queries that you pre-create in your tenant under **Administration → NQL API queries**. Each query is assigned an ID that must start with `#` and contain only lowercase letters, digits, and underscores (e.g. `#j1_devices`). Copy each ID into the matching field in the integration configuration.

The recommended queries below select the fields the integration maps. You can adjust them as long as the listed fields are present.

#### Devices — suggested ID `#j1_devices`

```text
devices
| list device.uid, device.name, device.collector.uid,
        device.operating_system.platform, device.operating_system.name,
        device.operating_system.build, device.hardware.manufacturer,
        device.hardware.model, device.hardware.chassis_serial_number,
        device.hardware.machine_serial_number, device.hardware.type,
        device.license_type, device.last_seen, device.first_seen,
        device.entity, device.sid, device.connectivity.last_local_ip
```

#### Users — suggested ID `#j1_users`

```text
users
| list user.uid, user.name, user.upn, user.sid, user.type,
        user.last_seen, user.first_seen, user.entity,
        user.ad.email_address, user.ad.full_name, user.ad.department
```

The `user.ad.*` fields (email, full name, department) are only populated if you have the Entra ID (Azure AD) connector configured in Nexthink.

#### Packages — suggested ID `#j1_packages`

```text
package.installed_packages
| list device.uid, package.uid, package.name,
        package.version, package.publisher, package.type, package.platform
```

#### Alerts — suggested ID `#j1_alerts`

```text
alerts
| list alert.uid, alert.status, alert.trigger_time,
        alert.recovery_time, alert.trigger_value, alert.duration,
        monitor.name, monitor.nql_id, monitor.priority,
        monitor.type, monitor.origin,
        device.uid, user.uid
```

Click **Create** once all values are provided to finalize the integration.

> **NOTE**
> 
> Nexthink controls data volume through the NQL query itself. Large tenants may return very large result sets, so add `where` filters or a `| limit` clause to your queries to bound the volume. The asynchronous export also enforces a license-based maximum number of results; when that maximum is reached the results are truncated and the integration logs a warning so the incomplete ingestion is visible.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (1)

-   `service:integration`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (3)

-   `https://{tenantId}-login.{region}.nexthink.cloud/oauth2/default/v1/token`
-   `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/export`
-   `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/status/{exportId}`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (3)

-   [https://docs.nexthink.com/api/getting-authentication-token.md](https://docs.nexthink.com/api/getting-authentication-token.md)
-   [https://docs.nexthink.com/api/nql/export-an-nql.md](https://docs.nexthink.com/api/nql/export-an-nql.md)
-   [https://docs.nexthink.com/platform/understanding-key-data-platform-concepts/nql-data-model.md](https://docs.nexthink.com/platform/understanding-key-data-platform-concepts/nql-data-model.md)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | OAuth Scopes | Endpoints |
| --- | --- | --- |
| Fetch Alerts | `service:integration` | `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/export`, `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/status/{exportId}` |
| Fetch Devices | `service:integration` | `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/export`, `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/status/{exportId}` |
| Fetch Packages | `service:integration` | `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/export`, `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/status/{exportId}` |
| Fetch Users | `service:integration` | `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/export`, `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/status/{exportId}` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `nexthink_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `nexthink_alert` | [Alert](https://docs.jupiterone.io/data-model/schemas/Alert), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Device | `nexthink_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Package | `nexthink_package` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| User | `nexthink_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `nexthink_account` | **HAS** | `nexthink_device` |
| `nexthink_account` | **HAS** | `nexthink_user` |
| `nexthink_device` | **INSTALLED** | `nexthink_package` |
| `nexthink_device` | **HAS** | `nexthink_alert` |
| `nexthink_user` | **HAS** | `nexthink_alert` |

### Nexthink Account

`nexthink_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`region` \*

 | `string` | The Nexthink region (e.g. us, eu, pac, meta). |  |
| 

`tenantId` \*

 | `string` | The Nexthink tenant/instance identifier. |  |

---

### Nexthink Alert

`nexthink_alert` inherits from [Alert](/data-model/schemas/Alert.md), [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`duration` \*

 | `string` **|** `null` | Duration the alert condition was active. |  |
| 

`monitorName` \*

 | `string` **|** `null` | Name of the Nexthink monitor that triggered the alert. |  |
| 

`monitorNqlId` \*

 | `string` **|** `null` | NQL identifier of the monitor. |  |
| 

`monitorOrigin` \*

 | `string` **|** `null` | Origin of the monitor (e.g. nexthink\_library, custom). |  |
| 

`monitorPriority` \*

 | `string` **|** `null` | Priority of the monitor (e.g. critical, high, medium, low). |  |
| 

`monitorType` \*

 | `string` **|** `null` | Type of monitor (e.g. metric, event). |  |
| 

`triggerValue` \*

 | `string` **|** `null` | The value that triggered the alert. |  |

---

### Nexthink Device

`nexthink_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`collectorUid` \*

 | `string` **|** `null` | Nexthink Collector UID installed on the device. |  |
| 

`entity` \*

 | `string` **|** `null` | Nexthink organizational entity the device belongs to. |  |
| 

`licenseType` \*

 | `string` **|** `null` | Nexthink license type assigned to the device. |  |
| 

`sid` \*

 | `string` **|** `null` | Windows Security Identifier (SID) for the device. |  |

---

### Nexthink Package

`nexthink_package` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`packageType` \*

 | `string` **|** `null` | Package type (e.g. msi, exe, deb, rpm). |  |
| 

`platform` \*

 | `string` **|** `null` | Operating system platform the package targets. |  |
| 

`publisher` \*

 | `string` **|** `null` | Software publisher/vendor name. |  |
| 

`version` \*

 | `string` **|** `null` | Package version string. |  |

---

### Nexthink User

`nexthink_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`department` \*

 | `string` **|** `null` | Department from Active Directory (requires Entra ID connector). |  |
| 

`entity` \*

 | `string` **|** `null` | Nexthink organizational entity the user belongs to. |  |
| 

`sid` \*

 | `string` **|** `null` | Windows Security Identifier (SID) for the user. |  |
| 

`upn` \*

 | `string` **|** `null` | User Principal Name (UPN) from Active Directory. |  |
| 

`userType` \*

 | `string` **|** `null` | Nexthink user type (e.g. local, domain). |  |

---

---

Source: /integrations/directory/ninja-one

# NinjaOne

Visualize NinjaOne Users, Devices, Policies, Alerts, and monitor changes through queries and alerts.

## Installation

### Requirements

-   User requires Client ID and Client Secret generated in NinjaOne Account.
-   You must have permission in JupiterOne to install new integrations.

### Configuration in NinjaOne

#### Create Client App and Generate Client ID and Client Secret

1.  Visit the [Apps page](https://app.ninjarmm.com/#/administration/apps) in the NinjaOne portal.
2.  Navigate to the **API** tab.
3.  Select **Client App IDs**.
4.  Click the **Add** button and choose **Application Platform** as Web (PHP, Java, .NET Core, etc.).
5.  Provide a **Name** for the Client Application.
6.  Select the **Monitoring & Management Scope** checkbox.
7.  Under **Allowed grant types**, select **Client Credentials** and **Refresh Token**.
8.  Click the **Save** button.
9.  Copy the **Client Secret**—it will disappear once you close the window.
10.  Close the window and copy the **Client ID**. This will be needed for configuring the integration in the JupiterOne portal.

### Configuration in JupiterOne

1.  From the top navigation of the J1 Search homepage, select **Integrations**
2.  Search for the **NinjaOne** and select it.
3.  Click on the **Add Instance** button and configure the following settings:

-   Enter the **Account Name** by which you'd like to identify this NinjaOne Cloud instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
-   Enter a **Description** that will further assist your team when identifying the integration instance.
-   Select a **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
-   Enter the **NinjaOne Client ID** generated for use by JupiterOne.
-   Enter the **NinjaOne Client Secret** generated for use by JupiterOne.
-   (Optional) Enter a **Custom Fields Allow List**: a comma-separated list of NinjaOne custom field names to ingest onto `ninjaone_device` entities as `customField.<name>` properties (for example, `Browser Extensions,Asset Tag`). Use each field's name as configured in NinjaOne. Leave this empty to skip custom field ingestion. Each field you list must have its **API** permission set to at least **Read Only** in its NinjaOne custom field permission settings, otherwise NinjaOne does not return its value over the API.

4.  Click **Create Configuration** once all values are provided.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `ninjaone_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `ninjaone_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Device | `ninjaone_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Incident | `ninjaone_alert` | [Alert](https://docs.jupiterone.io/data-model/schemas/Alert) |
| Policy | `ninjaone_controlpolicy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| User | `ninjaone_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `ninjaone_account` | **OWNS** | `ninjaone_device` |
| `ninjaone_account` | **HAS** | `ninjaone_application` |
| `ninjaone_controlpolicy` | **ENFORCES** | `ninjaone_device` |
| `ninjaone_device` | **HAS** | `ninjaone_alert` |
| `ninjaone_device` | **INSTALLED** | `ninjaone_application` |
| `ninjaone_user` | **OWNS** | `ninjaone_device` |

### Ninjaone Account

`ninjaone_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_key` \*

 | `string` |  |  |
| 

`mfaEnabled` \*

 | `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Ninjaone Alert

`ninjaone_alert` inherits from [Alert](/data-model/schemas/Alert.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_key` \*

 | `string` |  |  |
| 

`deviceId` \*

 | `number` |  |  |
| 

`message` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`sourceConfigUid` \*

 | `string` |  |  |
| 

`sourceName` \*

 | `string` |  |  |
| `sourceType` | `string` |  |  |
| `subject` | `string` |  |  |
| `ticketTemplateId` | `number` |  |  |
| `userId` | `number` |  |  |

---

### Ninjaone Application

`ninjaone_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`productCode` \*

 | `string` **|** `null` |  |  |
| 

`publisher` \*

 | `string` **|** `null` |  |  |
| 

`version` \*

 | `string` **|** `null` |  |  |

---

### Ninjaone Controlpolicy

`ninjaone_controlpolicy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_key` \*

 | `string` |  |  |
| `description` | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`nodeClass` \*

 | `string` |  |  |
| 

`nodeClassDefault` \*

 | `boolean` |  |  |
| `parentPolicyId` | `number` |  |  |
| `tags` | `array` of `string`s |  |  |

---

### Ninjaone Device

`ninjaone_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`approvalStatus` \*

 | `string` |  |  |
| `biosSerialNumber` | `string` |  |  |
| `bitLockerConversionStatus` | `string` |  | **Any of**:

-   `FULLY_DECRYPTED`

-   `FULLY_ENCRYPTED`

-   `ENCRYPTION_IN_PROGRESS`

-   `DECRYPTION_IN_PROGRESS`

-   `ENCRYPTION_PAUSED`

-   `DECRYPTION_PAUSED`

-   `UNKNOWN`

 |
| `bitLockerEncryptionMethod` | `string` |  | **Any of**:

-   `NONE`

-   `AES_128_WITH_DIFFUSER`

-   `AES_256_WITH_DIFFUSER`

-   `AES_128`

-   `AES_256`

-   `HARDWARE_ENCRYPTION`

-   `XTS_AES_128`

-   `XTS_AES_256`

-   `UNKNOWN`

 |
| `bitLockerInitializedForProtection` | `boolean` |  |  |
| `bitLockerLockStatus` | `string` |  | **Any of**:

-   `UNKNOWN`

-   `UNLOCKED`

-   `LOCKED`

 |
| `bitLockerProtectionStatus` | `string` |  | **Any of**:

-   `UNPROTECTED`

-   `PROTECTED`

-   `UNKNOWN`

-   `PENDING`

 |
| `bitLockerVolumeName` | `string` | The name of the first volume with BitLocker enabled. Multiple volumes with BitLocker enabled will not be represented. |  |
| 

`category` \*

 | `string` |  |  |
| `chassisType` | `string` |  |  |
| `domainRole` | `string` |  |  |
| `ipAddresses` | `array` of `string`s |  |  |
| `isVirtualMachine` | `boolean` |  |  |
| `lastLoggedInUser` | `string` |  |  |
| 

`locationId` \*

 | `number` |  |  |
| `memoryCapacity` | `number` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`nodeClass` \*

 | `string` |  |  |
| 

`nodeRoleId` \*

 | `number` |  |  |
| `numberOfProcessors` | `number` |  |  |
| 

`organizationId` \*

 | `number` |  |  |
| `osArchitecture` | `string` |  |  |
| `osBuildNumber` | `string` |  |  |
| `osLanguage` | `string` |  |  |
| `osLastBootOn` | `number` |  |  |
| `osLocale` | `string` |  |  |
| `osNeedsReboot` | `boolean` |  |  |
| `osServicePackMajorVersion` | `number` |  |  |
| `osServicePackMinorVersion` | `number` |  |  |
| `policyId` | `number` |  |  |
| `processorArchitectures` | `array` of `string`s |  |  |
| `processorClockSpeeds` | `array` of `number`s |  |  |
| `processorMaxClockSpeeds` | `array` of `number`s |  |  |
| `processorNames` | `array` of `string`s |  |  |
| `processorNumCores` | `array` of `number`s |  |  |
| `processorNumLogicalCores` | `array` of `number`s |  |  |
| `publicIP` | `string` |  |  |
| 

`rolePolicyId` \*

 | `number` |  |  |
| `totalPhysicalMemory` | `string` |  |  |
| `totalPhysicalMemoryInBytes` | `number` |  |  |

---

### Ninjaone User

`ninjaone_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `fields` | `array` of `string`s |  |  |
| 
`invitationStatus` \*

 | `string` |  |  |
| 

`mustChangePassword` \*

 | `boolean` |  |  |
| 

`notifyAllClients` \*

 | `boolean` |  |  |
| 

`permitAllClients` \*

 | `boolean` |  |  |
| 

`phoneNumber` \*

 | `string` |  |  |
| `tags` | `array` of `string`s |  |  |
| 

`userType` \*

 | `string` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS details for NinjaOne device entities, adding OS build number alongside the OS name.
-   **2026-02-23** — Added software inventory ingestion to NinjaOne, providing visibility into installed applications and versions across managed devices.
-   **2025-12-09** — Added configuration option for NinjaOne server URL, supporting regional server endpoints for EU, US2, and Oceania deployments.

---

Source: /integrations/directory/nowsecure

# NowSecure

Visualize NowSecure users, services, applications, and findings, map NowSecure users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to provide an API key from your NowSecure account. See [their documentation](https://support.nowsecure.com/hc/en-us/articles/7499657262093-Creating-an-API-Bearer-Token-in-Platform) for more information.

### Configuration in JupiterOne

To install the NowSecure integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select NowSecure. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the NowSecure account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   lastly, your NowSecure **API Key**.
    

Click **Create** once all values are provided to finalize the integration.

> **NOTE**
> 
> By default, JupiterOne ingests findings from the past 30 days. You can adjust the configuration to ingest findings from the latest scan reports if you have a NowSecure Enterprise Plan.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `nowsecure_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Finding | `nowsecure_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Mobile Applications | `mobile_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Service | `nowsecure_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `nowsecure_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `mobile_app` | **HAS** | `nowsecure_finding` |
| `nowsecure_account` | **PROVIDES** | `nowsecure_service` |
| `nowsecure_account` | **HAS** | `nowsecure_user` |
| `nowsecure_account` | **HAS** | `mobile_app` |
| `nowsecure_service` | **SCANS** | `mobile_app` |

---

Source: /integrations/directory/nozomi

# Nozomi Networks

Visualize your Nozomi Networks Vantage OT, IoT, and IT assets in the JupiterOne graph. Ingest the devices discovered on your operational-technology network along with their network security alerts and CVE-backed vulnerabilities, and monitor your OT/ICS security posture through queries and alerts.

## Installation

The Nozomi Networks integration ingests your Nozomi Vantage asset inventory, network security alerts, and CVE-backed vulnerabilities using the Vantage REST and pipe-query APIs. It authenticates with a Vantage API key (a key name and key token), which Vantage exchanges for a short-lived bearer token, then reads nodes (devices), alerts, and node CVEs to build a graph of your OT/IoT/IT environment.

### Prerequisites

-   A **Nozomi Networks Vantage** account, and the base URL you use to reach the Vantage web UI (for example, `https://<tenant>.nozominetworks.io`).
-   A Vantage user with permission to view the assets, alerts, and vulnerabilities you want to ingest. An API key inherits the data-access permissions of the user that owns it.
-   A Vantage **API key** (key name and key token) — see below.
-   Access to JupiterOne with permission to configure integrations.

### Obtaining a Nozomi API key

1.  Sign in to Vantage as the user who will own the API key. The key inherits that user's data-access permissions.
2.  Select **Profile** in the top navigation bar, then select **API Keys**.
3.  Generate a new API key and record its **Key Name** and **Key Token**.

> **CAUTION**
> 
> The key token is displayed only once, at generation time. If you lose it, you must generate a new API key, so store the token securely.

For more detail, see the Nozomi [API key authentication documentation](https://technicaldocs.nozominetworks.com/products/vantage/topics/administration/teams/c_vantage_admin_teams_api-keys_authentication.html).

### Configuration in JupiterOne

To install the Nozomi Networks integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Nozomi Networks**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Nozomi account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **Nozomi Vantage URL** — the base URL of your Vantage instance (the same URL you use for the web UI), in the form `https://<tenant>.nozominetworks.io`. This field is required.
    
-   Your **Nozomi API Key Name** — the API key name generated in your Vantage user profile. This field is required.
    
-   Your **Nozomi API Key Token** — the API key token generated alongside the key name. This field is required.
    
-   **Historical Days** — the number of days of historical alerts to retrieve (`7`, `30`, `90`, `180`, or `365`; default `30`). Vulnerabilities are not time-bounded; the current set of matched CVEs is always ingested in full.
    
-   Optionally, **Disable TLS Verification** — intended only for on-premises Nozomi deployments that do not present a valid TLS certificate. Leave this off whenever possible and install valid certificates instead.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (5)

-   `/api/open/query/do?query=alerts`
-   `/api/open/query/do?query=node_cves`
-   `/api/open/query/do?query=nodes`
-   `/api/v1/keys/sign_in`
-   `/api/v1/organizations/mine`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (4)

-   [https://technicaldocs.nozominetworks.com/products/n2os/topics/sdk/data-model/r\_n2os-sdk\_data\_model\_alerts.html](https://technicaldocs.nozominetworks.com/products/n2os/topics/sdk/data-model/r_n2os-sdk_data_model_alerts.html)
-   [https://technicaldocs.nozominetworks.com/products/n2os/topics/sdk/data-model/r\_n2os-sdk\_data\_model\_node\_cves.html](https://technicaldocs.nozominetworks.com/products/n2os/topics/sdk/data-model/r_n2os-sdk_data_model_node_cves.html)
-   [https://technicaldocs.nozominetworks.com/products/n2os/topics/sdk/data-model/r\_n2os-sdk\_data\_model\_nodes.html](https://technicaldocs.nozominetworks.com/products/n2os/topics/sdk/data-model/r_n2os-sdk_data_model_nodes.html)
-   [https://technicaldocs.nozominetworks.com/products/vantage/topics/administration/teams/c\_vantage\_admin\_teams\_api-keys\_authentication.html](https://technicaldocs.nozominetworks.com/products/vantage/topics/administration/teams/c_vantage_admin_teams_api-keys_authentication.html)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (2)

| Step | Endpoints |
| --- | --- |
| Fetch Alerts | `/api/open/query/do?query=alerts` |
| Fetch Vulnerabilities | `/api/open/query/do?query=node_cves` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `nozomi_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `nozomi_finding_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Device | `nozomi_device` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Service | `nozomi_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Vulnerability | `nozomi_finding_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `nozomi_account` | **PROVIDES** | `nozomi_service` |
| `nozomi_account` | **MANAGES** | `nozomi_device` |
| `nozomi_device` | **HAS** | `nozomi_finding_alert` |
| `nozomi_device` | **HAS** | `nozomi_finding_vulnerability` |
| `nozomi_service` | **IDENTIFIED** | `nozomi_finding_alert` |
| `nozomi_service` | **IDENTIFIED** | `nozomi_finding_vulnerability` |

### Nozomi Account

`nozomi_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`url` \*

 | `string` | The base URL of the Nozomi Vantage instance |  |

---

### Nozomi Device

`nozomi_device` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `firstSeenOn` | `number` | Epoch milliseconds when the device first sent a packet |  |
| 
`isCompromised` \*

 | `boolean` **|** `null` | True if the device was recognised as compromised |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | True if this is an outside, public IP rather than a local node |  |
| 

`macVendor` \*

 | `string` **|** `null` | Vendor of the device MAC address, when known |  |
| 

`nodeType` \*

 | `string` **|** `null` | The Nozomi node type (e.g. PLC, HMI, computer) |  |
| 

`protocols` \*

 | `array` **|** `null` | Unique protocols observed from and to the device |  |
| 

`purdueLevel` \*

 | `string` **|** `null` | The Purdue-model level of the device (OT segmentation) |  |
| 

`subnet` \*

 | `string` **|** `null` | The subnet to which the device belongs, if any |  |
| 

`vlanId` \*

 | `string` **|** `null` | The VLAN identifier of the device, if VLAN-tagged |  |
| 

`zone` \*

 | `string` **|** `null` | The Nozomi network zone the device belongs to |  |

---

### Nozomi Finding Alert

`nozomi_finding_alert` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applianceHost` \*

 | `string` **|** `null` | Hostname of the sensor where the alert was observed |  |
| 

`applianceSite` \*

 | `string` **|** `null` | Site name of the sensor where the alert was observed |  |
| 

`closedOn` \*

 | `number` **|** `null` | Epoch milliseconds when the alert was closed |  |
| 

`ipDst` \*

 | `string` **|** `null` | Destination IP address of the alert |  |
| 

`ipSrc` \*

 | `string` **|** `null` | Source IP address of the alert |  |
| 

`isAcknowledged` \*

 | `boolean` **|** `null` | True if the alert has been acknowledged |  |
| 

`isIncident` \*

 | `boolean` **|** `null` | True if the alert is an incident grouping more alerts |  |
| 

`isSecurity` \*

 | `boolean` **|** `null` | True if the alert is a cybersecurity alert |  |
| 

`protocol` \*

 | `string` **|** `null` | The protocol in which the alert was observed |  |
| 

`threatName` \*

 | `string` **|** `null` | The threat name, when the alert matches a known threat |  |
| 

`zoneDst` \*

 | `string` **|** `null` | Destination zone of the alert |  |
| 

`zoneSrc` \*

 | `string` **|** `null` | Source zone of the alert |  |

---

### Nozomi Finding Vulnerability

`nozomi_finding_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cveScore` \*

 | `number` **|** `null` | CVSS score assigned to the CVE |  |
| 

`cveSource` \*

 | `string` **|** `null` | The entity that provided the CVE information |  |
| 

`cweId` \*

 | `string` **|** `null` | The CWE (vulnerability category) identifier |  |
| 

`isResolved` \*

 | `boolean` **|** `null` | Whether the vulnerability has been resolved |  |
| 

`latestHotfix` \*

 | `string` **|** `null` | Latest hotfix to install to resolve the CVE |  |
| 

`minimumHotfix` \*

 | `string` **|** `null` | Minimum hotfix to install to resolve the CVE |  |
| 

`zone` \*

 | `string` **|** `null` | Network zone of the vulnerable node |  |

---

### Nozomi Service

`nozomi_service` inherits from [Service](/data-model/schemas/Service.md)

---

## Release Notes

-   **2026-07-21** — Added initial Nozomi Networks Vantage integration, ingesting OT and IoT devices, security alerts, and vulnerability findings with their relationships.

---

Source: /integrations/directory/npm

# npm

Visualize NPM users, groups, and packages, map NPM users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> For this integration, you will need to create an NPM token with `Read only` access. See [their documentation](https://docs.npmjs.com/creating-and-viewing-authentication-tokens) for more information.

### Configuration in JupiterOne

To install the NPM integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select NPM. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the NPM account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **NPM Organization** and **Access Token** (configured for read access).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Package | `npm_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Team | `npm_team` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| User | `npm_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `npm_team` | **HAS** | `npm_user` |

### Npm User

`npm_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admin` | `boolean` |  |  |
| `role` | `string` |  |  |

---

---

Source: /integrations/directory/nutanix

# Nutanix

Visualize your Nutanix infrastructure in JupiterOne — Prism Central accounts, clusters, hosts, and virtual machines — map hosts to the workloads they run, and monitor changes through queries and alerts.

## Installation

This integration connects to a Nutanix Prism Central instance using the Nutanix v4.2 REST APIs and ingests clusters, hosts (physical nodes), and virtual machines. It is a collector-based integration and communicates with Prism Central over HTTPS on port `9440`.

### Configuration in Nutanix

Before configuring the integration in JupiterOne, prepare the following in Nutanix Prism Central:

-   The **hostname or IP address** of your Prism Central instance, reachable from the JupiterOne collector on port `9440`.
-   A **local or authentication-domain user** for the integration to authenticate as. Assign it a role with at least read (**Viewer**) access to clusters, hosts, and virtual machines.
-   The **username** and **password** for that user.
-   If Prism Central presents a self-signed or internal-CA TLS certificate, obtain the **CA certificate** (in PEM format) so the collector can verify the connection.

Once you have obtained the information above, proceed to JupiterOne to finalize the integration.

### Configuration in JupiterOne

To install the Nutanix integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Nutanix**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Nutanix account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Prism Central **Host**, **Username**, and **Password**.
    
-   Optionally, a **CA Certificate** to trust a self-signed or internal-CA certificate, or enable **Disable TLS Verification** to skip certificate validation (not recommended).
    
-   Optionally, enable **Include Powered-Off VMs** to also ingest virtual machines that are powered off.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `Viewer`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (3)

-   `https://<prism-central-host>:9440/api/clustermgmt/v4.0/config/clusters`
-   `https://<prism-central-host>:9440/api/clustermgmt/v4.0/config/hosts`
-   `https://<prism-central-host>:9440/api/vmm/v4.0/ahv/config/vms`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (3)

-   [https://developers.nutanix.com/api-reference?namespace=clustermgmt&version=v4.0](https://developers.nutanix.com/api-reference?namespace=clustermgmt&version=v4.0)
-   [https://developers.nutanix.com/api-reference?namespace=vmm&version=v4.0](https://developers.nutanix.com/api-reference?namespace=vmm&version=v4.0)
-   [https://www.nutanix.dev/api-reference-v4/](https://www.nutanix.dev/api-reference-v4/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (2)

| Step | Roles | Endpoints |
| --- | --- | --- |
| Fetch Hosts | `Viewer` | `https://<prism-central-host>:9440/api/clustermgmt/v4.0/config/hosts` |
| Fetch Virtual Machines | `Viewer` | `https://<prism-central-host>:9440/api/vmm/v4.0/ahv/config/vms` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `nutanix_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cluster | `nutanix_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Host | `nutanix_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| VirtualMachine | `nutanix_vm` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `nutanix_account` | **HAS** | `nutanix_cluster` |
| `nutanix_cluster` | **HAS** | `nutanix_host` |
| `nutanix_cluster` | **CONTAINS** | `nutanix_vm` |
| `nutanix_host` | **HOSTS** | `nutanix_vm` |

### Nutanix Account

`nutanix_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Nutanix Cluster

`nutanix_cluster` inherits from [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`clusterFqdn` \*

 | `string` **|** `null` | Fully qualified domain name of the cluster. |  |
| 

`clusterType` \*

 | `string` **|** `null` | The type of cluster (e.g. AOS, PRISM\_CENTRAL). |  |
| 

`encryptionInTransitStatus` \*

 | `string` **|** `null` | Encryption-in-transit status for the cluster. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | Cluster external (virtual) IPv4 address. |  |
| 

`hypervisorTypes` \*

 | `array` **|** `null` | Hypervisor types running on the cluster (e.g. AHV, ESX). |  |
| 

`version` \*

 | `string` **|** `null` | Cluster software (AOS) build version. |  |
| 

`vmCount` \*

 | `number` **|** `null` | Number of VMs running on the cluster. |  |

---

### Nutanix Host

`nutanix_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cpuCapacityHz` \*

 | `number` **|** `null` | Total CPU capacity of the host in Hz. |  |
| 

`cpuFrequencyHz` \*

 | `number` **|** `null` | CPU frequency of the host in Hz. |  |
| 

`cpuModel` \*

 | `string` **|** `null` | CPU model name of the host. |  |
| 

`hypervisorState` \*

 | `string` **|** `null` | Current state of the hypervisor on the host. |  |
| 

`hypervisorType` \*

 | `string` **|** `null` | Hypervisor type running on the host (e.g. AHV). |  |
| 

`isDegraded` \*

 | `boolean` **|** `null` | Whether the node is in a degraded state. |  |
| 

`isSecureBooted` \*

 | `boolean` **|** `null` | Whether the host booted with Secure Boot enabled. |  |
| 

`maintenanceState` \*

 | `string` **|** `null` | Maintenance state of the host. |  |
| 

`memorySizeBytes` \*

 | `number` **|** `null` | Total memory size of the host in bytes. |  |
| 

`numCpuCores` \*

 | `number` **|** `null` | Number of CPU cores on the host. |  |
| 

`numCpuSockets` \*

 | `number` **|** `null` | Number of CPU sockets on the host. |  |
| 

`numCpuThreads` \*

 | `number` **|** `null` | Number of CPU threads on the host. |  |

---

### Nutanix Vm

`nutanix_vm` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`biosUuid` \*

 | `string` **|** `null` | BIOS UUID of the VM. |  |
| 

`categoryIds` \*

 | `array` **|** `null` | External ids of the categories associated with the VM. |  |
| 

`ipAddresses` \*

 | `array` **|** `null` | IPv4 addresses learned on the VM NICs, as reported by the guest. |  |
| 

`isAgentVm` \*

 | `boolean` **|** `null` | Whether the VM is an agent VM. |  |
| 

`isLiveMigrateCapable` \*

 | `boolean` **|** `null` | Whether the VM is capable of live migration. |  |
| 

`memorySizeBytes` \*

 | `number` **|** `null` | Memory size assigned to the VM in bytes. |  |
| 

`numCoresPerSocket` \*

 | `number` **|** `null` | Number of cores per socket assigned to the VM. |  |
| 

`numSockets` \*

 | `number` **|** `null` | Number of vCPU sockets assigned to the VM. |  |
| 

`numThreadsPerCore` \*

 | `number` **|** `null` | Number of threads per core assigned to the VM. |  |
| 

`powerState` \*

 | `string` **|** `null` | Power state of the VM (ON, OFF, PAUSED, UNDETERMINED). |  |
| 

`protectionType` \*

 | `string` **|** `null` | Data protection type applied to the VM. |  |

---

## Release Notes

-   **2026-07-14** — Nutanix virtual machines are now classified as hosts and participate in unified device correlation across integrations.
-   **2026-07-14** — Added hostname to Nutanix virtual machine entities.
-   **2026-07-10** — Added initial Nutanix integration support, ingesting accounts, clusters, physical hosts, and virtual machines with their relationships.

---

Source: /integrations/directory/okta

# Okta

Visualize Okta users, groups, devices, applications, and services, map users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to create an [API Token on Okta](https://help.okta.com/en-us/Content/Topics/Security/API.htm#create-okta-api-token) from an Okta account with admin permissions. Ensure that you are in admin-mode when creating the token by selecting the **Admin** button in the top right prior to creating the API Token.

> **NOTE**
> 
> Depending on the Okta account's admin role level, fetching role information requires the supplied token to have `Super Administrator` privileges. If `Read Only Administrator` or `Organization Administrator` are provided instead, the step will fail, but all other ingestion steps will remain unaffected.

Per the Okta documentation: API tokens are valid for 30 days and automatically renew every time they are used with an API request. When a token has been inactive for more than 30 days it is revoked and cannot be used again. Tokens are also only valid if the user who created the token is also active.

> **INFO**
> 
> For additional information regarding Okta API tokens, see [their documentation](https://help.okta.com/en-us/Content/Topics/Security/API.htm) for more information.

### Configuration in JupiterOne

To install the Okta integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Okta. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Okta account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Enter the **Organization URL** unique to your Okta organization and your Okta **API Key**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Okta Account | `okta_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Okta App UserGroup | `okta_app_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Okta Application | `okta_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Okta Device | `okta_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Okta Factor Device | `mfa_device` | [Key](https://docs.jupiterone.io/data-model/schemas/Key), [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Okta Role | `okta_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Okta Rule | `okta_rule` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Okta Service | `okta_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service), [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Okta User | `okta_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Okta UserGroup | `okta_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `okta_account` | **MANAGES** | `okta_service` |
| `okta_account` | **HAS** | `okta_service` |
| `okta_account` | **HAS** | `okta_user` |
| `okta_account` | **HAS** | `okta_user_group` |
| `okta_account` | **HAS** | `okta_app_user_group` |
| `okta_account` | **HAS** | `okta_application` |
| `okta_account` | **HAS** | `okta_rule` |
| `okta_account` | **MANAGES** | `okta_device` |
| `okta_app_user_group` | **HAS** | `okta_user` |
| `okta_rule` | **MANAGES** | `okta_user_group` |
| `okta_user` | **ASSIGNED** | `mfa_device` |
| `okta_user` | **MANAGES** | `okta_user` |
| `okta_user` | **ASSIGNED** | `okta_application` |
| `okta_user` | **ASSIGNED** | `aws_iam_role` |
| `okta_user` | **ASSIGNED** | `okta_role` |
| `okta_user` | **CREATED** | `okta_application` |
| `okta_user` | **OWNS** | `okta_device` |
| `okta_user_group` | **HAS** | `okta_user` |
| `okta_user_group` | **ASSIGNED** | `aws_iam_role` |
| `okta_user_group` | **ASSIGNED** | `okta_role` |
| `okta_user_group, okta_app_user_group` | **ASSIGNED** | `okta_application` |

### Mfa Device

`mfa_device` inherits from [Key](/data-model/schemas/Key.md), [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `authenticatorName` | `string` |  |  |
| `created` | `number` | Please use `createdOn` instead | **deprecated**: true |
| `credentialId` | `string` |  |  |
| `device` | `string` |  |  |
| `deviceType` | `string` |  |  |
| `factorType` | `string` |  | `call`, `email`, `hotp`, `push`, `question`, `sms`, `token`, `token:hardware`, `token:hotp`, `token:software:totp`, `u2f`, `web`, `webauthn` |
| `lastUpdated` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `lastVerifiedOn` | `number` |  |  |
| `platform` | `string` |  |  |
| `profileName` | `string` |  |  |
| `provider` | `string` |  | `CUSTOM`, `DUO`, `FIDO`, `GOOGLE`, `OKTA`, `RSA`, `SYMANTEC`, `YUBICO` |
| `status` | `string` |  | `active`, `inactive`, `pending_activation`, `disabled`, `enrolled`, `expired`, `not_setup` |
| `vendorName` | `string` |  |  |

---

### Okta Account

`okta_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`supportEnabled` \*

 | `boolean` |  |  |
| `supportExpiresOn` | `number` |  |  |

---

### Okta App User Group

`okta_app_user_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `created` | `number` |  |  |
| `lastMembershipUpdated` | `number` | Please use `lastMembershipUpdatedOn` instead | **deprecated**: true |
| `lastMembershipUpdatedOn` | `number` |  |  |
| `lastUpdated` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `lastUpdatedOn` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `objectClass` | `array` of `string`s |  |  |
| `type` | `string` |  | `APP_GROUP`, `BUILT_IN`, `OKTA_GROUP` |

---

### Okta Application

`okta_application` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`adminNotes` \*

 | `string` **|** `null` |  |  |
| `appAccountType` | `string` **|** `array` |  |  |
| `appVendorName` | `string` | Human readable, capitalized vendor name  
  
**Examples**: Atlassian, Snyk |  |
| `created` | `number` | Please use `createdOn` instead | **deprecated**: true |
| 

`endUserNotes` \*

 | `string` **|** `null` |  |  |
| `features` | `array` of `string`s |  |  |
| `imageUrl` | `string` |  |  |
| `isMultiInstanceApp` | `boolean` | True if one of: aws, githubcloud, gcp, google, office365 |  |
| `isSAMLApp` | `boolean` | True if the application is a SAML application |  |
| `label` | `string` |  |  |
| `lastUpdated` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `loginUrl` | `string` |  |  |
| `oauthApplicationType` | `string` | OAuth client application type: web, native, browser, or service |  |
| `oauthClientUri` | `string` | Publisher-supplied landing page URL for the OAuth client |  |
| `oauthConsentMethod` | `string` | OAuth consent flow: REQUIRED (end-user consent) or TRUSTED (admin pre-approved — risk signal for third-party access) |  |
| `oauthGrantTypes` | `array` of `string`s | OAuth grant types the client is configured for (e.g. authorization\_code, client\_credentials, refresh\_token) |  |
| `oauthLogoUri` | `string` | Publisher-supplied URL of the client's logo |  |
| `oauthPolicyUri` | `string` | Publisher-supplied privacy policy URL |  |
| `oauthPostLogoutRedirectUris` | `array` of `string`s | OAuth post-logout redirect URIs the client is allowed to use |  |
| `oauthRedirectUris` | `array` of `string`s | OAuth redirect URIs the client is allowed to use after authorization |  |
| `oauthTosUri` | `string` | Publisher-supplied terms of service URL |  |
| `shortName` | `string` | **Examples**: aws, gcp |  |
| `signOnAttribute` | `array` of `string`s |  |  |
| `signOnMode` | `string` |  | `AUTO_LOGIN`, `BASIC_AUTH`, `BOOKMARK`, `BROWSER_PLUGIN`, `OPENID_CONNECT`, `SAML_1_1`, `SAML_2_0`, `SECURE_PASSWORD_STORE`, `WS_FEDERATION` |

---

### Okta Device

`okta_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `deviceStatus` | `string` |  | `active`, `created`, `deactivated`, `suspended` |
| `isRegistered` | `boolean` |  |  |
| `platform` | `string` |  |  |
| `registered` | `boolean` | Please use `isRegistered` instead | **deprecated**: true |

---

### Okta Role

`okta_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `lastUpdatedOn` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `roleType` | `string` |  | `API_ACCESS_MANAGEMENT_ADMIN`, `APP_ADMIN`, `GROUP_MEMBERSHIP_ADMIN`, `HELP_DESK_ADMIN`, `MOBILE_ADMIN`, `ORG_ADMIN`, `READ_ONLY_ADMIN`, `REPORT_ADMIN`, `SUPER_ADMIN`, `USER_ADMIN` |
| `status` | `string` |  | `active`, `inactive` |

---

### Okta Rule

`okta_rule` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `actions` | `string` | JSON stringified object of actions |  |
| `conditions` | `string` | JSON stringified object of conditions |  |
| `created` | `number` | Please use `createdOn` instead | **deprecated**: true |
| `lastUpdated` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `lastUpdatedOn` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `ruleType` | `string` | **Examples**: group\_rule, policy\_rule |  |
| `status` | `string` |  | `active`, `inactive`, `invalid` |

---

### Okta Service

`okta_service` inherits from [Service](/data-model/schemas/Service.md), [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` of `string`s |  |  |
| 

`controlDomain` \*

 | `string` |  | **const**: identity-access |

---

### Okta User

`okta_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activated` | `number` | Please use `activatedOn` instead | **deprecated**: true |
| `activatedOn` | `number` |  |  |
| `countryCode` | `string` |  |  |
| `created` | `number` |  |  |
| `credentialProvider` | `string` | The type of authentication provider backing the user (e.g. OKTA for native credentials, FEDERATION for SSO-bound). | **Any of**:
-   `ACTIVE_DIRECTORY`

-   `FEDERATION`

-   `IMPORT`

-   `LDAP`

-   `OKTA`

-   `SOCIAL`

 |
| `credentialProviderName` | `string` | The display name of the authentication provider (e.g. an AD domain or federated IdP label). |  |
| `employeeType` | `string` | Employment classification from Okta user profile (e.g. "Full-time", "Contractor"). Custom attribute configured per-organization. |  |
| `hiredOn` | `number` |  |  |
| `isMfaEnabled` | `boolean` |  |  |
| `isSsoBound` | `boolean` | True when the user authenticates through a federated SSO provider (credentialProvider === FEDERATION). |  |
| `lastLogin` | `number` | Please use `lastLoginOn` instead | **deprecated**: true |
| `lastLoginOn` | `number` |  |  |
| `lastUpdated` | `number` | Please use `lastUpdatedOn` instead | **deprecated**: true |
| `lastUpdatedOn` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `managerId` | `string` |  |  |
| 

`memberOfGroupId` \*

 | `undefined` |  |  |
| `passwordChanged` | `number` | Please use `passwordChangedOn` instead | **deprecated**: true |
| `passwordChangedOn` | `number` |  |  |
| `statusChanged` | `number` | Please use `statusChangedOn` instead | **deprecated**: true |
| `statusChangedOn` | `number` |  |  |
| `terminatedOn` | `number` |  |  |
| `unverifiedEmails` | `array` of `string`s |  | 

**Format**: `email`

  
 |
| `verifiedEmails` | `array` of `string`s |  | 

**Format**: `email`

  
 |

---

### Okta User Group

`okta_user_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `created` | `number` |  |  |
| `lastMembershipUpdated` | `number` | Please use `lastMembershipUpdatedOn` instead | **deprecated**: true |
| `lastMembershipUpdatedOn` | `number` |  |  |
| `lastUpdated` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `lastUpdatedOn` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `objectClass` | `array` of `string`s |  |  |
| `type` | `string` |  | `APP_GROUP`, `BUILT_IN`, `OKTA_GROUP` |

---

## Release Notes

-   **2026-04-08** — Improved OS name display for Okta device entities, providing human-readable names for all supported platforms.
-   **2026-03-05** — Added MFA enabled status property to Okta user entities, indicating whether a user has active MFA configured.
-   **2025-10-09** — Added management hierarchy relationships linking Okta users to the users who manage them.
-   **2025-06-16** — Added notes field and configuration option to Okta user entities for storing user notes.
-   **2025-05-12** — Added device management status property to Okta user-to-device relationships.

---

Source: /integrations/directory/one-trust

# OneTrust

Visualize OneTrust users, groups, risk, and vendors, and monitor changes through queries and alerts.

## Installation

### Requirements

-   User must have an active OneTrust account with **API access**.
-   User must have permission in JupiterOne to install new integrations.

### Configuration in OneTrust

#### Generate OAuth 2.0 Client Credentials and collect Host URL

1.  **Log in** to your OneTrust account.
2.  Click the **gear icon** in the upper-right corner to access **Global Settings**.
3.  From the Global Settings menu, select **Access Management** > **Client Credentials**. The **Credentials** screen appears.
4.  Click the **Add** button. The **Add Client Credential** screen will open.
5.  In the **Name** field, enter a name for the client credential.
6.  (Optional) In the **Description** field, provide a description for the client credential.
7.  In the Access Token Lifetime field, set the duration of the access token to 1 hour.
8.  (Optional) Enable the **Restrict IP Addresses** setting to restrict incoming communication to specific IP addresses. If enabled, enter the allowed IP addresses. You can add multiple IPs by clicking the **Add** icon.
9.  Click **Next**. The **Scope** section appears.
10.  Select following Scopes
     -   RISK\_READ: To fetch Risk Data
     -   SCIM: To fetch User and Group Data
     -   INVENTORY\_READ: To fetch Vendor Data
11.  Click **Create**. The **Client ID** and **Client Secret** section will appear.
12.  Click **Download** to save the `.txt` file containing your **Client ID** and **Client Secret** to a secure location.
13.  Click **Close** to finish.
14.  Note down your OneTrust **Host URL** from URL bar (e.g., `https://customer.my.onetrust.com`).

### Configuration in JupiterOne

1.  From the top navigation of the J1 Search homepage, select **Integrations**.
2.  Search for **OneTrust** and select it.
3.  Click on the **Add Instance** button and configure the following settings:

-   Enter the **OneTrust Host URL**.
-   Enter the **OneTrust Client ID**.
-   Enter the **OneTrust Client Secret**.
-   Enter the **Account Name** by which you'd like to identify this OneTrust instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
-   Enter a **Description** to help your team identify the integration instance.
-   Select a **Polling Interval** that fits your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.

4.  Click **Create Instance** once all values are provided.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `onetrust_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Risk | `onetrust_risk` | [Risk](https://docs.jupiterone.io/data-model/schemas/Risk) |
| User | `onetrust_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Group | `onetrust_user_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Vendor | `onetrust_vendor` | [Vendor](https://docs.jupiterone.io/data-model/schemas/Vendor) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `onetrust_account` | **HAS** | `onetrust_user_group` |
| `onetrust_account` | **HAS** | `onetrust_vendor` |
| `onetrust_account` | **HAS** | `onetrust_risk` |
| `onetrust_user_group` | **HAS** | `onetrust_user` |

### Onetrust Account

`onetrust_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Onetrust Risk

`onetrust_risk` inherits from [Risk](/data-model/schemas/Risk.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `actionId` | `number` |  |  |
| `closedAt` | `number` |  |  |
| 
`controlsIdentifier` \*

 | `array` of `string`s |  |  |
| `deadline` | `number` |  |  |
| 

`id` \*

 | `string` |  |  |
| `impactLevel` | `string` |  |  |
| `impactLevelId` | `number` |  |  |
| 

`inherentImpact` \*

 | `number` |  |  |
| `inherentImpactLevel` | `string` |  |  |
| 

`inherentProbability` \*

 | `number` |  |  |
| `inherentProbabilityLevel` | `string` |  |  |
| `inherentRiskScore` | `number` |  |  |
| `justification` | `string` |  |  |
| `level` | `string` |  |  |
| `levelId` | `number` |  |  |
| `mitigatedOn` | `number` |  |  |
| `orgGroupId` | `string` |  |  |
| `orgGroupName` | `string` |  |  |
| `previousState` | `string` |  |  |
| `probabilityLevel` | `string` |  |  |
| `probabilityLevelId` | `number` |  |  |
| `recommendation` | `string` |  |  |
| `references` | `string` |  |  |
| `remediationProposal` | `string` |  |  |
| `result` | `string` |  |  |
| 

`riskNumber` \*

 | `number` |  |  |
| 

`riskOwnersId` \*

 | `array` of `string`s |  |  |
| `riskType` | `string` |  |  |
| `sourceId` | `string` |  |  |
| `sourceName` | `string` |  |  |
| 

`targetImpact` \*

 | `number` |  |  |
| `targetImpactLevel` | `string` |  |  |
| `targetLevel` | `string` |  |  |
| 

`targetProbability` \*

 | `number` |  |  |
| `targetProbabilityLevel` | `string` |  |  |
| `targetRiskScore` | `number` |  |  |
| `threatName` | `string` |  |  |
| `treatment` | `string` |  |  |
| `treatmentStatus` | `string` |  |  |
| `updatedBy` | `string` |  |  |
| `updatedByName` | `string` |  |  |
| `vulnerabilityNames` | `string` |  |  |
| `workflowId` | `string` |  |  |
| `workflowName` | `string` |  |  |

---

### Onetrust User

`onetrust_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `title` | `string` |  |  |

---

### Onetrust User Group

`onetrust_user_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `externalId` | `string` |  |  |

---

### Onetrust Vendor

`onetrust_vendor` inherits from [Vendor](/data-model/schemas/Vendor.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `canViewDetails` | `boolean` |  |  |
| `isDeletable` | `boolean` |  |  |
| `isEditable` | `boolean` |  |  |
| `isParent` | `boolean` |  |  |
| `organizationId` | `string` |  |  |
| `organizationName` | `string` |  |  |
| `typeId` | `string` |  |  |
| `typeValue` | `string` |  |  |
| `vendorNumber` | `number` | A number value assign to each vendor by OneTrust |  |
| `workflowId` | `string` |  |  |
| `workflowStage` | `string` |  |  |
| `workflowValue` | `string` |  |  |

---

---

Source: /integrations/directory/onelogin

# OneLogin

Visualize OneLogin users, groups, roles, devices, apps, and services, map OneLogin users to employees, and monitor changes through alerts and queries.

## Installation

> **INFO**
> 
> For this integration, you will need to create an API Client ID and Client Secret on OneLogin with the **Read All** scope as an administrator. See [their documentation](https://developers.onelogin.com/api-docs/1/getting-started/working-with-api-credentials) for more information.

### Configuration in JupiterOne

To install the OneLogin integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select OneLogin. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the OneLogin account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your OneLogin **API Client ID**, **API Client Secret**, and your **Organization Domain** (format: `<yourdomain>.onelogin.com`).
    

Click **Create** once all values are provided to finalize the integration.

### Troubleshooting

This integration's authentication is achieved by fetching an OAuth token from OneLogin. You can reproduce this authentication strategy by running the following curl, replacing `<CLIENT_ID>` and `<CLIENT_SECRET>` with your own. `<API_HOSTNAME>` defaults to `https://api.us.onelogin.com`:

```bash
curl --request POST \
  --url <API_HOSTNAME> \
  --header 'authorization: client_id:<CLIENT_ID>, client_secret:<CLIENT_SECRET>' \
  --header 'content-type: application/json' \
  --data '{
	"grant_type":"client_credentials"
}'
```

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Onelogin Account | `onelogin_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Onelogin Application | `onelogin_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Onelogin Application Rule | `onelogin_application_rule` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Onelogin Group | `onelogin_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Onelogin Personal Application | `onelogin_personal_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Onelogin Personal Device | `mfa_device` | [Key](https://docs.jupiterone.io/data-model/schemas/Key), [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Onelogin Role | `onelogin_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Onelogin Service | `onelogin_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service), [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Onelogin User | `onelogin_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `onelogin_account` | **HAS** | `onelogin_service` |
| `onelogin_account` | **HAS** | `onelogin_group` |
| `onelogin_account` | **HAS** | `onelogin_role` |
| `onelogin_account` | **HAS** | `onelogin_user` |
| `onelogin_account` | **HAS** | `onelogin_application` |
| `onelogin_application` | **HAS** | `onelogin_application_rule` |
| `onelogin_group` | **HAS** | `onelogin_user` |
| `onelogin_user` | **ASSIGNED** | `onelogin_group` |
| `onelogin_user` | **ASSIGNED** | `onelogin_role` |
| `onelogin_user` | **ASSIGNED** | `onelogin_application` |
| `onelogin_user` | **HAS** | `onelogin_personal_application` |
| `onelogin_user` | **ASSIGNED** | `aws_iam_role` |
| `onelogin_user` | **ASSIGNED** | `mfa_device` |

---

Source: /integrations/directory/oomnitza

# Oomnitza

Visualize Oomnitza IT asset management data including hardware, servers, software, and users. Map asset ownership to users and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need your Oomnitza tenant URL and an API token to set up this integration. See [Oomnitza's documentation](https://oomnitza.zendesk.com/hc/en-us/articles/360049276794-Adding-revoking-and-refreshing-an-Oomnitza-API-token) for more information on creating API tokens.

### Configuration in Oomnitza

1.  Log in to your Oomnitza instance as an administrator.
2.  Navigate to **Configuration** > **Security** > **API Tokens**.
3.  Click **Add API Token** to generate a new token.
4.  Copy and save the token value securely.
5.  Note your Oomnitza tenant URL (e.g., `https://acme.oomnitza.com`).

> **TIP**
> 
> Create a dedicated user for the JupiterOne integration rather than using a personal administrator account. This makes the API token's activity easier to identify and audit.

### Configuration in JupiterOne

Navigate to the **Integrations** tab, select **Oomnitza**, and click **New Instance**.

Creating an instance requires the following:

-   The **Account Name** used to identify this Oomnitza account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to help identify the integration instance, if desired.
    
-   **Polling Interval** for how often JupiterOne collects data from Oomnitza. Set to `DISABLED` to run the integration manually only.
    
-   Your Oomnitza **Base URL** — the tenant URL for your Oomnitza instance (e.g., `https://acme.oomnitza.com`).
    
-   Your Oomnitza **API Key** — the API token generated in the steps above.
    

Click **Create** to save the instance.

### Next steps

Once configured, the integration will run on the polling interval you set and populate data within JupiterOne. See the [Instance management guide](/integrations/instance-management.md) for details on managing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (9)

-   `https://{tenant}.oomnitza.com/api/v3/assets`
-   `https://{tenant}.oomnitza.com/api/v3/assets/{equipmentId}/software`
-   `https://{tenant}.oomnitza.com/api/v3/contracts`
-   `https://{tenant}.oomnitza.com/api/v3/saas`
-   `https://{tenant}.oomnitza.com/api/v3/saas/users`
-   `https://{tenant}.oomnitza.com/api/v3/saas/{saasId}/users`
-   `https://{tenant}.oomnitza.com/api/v3/software`
-   `https://{tenant}.oomnitza.com/api/v3/users`
-   `https://{tenant}.oomnitza.com/api/v3/users/{username}/software/software`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://oomnitza.zendesk.com/hc/en-us/articles/360049276794-Adding-revoking-and-refreshing-an-Oomnitza-API-token](https://oomnitza.zendesk.com/hc/en-us/articles/360049276794-Adding-revoking-and-refreshing-an-Oomnitza-API-token)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (5)

| Step | Endpoints |
| --- | --- |
| Fetch Asset Installed Software | `https://{tenant}.oomnitza.com/api/v3/assets/{equipmentId}/software` |
| Fetch Assets | `https://{tenant}.oomnitza.com/api/v3/assets` |
| Fetch Contracts | `https://{tenant}.oomnitza.com/api/v3/contracts` |
| Fetch SaaS User Assignments | `https://{tenant}.oomnitza.com/api/v3/saas/users`, `https://{tenant}.oomnitza.com/api/v3/saas/{saasId}/users` |
| Fetch User Software Assignments | `https://{tenant}.oomnitza.com/api/v3/users/{username}/software/software` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `oomnitza_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Asset | `oomnitza_asset` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Contract | `oomnitza_contract` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| Hardware | `oomnitza_hardware` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| SaaS | `oomnitza_saas` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Server | `oomnitza_server` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Software | `oomnitza_software` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Software Catalog | `oomnitza_software_catalog` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| User | `oomnitza_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `oomnitza_account` | **HAS** | `oomnitza_user` |
| `oomnitza_account` | **HAS** | `oomnitza_hardware` |
| `oomnitza_account` | **HAS** | `oomnitza_server` |
| `oomnitza_account` | **HAS** | `oomnitza_software` |
| `oomnitza_account` | **HAS** | `oomnitza_asset` |
| `oomnitza_account` | **HAS** | `oomnitza_software_catalog` |
| `oomnitza_account` | **HAS** | `oomnitza_saas` |
| `oomnitza_account` | **HAS** | `oomnitza_contract` |
| `oomnitza_asset` | **INSTALLED** | `oomnitza_software_catalog` |
| `oomnitza_contract` | **PROVIDES** | `oomnitza_software_catalog` |
| `oomnitza_contract` | **PROVIDES** | `oomnitza_saas` |
| `oomnitza_hardware` | **INSTALLED** | `oomnitza_software_catalog` |
| `oomnitza_server` | **INSTALLED** | `oomnitza_software_catalog` |
| `oomnitza_user` | **HAS** | `oomnitza_hardware` |
| `oomnitza_user` | **HAS** | `oomnitza_server` |
| `oomnitza_user` | **HAS** | `oomnitza_software` |
| `oomnitza_user` | **HAS** | `oomnitza_asset` |
| `oomnitza_user` | **ASSIGNED** | `oomnitza_saas` |
| `oomnitza_user` | **ASSIGNED** | `oomnitza_software_catalog` |

### Oomnitza Account

`oomnitza_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Oomnitza Asset

`oomnitza_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetType` \*

 | `string` **|** `null` |  |  |
| 

`assignedTo` \*

 | `string` **|** `null` |  |  |
| 

`barcode` \*

 | `string` **|** `null` |  |  |
| 

`totalMemoryMb` \*

 | `string` **|** `null` |  |  |
| 

`warrantyEndDate` \*

 | `number` **|** `null` |  |  |

---

### Oomnitza Contract

`oomnitza_contract` inherits from [Subscription](/data-model/schemas/Subscription.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`contractId` \*

 | `string` | Oomnitza contract identifier (contract\_id). |  |
| 

`contractType` \*

 | `string` **|** `null` | Contract type, e.g. "License". |  |
| 

`cost` \*

 | `number` **|** `null` | Contract cost. |  |
| 

`endDate` \*

 | `number` **|** `null` | Contract end date (UNIX epoch seconds). |  |
| `id` | `string` **|** `null` | Oomnitza internal numeric UID of the contract record. |  |
| 

`startDate` \*

 | `number` **|** `null` | Contract start date (UNIX epoch seconds). |  |
| 

`totalLicenses` \*

 | `number` **|** `null` | Total number of licenses provisioned by the contract. |  |
| 

`usedLicenses` \*

 | `number` **|** `null` | Number of licenses currently consumed under the contract. |  |
| 

`vendor` \*

 | `string` **|** `null` | Contract vendor. |  |

---

### Oomnitza Hardware

`oomnitza_hardware` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetType` \*

 | `string` **|** `null` |  |  |
| 

`assignedTo` \*

 | `string` **|** `null` |  |  |
| 

`barcode` \*

 | `string` **|** `null` |  |  |
| 

`totalMemoryMb` \*

 | `string` **|** `null` |  |  |
| 

`warrantyEndDate` \*

 | `number` **|** `null` |  |  |

---

### Oomnitza Saas

`oomnitza_saas` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `null` | SaaS application category. |  |
| `createdBy` | `string` | Username of the record creator. |  |
| `id` | `string` **|** `null` | Oomnitza internal numeric UID of the SaaS record. |  |
| 

`saasId` \*

 | `string` | Oomnitza SaaS application identifier (saas\_id). |  |
| `updatedBy` | `string` | Username of the last modifier. |  |
| 

`url` \*

 | `string` **|** `null` | SaaS application URL. |  |
| 

`vendor` \*

 | `string` **|** `null` | The vendor or the software publisher if vendor isn't provided. |  |

---

### Oomnitza Server

`oomnitza_server` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetType` \*

 | `string` **|** `null` |  |  |
| 

`assignedTo` \*

 | `string` **|** `null` |  |  |
| 

`barcode` \*

 | `string` **|** `null` |  |  |
| 

`totalMemoryMb` \*

 | `string` **|** `null` |  |  |
| 

`warrantyEndDate` \*

 | `number` **|** `null` |  |  |

---

### Oomnitza Software

`oomnitza_software` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetType` \*

 | `string` **|** `null` |  |  |
| 

`assignedTo` \*

 | `string` **|** `null` |  |  |
| 

`barcode` \*

 | `string` **|** `null` |  |  |
| 

`totalMemoryMb` \*

 | `string` **|** `null` |  |  |
| 

`warrantyEndDate` \*

 | `number` **|** `null` |  |  |

---

### Oomnitza Software Catalog

`oomnitza_software_catalog` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `null` | Software category. |  |
| `id` | `string` **|** `null` | Oomnitza internal numeric UID of the software record. |  |
| 

`softwareId` \*

 | `string` | Oomnitza software catalog record identifier (software\_id). |  |
| 

`vendor` \*

 | `string` **|** `null` | The vendor or the software publisher if vendor isn't provided. |  |
| 

`version` \*

 | `string` **|** `null` | Software version. |  |

---

### Oomnitza User

`oomnitza_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`role` \*

 | `number` **|** `null` |  |  |

---

## Release Notes

-   **2026-03-02** — Added software catalog, SaaS applications, contracts, and software assignment ingestion to the Oomnitza integration.
-   **2026-02-12** — New Oomnitza integration: ingests hardware assets, devices, users, and user-device assignments.

---

Source: /integrations/directory/oracle-cloud

# Oracle Cloud

Visualize OCI compute instances, virtual machine hosts, domains, access policies, oracle object storage, vaults, nosql services, streaming services , devops, functions, redis, resource manager , map OCI users to employees, and monitor changes through queries and alerts.

## Installation

This guide walks you through setting up the Oracle Cloud Infrastructure (OCI) integration in JupiterOne. The process involves two main steps:

1.  **Configure API access in Oracle Cloud** - Set up authentication credentials
2.  **Configure the integration in JupiterOne** - Connect JupiterOne to your OCI account

---

## Prerequisites

Before you begin, make sure you have:

-   **Admin access** to your Oracle Cloud Infrastructure account (or a user with sufficient permissions)
-   The ability to create API keys and configure IAM policies in OCI
-   Access to your JupiterOne account

---

## Step 1: Configure API Access in Oracle Cloud

To connect JupiterOne to your Oracle Cloud account, you'll need to create API credentials. Here's what you'll be collecting:

| Credential | What It Is | Where You'll Get It |
| --- | --- | --- |
| **Private Key** | The private half of an RSA key pair used for API authentication | Generated/downloaded during API key creation |
| **Tenancy OCID** | Your Oracle Cloud tenancy's unique identifier | Shown in the configuration preview after creating the API key |
| **User OCID** | The unique identifier for your OCI user account | Shown in the configuration preview after creating the API key |
| **Fingerprint** | A unique identifier for your public key | Shown in the configuration preview after creating the API key |
| **Region** | The Oracle Cloud region you want to connect to | Shown in the configuration preview after creating the API key |
| **Passphrase** | Optional password protecting your private key | Only needed if you used a passphrase when generating the key |

### Create an API Key in Oracle Cloud

1.  **Log into Oracle Cloud Infrastructure Console**
    
    -   Sign in as the root user or a user with permissions to create API keys and manage IAM policies
2.  **Navigate to User Profile**
    
    -   Click on your profile icon in the top-right corner of the screen
    -   Select **My profile** from the dropdown menu
3.  **Add API Key**
    
    -   In your profile, scroll to the **Tokens and Keys** section
    -   Click **Add API Key**
4.  **Generate or Upload Key Pair**
    
    -   **Recommended**: Select "Generate a key pair for me" (easiest option)
    -   **Alternative**: Upload your own public key if you already have one
5.  **Download Your Private Key**
    
    -   If you generated a new key pair, you'll see an option to download the private key
    -   **Download and securely store this file** - you'll need it for the JupiterOne integration
    -   The private key file will have a `.pem` extension
    -   Click **Add Key**
6.  **Save Your Configuration Values**
    
    -   After adding the API key, Oracle Cloud will display a configuration file preview
    -   This preview contains the following values you'll need:
        -   **User OCID**: `ocid1.user.oc1..xxxxx`
        -   **Tenancy OCID**: `ocid1.tenancy.oc1..xxxxx`
        -   **Fingerprint**: A string like `aa:bb:cc:dd:ee:ff:...`
        -   **Region**: Your region identifier (e.g., `us-ashburn-1`)
    -   **Copy and save these values** - you'll enter them in JupiterOne in the next step

### Set Up Required Permissions

JupiterOne needs specific permissions to collect data from your Oracle Cloud account. This section walks you through creating a user group and assigning the necessary permissions via an IAM policy.

> **Why create a group?** Oracle Cloud policies are typically applied to groups rather than individual users. This makes management easier and follows security best practices.

#### Step 1: Create a User Group

1.  **Navigate to Identity & Security**
    
    -   In the OCI Console, open **Identity & Security** from the main menu
2.  **Select Domains**
    
    -   Click **Domains** in the left sidebar
    -   Select your **default domain** (usually named "Default")
3.  **Create a New Group**
    
    -   Click the **User Management** tab
    -   Scroll to the **Groups** section
    -   Click **Create Group**
4.  **Configure the Group**
    
    -   **Name**: Enter `J1Group` (or any name you prefer)
    -   **Description**: Add a description like "JupiterOne integration access group"
    -   **Users**: Add your current user (the one with the API key) to this group
    -   Click **Create**

#### Step 2: Create an IAM Policy

Now you'll create a policy that grants the necessary permissions to your group. You can choose between two approaches:

**Option A: Simple (Recommended for Most Users)**

-   Fastest to set up
-   Grants broad read and inspect permissions
-   Perfect if you don't need fine-grained control

**Option B: Granular**

-   More restrictive permissions
-   Follows the principle of least privilege
-   Better for organizations with strict security requirements

##### Option A: Simple Permissions (Recommended)

This approach grants JupiterOne the permissions it needs with just 3 policy statements:

1.  **Navigate to Policies**
    
    -   In the OCI Console, go to **Identity & Security > Identity > Policies**
2.  **Create New Policy**
    
    -   Click **Create Policy**
    -   **Name**: Enter a name like `J1-Integration-Policy`
    -   **Description**: Add a description like "Policy for JupiterOne integration access"
    -   **Policy Builder**: Select **Show manual builder**
3.  **Add Policy Statements**
    
    -   Copy and paste the following three statements into the policy editor:

```plaintext
Allow group J1Group to inspect all-resources in tenancy
Allow group J1Group to read all-resources in tenancy
Allow group J1Group to use network-security-groups in tenancy
```

4.  **Save the Policy**
    -   Click **Create** to save the policy

> **Important**: Replace `J1Group` with your actual group name if you used something different.

##### Option B: Granular Permissions (Advanced)

If you prefer more restrictive, fine-grained permissions, use this comprehensive policy set instead:

1.  **Navigate to Policies**
    
    -   In the OCI Console, go to **Identity & Security > Identity > Policies**
2.  **Create New Policy**
    
    -   Click **Create Policy**
    -   **Name**: Enter a name like `J1-Integration-Policy-Granular`
    -   **Description**: Add a description like "Granular policy for JupiterOne integration access"
    -   **Policy Builder**: Select **Show manual builder**
3.  **Add Policy Statements**
    
    -   Copy and paste all of the following statements into the policy editor:

```plaintext
Allow group J1Group to inspect groups in tenancy
Allow group J1Group to read policies in tenancy
Allow group J1Group to inspect devops-family in tenancy
Allow group J1Group to read fn-function in tenancy
Allow group J1Group to read fn-app in tenancy
Allow group J1Group to read instances in tenancy
Allow group J1Group to inspect dedicated-vm-hosts in tenancy
Allow group J1Group to read nosql-indexes in tenancy
Allow group J1Group to inspect nosql-tables in tenancy
Allow group J1Group to read buckets in tenancy
Allow group J1Group to inspect redis-clusters in tenancy
Allow group J1Group to inspect orm-stacks in tenancy
Allow group J1Group to inspect streams in tenancy
Allow group J1Group to inspect stream-pools in tenancy
Allow group J1Group to inspect keys in tenancy
Allow group J1Group to inspect vaults in tenancy
Allow group J1Group to inspect secrets in tenancy
Allow group J1Group to inspect secret-bundles in tenancy
Allow group J1Group to inspect cloud-guard-problems in tenancy
Allow group J1Group to inspect cloud-guard-detectors in tenancy
Allow group J1Group to inspect cloud-guard-detector-recipes in tenancy
Allow group J1Group to inspect cloud-guard-detector-rule-definitions in tenancy
Allow group J1Group to inspect cloud-exadata-infrastructures in tenancy
Allow group J1Group to inspect cloud-vmclusters in tenancy
Allow group J1Group to read vcns in tenancy
Allow group J1Group to read subnets in tenancy
Allow group J1Group to read vnics in tenancy
Allow group J1Group to inspect load-balancers in tenancy
Allow group J1Group to inspect file-systems in tenancy
Allow group J1Group to inspect mount-targets in tenancy
Allow group J1Group to inspect volumes in tenancy
Allow group J1Group to inspect volume-groups in tenancy
Allow group J1Group to inspect log-groups in tenancy
Allow group J1Group to inspect ons-topics in tenancy
Allow group J1Group to inspect ons-subscriptions in tenancy
Allow group J1Group to inspect analytics-instances in tenancy
Allow group J1Group to inspect integration-instances in tenancy
Allow group J1Group to use network-security-groups in tenancy
Allow group J1Group to read security-lists in tenancy
Allow group J1Group to inspect recovery-service-protected-databases in tenancy
Allow group J1Group to inspect instance-images in tenancy
Allow group J1Group to read authentication-policies in tenancy
Allow group J1Group to read compartments in tenancy
Allow group J1Group to read domains in tenancy
Allow group J1Group to read users in tenancy
Allow group J1Group to inspect vnic-attachments in tenancy
Allow group J1Group to inspect loganalytics-resources-family in tenancy
Allow group J1Group to inspect db-homes in tenancy
Allow group J1Group to inspect databases in tenancy
Allow group J1Group to inspect data-safe-family in tenancy
Allow group J1Group to inspect container-instances in tenancy
Allow group J1Group to read alarms in tenancy
Allow group J1Group to read fast-connect-providers in tenancy
Allow group J1Group to inspect virtual-circuits in tenancy
```

4.  **Save the Policy**
    -   Click **Create** to save the policy

> **Important**: Replace `J1Group` with your actual group name if you used something different.

#### Verify Your Setup

Before proceeding, confirm that:

-   Your user is a member of the group you created
-   The IAM policy has been created successfully
-   The policy includes your group name in all statements

---

## Step 2: Configure the Integration in JupiterOne

Now that you have your Oracle Cloud credentials ready, it's time to set up the integration in JupiterOne.

### Create a New Integration Instance

1.  **Navigate to Integrations**
    
    -   In JupiterOne, go to the **Integrations** page
    -   Find and select **Oracle Cloud** from the list of available integrations
2.  **Start Configuration**
    
    -   Click **New Instance** to begin setting up a new Oracle Cloud integration

### Enter Configuration Details

Fill out the following fields in the integration configuration form:

#### Basic Information

-   **Account Name** (Required)
    
    -   A friendly name to identify this Oracle Cloud account in JupiterOne
    -   This name will appear in tags on ingested entities (`tag.AccountName`)
    -   Example: `production-oci`, `us-east-oci`, or `company-oci`
-   **Description** (Optional)
    
    -   Additional information to help you identify this integration instance
    -   Useful if you have multiple Oracle Cloud accounts

#### Connection Settings

-   **Polling Interval** (Required)
    -   How often JupiterOne should automatically collect data from Oracle Cloud
    -   Options typically include: `DISABLED`, `1 hour`, `4 hours`, `12 hours`, `24 hours`
    -   Choose `DISABLED` if you prefer to run the integration manually

#### Oracle Cloud Credentials

Enter the values you collected in Step 1:

-   **Private Key** (Required)
    
    -   Paste the contents of the private key file (`.pem` file) you downloaded
    -   Copy the entire file contents, including the header and footer lines:
        
        ```text
        -----BEGIN RSA PRIVATE KEY-----
        [key content]
        -----END RSA PRIVATE KEY-----
        ```
        
-   **Tenancy OCID** (Required)
    
    -   Your tenancy's unique identifier
    -   Format: `ocid1.tenancy.oc1..xxxxx`
-   **User OCID** (Required)
    
    -   Your user's unique identifier
    -   Format: `ocid1.user.oc1..xxxxx`
-   **Fingerprint** (Required)
    
    -   The fingerprint associated with your API key
    -   Format: `aa:bb:cc:dd:ee:ff:...`
-   **Region** (Required)
    
    -   One or more Oracle Cloud regions to ingest, comma-separated
    -   Single region: `us-ashburn-1`; multiple regions: `us-ashburn-1,eu-frankfurt-1`
    -   Common values: `us-ashburn-1`, `us-phoenix-1`, `eu-frankfurt-1`, `ap-tokyo-1`
-   **Private Key Passphrase** (Optional)
    
    -   Only required if you used a passphrase when generating the private key
    -   Leave blank if your key is not encrypted
-   **Cloud Guard Problems Ingestion Window** (Optional)
    
    -   Filters Cloud Guard problems by last-detected date
    -   Select `30 days`, `60 days`, or `90 days`; defaults to `30 days`

### Complete the Setup

1.  **Review your configuration**
    
    -   Double-check that all required fields are filled in correctly
    -   Verify that OCID values and fingerprints match what you saved from Oracle Cloud
2.  **Click Create**
    
    -   JupiterOne will validate the credentials and start the initial data collection
    -   The integration will begin running on your specified polling interval

---

## Next Steps

Once your integration is configured:

-   The integration will automatically run according to your polling interval (or you can run it manually)
-   Data from your Oracle Cloud account will begin populating in JupiterOne
-   You can view, manage, and edit your integration instance by visiting the [Instance management guide](/integrations/instance-management.md)

**Need help?** If you encounter any issues during setup, verify that:

-   Your API key permissions are correctly configured
-   All OCID values and fingerprints are copied correctly (watch for extra spaces)
-   Your private key is pasted in full, including the header and footer lines

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (63)

-   `inspect analytics-instances`
-   `inspect cloud-exadata-infrastructures`
-   `inspect cloud-guard-detector-recipes`
-   `inspect cloud-guard-detectors`
-   `inspect cloud-guard-problems`
-   `inspect cloud-guard-resource-types`
-   `inspect cloud-guard-targets`
-   `inspect cloud-vmclusters`
-   `inspect container-instances`
-   `inspect data-safe-family`
-   `inspect databases`
-   `inspect db-homes`
-   `inspect dedicated-vm-hosts`
-   `inspect devops-family`
-   `inspect file-systems`
-   `inspect groups`
-   `inspect instance-images`
-   `inspect integration-instances`
-   `inspect keys`
-   `inspect load-balancers`
-   `inspect log-groups`
-   `inspect loganalytics-resources-family`
-   `inspect mount-targets`
-   `inspect nosql-tables`
-   `inspect ons-subscriptions`
-   `inspect ons-topics`
-   `inspect orm-stacks`
-   `inspect recovery-service-protected-databases`
-   `inspect redis-clusters`
-   `inspect secret-bundles`
-   `inspect secrets`
-   `inspect security-policy`
-   `inspect security-recipe`
-   `inspect security-zone`
-   `inspect stream-pools`
-   `inspect streams`
-   `inspect vaults`
-   `inspect virtual-circuits`
-   `inspect vnic-attachments`
-   `inspect volume-groups`
-   `inspect volumes`
-   `read alarms`
-   `read audit-events`
-   `read authentication-policies`
-   `read buckets`
-   `read compartments`
-   `read domains`
-   `read fast-connect-providers`
-   `read fn-app`
-   `read fn-function`
-   `read goldengate-connections`
-   `read goldengate-deployment-backups`
-   `read goldengate-deployment-upgrades`
-   `read goldengate-deployments`
-   `read instances`
-   `read nosql-indexes`
-   `read policies`
-   `read security-lists`
-   `read serviceconnectors`
-   `read subnets`
-   `read vcns`
-   `read vnics`
-   `use network-security-groups`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (93)

-   `https://analytics.{region}.ocp.oraclecloud.com/20190331/analyticsInstances`
-   `https://analytics.{region}.ocp.oraclecloud.com/20190331/analyticsInstances/{analyticsInstanceId}`
-   `https://audit.{region}.oraclecloud.com/20190901/configuration`
-   `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/detectorRecipes`
-   `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/detectorRecipes/{detectorRecipeId}`
-   `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/detectorRecipes/{detectorRecipeId}/detectorRules`
-   `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/problems`
-   `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/resourceTypes`
-   `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/securityPolicies`
-   `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/securityRecipes`
-   `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/securityZones`
-   `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/targets`
-   `https://compute-containers.{region}.oci.oraclecloud.com/20210415/containerInstances`
-   `https://compute-containers.{region}.oci.oraclecloud.com/20210415/containerInstances/{containerInstanceId}`
-   `https://compute-containers.{region}.oci.oraclecloud.com/20210415/containers/{containerId}`
-   `https://database.{region}.oraclecloud.com/20160918/cloudExadataInfrastructures`
-   `https://database.{region}.oraclecloud.com/20160918/cloudVmClusters`
-   `https://database.{region}.oraclecloud.com/20160918/databases`
-   `https://database.{region}.oraclecloud.com/20160918/dbHomes`
-   `https://datasafe.{region}.oci.oraclecloud.com/20181201/auditPolicies`
-   `https://datasafe.{region}.oci.oraclecloud.com/20181201/dataSafeConfiguration`
-   `https://datasafe.{region}.oci.oraclecloud.com/20181201/dataSafePrivateEndpoints`
-   `https://datasafe.{region}.oci.oraclecloud.com/20181201/dataSafePrivateEndpoints/{privateEndpointId}`
-   `https://datasafe.{region}.oci.oraclecloud.com/20181201/securityPolicies`
-   `https://datasafe.{region}.oci.oraclecloud.com/20181201/targetDatabases`
-   `https://datasafe.{region}.oci.oraclecloud.com/20181201/targetDatabases/{targetDatabaseId}`
-   `https://devops.{region}.oci.oraclecloud.com/20210630/buildPipelines`
-   `https://devops.{region}.oci.oraclecloud.com/20210630/deployEnvironments`
-   `https://devops.{region}.oci.oraclecloud.com/20210630/deployPipelines`
-   `https://devops.{region}.oci.oraclecloud.com/20210630/projects`
-   `https://devops.{region}.oci.oraclecloud.com/20210630/repositories`
-   `https://filestorage.{region}.oraclecloud.com/20171215/fileSystems`
-   `https://filestorage.{region}.oraclecloud.com/20171215/fileSystems/{fileSystemId}`
-   `https://filestorage.{region}.oraclecloud.com/20171215/mountTargets`
-   `https://functions.{region}.oci.oraclecloud.com/20181201/applications`
-   `https://functions.{region}.oci.oraclecloud.com/20181201/functions`
-   `https://goldengate.{region}.oci.oraclecloud.com/20200407/connections`
-   `https://goldengate.{region}.oci.oraclecloud.com/20200407/connections/{connectionId}`
-   `https://goldengate.{region}.oci.oraclecloud.com/20200407/deploymentBackups`
-   `https://goldengate.{region}.oci.oraclecloud.com/20200407/deploymentUpgrades`
-   `https://goldengate.{region}.oci.oraclecloud.com/20200407/deployments`
-   `https://goldengate.{region}.oci.oraclecloud.com/20200407/deployments/{deploymentId}`
-   `https://iaas.{region}.oraclecloud.com/20160918/bootVolumes`
-   `https://iaas.{region}.oraclecloud.com/20160918/dedicatedVmHosts`
-   `https://iaas.{region}.oraclecloud.com/20160918/dedicatedVmHosts/{dedicatedVmHostId}`
-   `https://iaas.{region}.oraclecloud.com/20160918/fastConnectProviderServices`
-   `https://iaas.{region}.oraclecloud.com/20160918/images`
-   `https://iaas.{region}.oraclecloud.com/20160918/instances`
-   `https://iaas.{region}.oraclecloud.com/20160918/networkSecurityGroups`
-   `https://iaas.{region}.oraclecloud.com/20160918/networkSecurityGroups/{networkSecurityGroupId}/securityRules`
-   `https://iaas.{region}.oraclecloud.com/20160918/securityLists`
-   `https://iaas.{region}.oraclecloud.com/20160918/subnets`
-   `https://iaas.{region}.oraclecloud.com/20160918/vcns`
-   `https://iaas.{region}.oraclecloud.com/20160918/virtualCircuits`
-   `https://iaas.{region}.oraclecloud.com/20160918/vnicAttachments`
-   `https://iaas.{region}.oraclecloud.com/20160918/vnics/{vnicId}`
-   `https://iaas.{region}.oraclecloud.com/20160918/volumeGroups`
-   `https://iaas.{region}.oraclecloud.com/20160918/volumes`
-   `https://iaas.{region}.oraclecloud.com/20170115/loadBalancers`
-   `https://identity.{region}.oraclecloud.com/20160918/authenticationPolicies/{compartmentId}`
-   `https://identity.{region}.oraclecloud.com/20160918/compartments`
-   `https://identity.{region}.oraclecloud.com/20160918/compartments/{tenancyId}`
-   `https://identity.{region}.oraclecloud.com/20160918/domains`
-   `https://identity.{region}.oraclecloud.com/20160918/policies`
-   `https://identity.{region}.oraclecloud.com/20160918/userGroupMemberships`
-   `https://integration.{region}.ocp.oraclecloud.com/20190131/integrationInstances`
-   `https://kms.{region}.oraclecloud.com/20180608/vaults`
-   `https://loganalytics.{region}.oci.oraclecloud.com/20200601/namespaces/{namespace}/logAnalyticsEntities`
-   `https://loganalytics.{region}.oci.oraclecloud.com/20200601/namespaces/{namespace}/rules`
-   `https://logging.{region}.oci.oraclecloud.com/20200531/logGroups`
-   `https://logging.{region}.oci.oraclecloud.com/20200531/logGroups/{logGroupId}/logs`
-   `https://logging.{region}.oci.oraclecloud.com/20200531/logGroups/{logGroupId}/logs/{logId}`
-   `https://logging.{region}.oci.oraclecloud.com/20200531/logServices`
-   `https://nosql.{region}.oci.oraclecloud.com/20190828/tables`
-   `https://nosql.{region}.oci.oraclecloud.com/20190828/tables/{tableName}/indexes`
-   `https://notification.{region}.oraclecloud.com/20181201/subscriptions`
-   `https://notification.{region}.oraclecloud.com/20181201/topics`
-   `https://objectstorage.{region}.oraclecloud.com/n/`
-   `https://objectstorage.{region}.oraclecloud.com/n/{namespace}/b`
-   `https://objectstorage.{region}.oraclecloud.com/n/{namespace}/b/{bucketName}`
-   `https://recovery.{region}.oci.oraclecloud.com/20210216/protectedDatabases`
-   `https://redis.{region}.oci.oraclecloud.com/20220315/redisClusters`
-   `https://resourcemanager.{region}.oraclecloud.com/20180917/stacks`
-   `https://service-connector-hub.{region}.oci.oraclecloud.com/20200909/serviceConnectors`
-   `https://service-connector-hub.{region}.oci.oraclecloud.com/20200909/serviceConnectors/{serviceConnectorId}`
-   `https://streaming.{region}.oci.oraclecloud.com/20180418/streamPools`
-   `https://streaming.{region}.oci.oraclecloud.com/20180418/streams`
-   `https://telemetry-ingestion.{region}.oraclecloud.com/20180401/alarms`
-   `https://telemetry-ingestion.{region}.oraclecloud.com/20180401/alarms/{alarmId}`
-   `https://vaults.{region}.oci.oraclecloud.com/20180608/secrets`
-   `https://{domain_host}/admin/v1/Groups`
-   `https://{domain_host}/admin/v1/Users`
-   `https://{vault_management_endpoint}/20180608/keys`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (88)

-   [https://docs.oracle.com/en-us/iaas/Content/Audit/Concepts/auditoverview.htm](https://docs.oracle.com/en-us/iaas/Content/Audit/Concepts/auditoverview.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/Balance/home.htm](https://docs.oracle.com/en-us/iaas/Content/Balance/home.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/Functions/home.htm](https://docs.oracle.com/en-us/iaas/Content/Functions/home.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/Identity/policyreference/iampolicyreference.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/policyreference/iampolicyreference.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/KeyManagement/home.htm](https://docs.oracle.com/en-us/iaas/Content/KeyManagement/home.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/Logging/home.htm](https://docs.oracle.com/en-us/iaas/Content/Logging/home.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/Monitoring/home.htm](https://docs.oracle.com/en-us/iaas/Content/Monitoring/home.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/ResourceManager/home.htm](https://docs.oracle.com/en-us/iaas/Content/ResourceManager/home.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/Streaming/home.htm](https://docs.oracle.com/en-us/iaas/Content/Streaming/home.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/cloud-guard/home.htm](https://docs.oracle.com/en-us/iaas/Content/cloud-guard/home.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/connector-hub/overview.htm](https://docs.oracle.com/en-us/iaas/Content/connector-hub/overview.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/container-instances/home.htm](https://docs.oracle.com/en-us/iaas/Content/container-instances/home.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/devops/using/home.htm](https://docs.oracle.com/en-us/iaas/Content/devops/using/home.htm)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/analytics/20190331/AnalyticsInstance/ListAnalyticsInstances](https://docs.oracle.com/en-us/iaas/api/#/en/analytics/20190331/AnalyticsInstance/ListAnalyticsInstances)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/audit/20190901/Configuration/GetConfiguration](https://docs.oracle.com/en-us/iaas/api/#/en/audit/20190901/Configuration/GetConfiguration)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/DetectorRecipe/GetDetectorRecipe](https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/DetectorRecipe/GetDetectorRecipe)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/DetectorRecipe/ListDetectorRecipes](https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/DetectorRecipe/ListDetectorRecipes)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/DetectorRecipeDetectorRule/ListDetectorRecipeDetectorRules](https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/DetectorRecipeDetectorRule/ListDetectorRecipeDetectorRules)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/Problem/ListProblems](https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/Problem/ListProblems)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/ResourceTypeSummary/ListResourceTypes](https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/ResourceTypeSummary/ListResourceTypes)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/SecurityPolicy/ListSecurityPolicies](https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/SecurityPolicy/ListSecurityPolicies)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/SecurityRecipe/ListSecurityRecipes](https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/SecurityRecipe/ListSecurityRecipes)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/SecurityZone/ListSecurityZones](https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/SecurityZone/ListSecurityZones)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/Target/ListTargets](https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/Target/ListTargets)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/container-instances/20210415/Container/GetContainer](https://docs.oracle.com/en-us/iaas/api/#/en/container-instances/20210415/Container/GetContainer)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/container-instances/20210415/ContainerInstance/ListContainerInstances](https://docs.oracle.com/en-us/iaas/api/#/en/container-instances/20210415/ContainerInstance/ListContainerInstances)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/AuditPolicySummary/ListAuditPolicies](https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/AuditPolicySummary/ListAuditPolicies)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/DataSafeConfiguration/GetDataSafeConfiguration](https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/DataSafeConfiguration/GetDataSafeConfiguration)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/PrivateEndpointSummary/ListPrivateEndpoints](https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/PrivateEndpointSummary/ListPrivateEndpoints)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/SecurityPolicySummary/ListSecurityPolicies](https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/SecurityPolicySummary/ListSecurityPolicies)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/TargetDatabaseSummary/ListTargetDatabases](https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/TargetDatabaseSummary/ListTargetDatabases)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/database/20160918/CloudExadataInfrastructure/ListCloudExadataInfrastructures](https://docs.oracle.com/en-us/iaas/api/#/en/database/20160918/CloudExadataInfrastructure/ListCloudExadataInfrastructures)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/database/20160918/CloudVmCluster/ListCloudVmClusters](https://docs.oracle.com/en-us/iaas/api/#/en/database/20160918/CloudVmCluster/ListCloudVmClusters)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/database/20160918/Database/ListDatabases](https://docs.oracle.com/en-us/iaas/api/#/en/database/20160918/Database/ListDatabases)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/database/20160918/DbHome/ListDbHomes](https://docs.oracle.com/en-us/iaas/api/#/en/database/20160918/DbHome/ListDbHomes)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/BuildPipeline/ListBuildPipelines](https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/BuildPipeline/ListBuildPipelines)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/DeployEnvironment/ListDeployEnvironments](https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/DeployEnvironment/ListDeployEnvironments)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/DeployPipeline/ListDeployPipelines](https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/DeployPipeline/ListDeployPipelines)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/Project/ListProjects](https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/Project/ListProjects)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/Repository/ListRepositories](https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/Repository/ListRepositories)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/FileSystem/ListFileSystems](https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/FileSystem/ListFileSystems)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/MountTarget/ListMountTargets](https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/MountTarget/ListMountTargets)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/functions/20181201/Application/ListApplications](https://docs.oracle.com/en-us/iaas/api/#/en/functions/20181201/Application/ListApplications)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/goldengate/20200407/Connection/](https://docs.oracle.com/en-us/iaas/api/#/en/goldengate/20200407/Connection/)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/goldengate/20200407/Deployment/](https://docs.oracle.com/en-us/iaas/api/#/en/goldengate/20200407/Deployment/)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/goldengate/20200407/DeploymentBackup/](https://docs.oracle.com/en-us/iaas/api/#/en/goldengate/20200407/DeploymentBackup/)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/goldengate/20200407/DeploymentUpgrade/](https://docs.oracle.com/en-us/iaas/api/#/en/goldengate/20200407/DeploymentUpgrade/)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/BootVolume/ListBootVolumes](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/BootVolume/ListBootVolumes)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/DedicatedVmHost/ListDedicatedVmHosts](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/DedicatedVmHost/ListDedicatedVmHosts)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/FastConnectProviderService/ListFastConnectProviderServices](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/FastConnectProviderService/ListFastConnectProviderServices)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Image/ListImages](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Image/ListImages)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Instance/ListInstances](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Instance/ListInstances)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/NetworkSecurityGroup/ListNetworkSecurityGroups](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/NetworkSecurityGroup/ListNetworkSecurityGroups)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/SecurityList/ListSecurityLists](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/SecurityList/ListSecurityLists)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/SecurityRule/ListNetworkSecurityGroupSecurityRules](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/SecurityRule/ListNetworkSecurityGroupSecurityRules)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Subnet/ListSubnets](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Subnet/ListSubnets)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Vcn/ListVcns](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Vcn/ListVcns)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/VirtualCircuit/ListVirtualCircuits](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/VirtualCircuit/ListVirtualCircuits)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/VnicAttachment/ListVnicAttachments](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/VnicAttachment/ListVnicAttachments)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Volume/ListVolumes](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Volume/ListVolumes)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/VolumeGroup/ListVolumeGroups](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/VolumeGroup/ListVolumeGroups)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/AuthenticationPolicy/GetAuthenticationPolicy](https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/AuthenticationPolicy/GetAuthenticationPolicy)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/Compartment/ListCompartments](https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/Compartment/ListCompartments)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/Domain/ListDomains](https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/Domain/ListDomains)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/Policy/ListPolicies](https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/Policy/ListPolicies)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/UserGroupMembership/ListUserGroupMemberships](https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/UserGroupMembership/ListUserGroupMemberships)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/integration/20190131/IntegrationInstance/ListIntegrationInstances](https://docs.oracle.com/en-us/iaas/api/#/en/integration/20190131/IntegrationInstance/ListIntegrationInstances)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/key/release/Key/ListKeys](https://docs.oracle.com/en-us/iaas/api/#/en/key/release/Key/ListKeys)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/key/release/Vault/ListVaults](https://docs.oracle.com/en-us/iaas/api/#/en/key/release/Vault/ListVaults)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/loadbalancer/20170115/LoadBalancer/ListLoadBalancers](https://docs.oracle.com/en-us/iaas/api/#/en/loadbalancer/20170115/LoadBalancer/ListLoadBalancers)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/log-analytics/20200601/LogAnalyticsEntity/ListLogAnalyticsEntities](https://docs.oracle.com/en-us/iaas/api/#/en/log-analytics/20200601/LogAnalyticsEntity/ListLogAnalyticsEntities)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/logging-management/20200531/Log/ListLogs](https://docs.oracle.com/en-us/iaas/api/#/en/logging-management/20200531/Log/ListLogs)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/logging-management/20200531/LogGroup/ListLogGroups](https://docs.oracle.com/en-us/iaas/api/#/en/logging-management/20200531/LogGroup/ListLogGroups)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/monitoring/20180401/AlarmSummary/ListAlarms](https://docs.oracle.com/en-us/iaas/api/#/en/monitoring/20180401/AlarmSummary/ListAlarms)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/nosql-database/20190828/Index/ListIndexes](https://docs.oracle.com/en-us/iaas/api/#/en/nosql-database/20190828/Index/ListIndexes)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/nosql-database/20190828/Table/ListTables](https://docs.oracle.com/en-us/iaas/api/#/en/nosql-database/20190828/Table/ListTables)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/objectstorage/20160918/Bucket/ListBuckets](https://docs.oracle.com/en-us/iaas/api/#/en/objectstorage/20160918/Bucket/ListBuckets)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/ons/20181201/NotificationTopicSummary/ListTopics](https://docs.oracle.com/en-us/iaas/api/#/en/ons/20181201/NotificationTopicSummary/ListTopics)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/ons/20181201/SubscriptionSummary/ListSubscriptions](https://docs.oracle.com/en-us/iaas/api/#/en/ons/20181201/SubscriptionSummary/ListSubscriptions)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/recovery-service/20210216/ProtectedDatabase/ListProtectedDatabases](https://docs.oracle.com/en-us/iaas/api/#/en/recovery-service/20210216/ProtectedDatabase/ListProtectedDatabases)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/redis/20220315/RedisCluster/ListRedisClusters](https://docs.oracle.com/en-us/iaas/api/#/en/redis/20220315/RedisCluster/ListRedisClusters)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/resourcemanager/20180917/Stack/ListStacks](https://docs.oracle.com/en-us/iaas/api/#/en/resourcemanager/20180917/Stack/ListStacks)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/secretmgmt/20180608/SecretSummary/ListSecrets](https://docs.oracle.com/en-us/iaas/api/#/en/secretmgmt/20180608/SecretSummary/ListSecrets)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/serviceconnectors/20200909/ServiceConnector/ListServiceConnectors](https://docs.oracle.com/en-us/iaas/api/#/en/serviceconnectors/20200909/ServiceConnector/ListServiceConnectors)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/streaming/20180418/Stream/ListStreams](https://docs.oracle.com/en-us/iaas/api/#/en/streaming/20180418/Stream/ListStreams)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/streaming/20180418/StreamPool/ListStreamPools](https://docs.oracle.com/en-us/iaas/api/#/en/streaming/20180418/StreamPool/ListStreamPools)
-   [https://docs.oracle.com/en/cloud/paas/identity-cloud/rest-api/op-admin-v1-groups-get.html](https://docs.oracle.com/en/cloud/paas/identity-cloud/rest-api/op-admin-v1-groups-get.html)
-   [https://docs.oracle.com/en/cloud/paas/identity-cloud/rest-api/op-admin-v1-users-get.html](https://docs.oracle.com/en/cloud/paas/identity-cloud/rest-api/op-admin-v1-users-get.html)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (36)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Build Group -> User Relationships | `inspect groups` | `https://identity.{region}.oraclecloud.com/20160918/userGroupMemberships` |
| Fetch CloudGuard Detector Recipe Rules | `inspect cloud-guard-detectors` | `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/detectorRecipes/{detectorRecipeId}/detectorRules` |
| Fetch CloudGuard Detector Recipes | `inspect cloud-guard-detector-recipes` | `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/detectorRecipes`, `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/detectorRecipes/{detectorRecipeId}` |
| Fetch CloudGuard Problems | `inspect cloud-guard-problems` | `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/problems` |
| Fetch CloudGuard Resource Types | `inspect cloud-guard-resource-types` | `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/resourceTypes` |
| Fetch CloudGuard Security Policies | `inspect security-policy` | `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/securityPolicies` |
| Fetch CloudGuard Security Recipes | `inspect security-recipe` | `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/securityRecipes` |
| Fetch CloudGuard Security Zones | `inspect security-zone` | `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/securityZones` |
| Fetch CloudGuard Targets | `inspect cloud-guard-targets` | `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/targets` |
| Fetch Container Instances | `inspect container-instances` | `https://compute-containers.{region}.oci.oraclecloud.com/20210415/containerInstances`, `https://compute-containers.{region}.oci.oraclecloud.com/20210415/containerInstances/{containerInstanceId}` |
| Fetch Containers | `inspect container-instances` | `https://compute-containers.{region}.oci.oraclecloud.com/20210415/containers/{containerId}` |
| Fetch Data Safe Audit Policies | `inspect data-safe-family` | `https://datasafe.{region}.oci.oraclecloud.com/20181201/auditPolicies` |
| Fetch Data Safe Private Endpoints | `inspect data-safe-family` | `https://datasafe.{region}.oci.oraclecloud.com/20181201/dataSafePrivateEndpoints`, `https://datasafe.{region}.oci.oraclecloud.com/20181201/dataSafePrivateEndpoints/{privateEndpointId}` |
| Fetch Data Safe Security Policies | `inspect data-safe-family` | `https://datasafe.{region}.oci.oraclecloud.com/20181201/securityPolicies` |
| Fetch Data Safe Target Databases | `inspect data-safe-family` | `https://datasafe.{region}.oci.oraclecloud.com/20181201/targetDatabases`, `https://datasafe.{region}.oci.oraclecloud.com/20181201/targetDatabases/{targetDatabaseId}` |
| Fetch FastConnect Virtual Circuits | `inspect virtual-circuits` | `https://iaas.{region}.oraclecloud.com/20160918/virtualCircuits` |
| Fetch File Systems | `inspect file-systems` | `https://filestorage.{region}.oraclecloud.com/20171215/fileSystems`, `https://filestorage.{region}.oraclecloud.com/20171215/fileSystems/{fileSystemId}` |
| Fetch GoldenGate Deployment Backups | `read goldengate-deployment-backups` | `https://goldengate.{region}.oci.oraclecloud.com/20200407/deploymentBackups` |
| Fetch GoldenGate Deployment Upgrades | `read goldengate-deployment-upgrades` | `https://goldengate.{region}.oci.oraclecloud.com/20200407/deploymentUpgrades` |
| Fetch Groups | `read domains` | `https://{domain_host}/admin/v1/Groups` |
| Fetch Instances | `read instances` | `https://iaas.{region}.oraclecloud.com/20160918/instances` |
| Fetch OCI Logs | `inspect log-groups` | `https://logging.{region}.oci.oraclecloud.com/20200531/logGroups/{logGroupId}/logs` |
| Fetch Oracle Kms Key | `inspect keys` | `https://{vault_management_endpoint}/20180608/keys` |
| Fetch Oracle Nosql Index | `read nosql-indexes` | `https://nosql.{region}.oci.oraclecloud.com/20190828/tables/{tableName}/indexes` |
| Fetch Subscriptions | `inspect ons-subscriptions` | `https://notification.{region}.oraclecloud.com/20181201/subscriptions` |
| Fetch Users | `read domains` | `https://{domain_host}/admin/v1/Users` |
| fetch-databases | `inspect databases` | `https://database.{region}.oraclecloud.com/20160918/databases` |
| fetch-devops-build-pipelines | `inspect devops-family` | `https://devops.{region}.oci.oraclecloud.com/20210630/buildPipelines` |
| fetch-devops-deploy-environment | `inspect devops-family` | `https://devops.{region}.oci.oraclecloud.com/20210630/deployEnvironments` |
| fetch-devops-deploy-pipelines | `inspect devops-family` | `https://devops.{region}.oci.oraclecloud.com/20210630/deployPipelines` |
| fetch-network-security-group | `use network-security-groups` | `https://iaas.{region}.oraclecloud.com/20160918/networkSecurityGroups` |
| fetch-network-security-Rule | `use network-security-groups` | `https://iaas.{region}.oraclecloud.com/20160918/networkSecurityGroups/{networkSecurityGroupId}/securityRules` |
| fetch-oac-analytics-instances | `inspect analytics-instances` | `https://analytics.{region}.ocp.oraclecloud.com/20190331/analyticsInstances`, `https://analytics.{region}.ocp.oraclecloud.com/20190331/analyticsInstances/{analyticsInstanceId}` |
| fetch-oic-integration-instances | `inspect integration-instances` | `https://integration.{region}.ocp.oraclecloud.com/20190131/integrationInstances` |
| fetch-repository | `inspect devops-family` | `https://devops.{region}.oci.oraclecloud.com/20210630/repositories` |
| fetch-security-list | `read security-lists` | `https://iaas.{region}.oraclecloud.com/20160918/securityLists` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `oci_compartment` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| ADB Protected Database | `oci_adb_protected_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Alert Object | `oci_alert_object` | [Alert](https://docs.jupiterone.io/data-model/schemas/Alert) |
| Audit | `oci_audit` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Authentication Policy | `oci_authentication_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Block Volume | `oci_block_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Boot Disk Image | `oci_boot_disk_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Boot Volume | `oci_boot_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| CachingService | `oci_caching` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| CloudGuard Detector Recipe | `oci_cloudguard_detector_recipe` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| CloudGuard Detector Recipe Rule | `oci_cloudguard_detector_recipe_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| CloudGuard Problems | `oci_cloudguard_problem` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| CloudGuard Resource Type | `oci_cloudguard_resource_type` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CloudGuard Security Policy | `oci_cloudguard_security_policy` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| CloudGuard Security Recipe | `oci_cloudguard_security_recipe` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| CloudGuard Security Zone | `oci_cloudguard_security_zone` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CloudGuard Service | `oci_cloudguard` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| CloudGuard Target | `oci_cloudguard_target` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ComputeInstance | `oci_compute_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Container | `oci_container` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| ContainerInstance | `oci_container_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| ContainerInstancesService | `oci_container_instance_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Database | `oci_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Database Home | `oci_database_home` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| DataSafeAuditPolicy | `oci_data_safe_audit_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| DataSafePrivateEndpoint | `oci_data_safe_private_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| DataSafeSecurityPolicy | `oci_data_safe_security_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| DataSafeService | `oci_data_safe` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| DataSafeTargetDatabase | `oci_data_safe_target_database` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| DedicatedVMHost | `oci_dedicated_vm_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| DevopsBuildPipeline | `oci_devops_build_pipeline` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| DevopsDeployEnvironment | `oci_devops_deploy_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| DevopsDeployPipeline | `oci_devops_deploy_pipeline` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| DevopsProject | `oci_devops_project` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| DevopsRepository | `oci_devops_repository` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| DevopsService | `oci_devops_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Domain | `oci_domain` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Exadata Infrastructure | `oci_exadata_infrastructure` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| FastConnectCrossConnectMapping | `oci_fastconnect_cross_connect_mapping` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| FastConnectProviderService | `oci_fastconnect_provider_service` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| FastConnectProviderServiceKey | `oci_fastconnect_provider_service_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| FastConnectService | `oci_fastconnect` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| FastConnectVirtualCircuit | `oci_fastconnect_virtual_circuit` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| File system | `oci_file_system` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| File System Replication | `oci_file_system_replication` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| File System Replication Target | `oci_file_system_replication_target` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| File System Snapshot | `oci_file_system_snapshot` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| File System Snapshot Policy | `oci_file_system_snapshot_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| FunctionsFunction | `oci_functions_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| FunctionsService | `oci_functions` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| GoldenGate Connection | `oci_goldengate_connection` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| GoldenGate Deployment | `oci_goldengate_deployment` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| GoldenGate Deployment Backup | `oci_goldengate_deployment_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| GoldenGate Deployment Upgrade | `oci_goldengate_deployment_upgrade` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Group | `oci_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Kms key | `oci_kms_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| Load Balancer | `oci_load_balancer` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Log | `oci_log` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| Log Analytics Entity | `oci_log_analytics_entity` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Logging Object | `oci_logging_object` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| Logging Service Summary | `oci_logging_service_summary` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| MonitoringAlarm | `oci_monitoring_alarm` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Mount Target | `oci_mount_target` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Network Security Group | `oci_network_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Network Security Rule | `oci_network_security_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| NOSQL Index | `oci_nosql_index` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| NOSQL Service | `oci_nosql` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| NOSQL table | `oci_nosql_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Notification Topic | `oci_notification_topic` | [DataObject](https://docs.jupiterone.io/data-model/schemas/DataObject) |
| OAC Analytics Instance | `oci_oac_analytics_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| ObjectStorageBucket | `oci_objectstorage_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| OIC Integration Instance | `oci_oic_integration_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| OracleObjectStorage | `oci_objectstorage` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Policy | `oci_access_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| RedisCluster | `oci_caching_redis_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| ResourceManagerService | `oci_resourcemanager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| ResourceManagerStacks | `oci_resourcemanager_stack` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Security List | `oci_security_list` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Service Connector | `oci_service_connector` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Streaming Pool | `oci_streaming_stream_pool` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Streaming Service | `oci_streaming` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Streaming Stream | `oci_streaming_stream` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| Subnet | `oci_subnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Subscription | `oci_subscription` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| UseCase | `oci_use_case` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| User | `oci_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| vault | `oci_kms_vault` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Vault secret | `oci_vault_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Vault Service | `oci_vault` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Virtual Cloud Network | `oci_virtual_cloud_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Virtual Network Interface Card | `oci_vnic` | [NetworkInterface](https://docs.jupiterone.io/data-model/schemas/NetworkInterface) |
| VM Cluster | `oci_exadata_vm_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Volume group | `oci_volume_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `oci_access_policy` | **HAS** | `oci_use_case` |
| `oci_boot_volume` | **HAS** | `oci_kms_key` |
| `oci_boot_volume` | **USES** | `oci_boot_disk_image` |
| `oci_caching` | **HAS** | `oci_caching_redis_cluster` |
| `oci_cloudguard` | **HAS** | `oci_cloudguard_detector_recipe` |
| `oci_cloudguard` | **HAS** | `oci_cloudguard_resource_type` |
| `oci_cloudguard` | **HAS** | `oci_cloudguard_security_policy` |
| `oci_cloudguard` | **HAS** | `oci_cloudguard_security_recipe` |
| `oci_cloudguard` | **HAS** | `oci_cloudguard_security_zone` |
| `oci_cloudguard` | **HAS** | `oci_cloudguard_target` |
| `oci_cloudguard_detector_recipe` | **HAS** | `oci_cloudguard_detector_recipe_rule` |
| `oci_cloudguard_detector_recipe_rule` | **IDENTIFIED** | `oci_cloudguard_problem` |
| `oci_cloudguard_security_recipe` | **HAS** | `oci_cloudguard_security_policy` |
| `oci_cloudguard_security_zone` | **USES** | `oci_cloudguard_security_recipe` |
| `oci_cloudguard_target` | **USES** | `oci_cloudguard_detector_recipe` |
| `oci_compartment` | **CONTAINS** | `oci_compartment` |
| `oci_compartment` | **HAS** | `oci_domain` |
| `oci_compartment` | **HAS** | `oci_authentication_policy` |
| `oci_compartment` | **HAS** | `oci_access_policy` |
| `oci_compartment` | **HAS** | `oci_compute_instance` |
| `oci_compartment` | **HAS** | `oci_dedicated_vm_host` |
| `oci_compartment` | **HAS** | `oci_devops_service` |
| `oci_compartment` | **HAS** | `oci_resourcemanager` |
| `oci_compartment` | **HAS** | `oci_caching` |
| `oci_compartment` | **HAS** | `oci_functions` |
| `oci_compartment` | **HAS** | `oci_objectstorage` |
| `oci_compartment` | **HAS** | `oci_vault` |
| `oci_compartment` | **HAS** | `oci_streaming` |
| `oci_compartment` | **HAS** | `oci_nosql` |
| `oci_compartment` | **HAS** | `oci_boot_disk_image` |
| `oci_compartment` | **HAS** | `oci_volume_group` |
| `oci_compartment` | **HAS** | `oci_mount_target` |
| `oci_compartment` | **HAS** | `oci_file_system` |
| `oci_compartment` | **HAS** | `oci_file_system_snapshot_policy` |
| `oci_compartment` | **HAS** | `oci_file_system_snapshot` |
| `oci_compartment` | **HAS** | `oci_file_system_replication` |
| `oci_compartment` | **HAS** | `oci_file_system_replication_target` |
| `oci_compartment` | **HAS** | `oci_alert_object` |
| `oci_compartment` | **HAS** | `oci_subscription` |
| `oci_compartment` | **HAS** | `oci_notification_topic` |
| `oci_compartment` | **HAS** | `oci_logging_object` |
| `oci_compartment` | **HAS** | `oci_log_analytics_entity` |
| `oci_compartment` | **HAS** | `oci_cloudguard` |
| `oci_compartment` | **HAS** | `oci_virtual_cloud_network` |
| `oci_compartment` | **HAS** | `oci_network_security_group` |
| `oci_compartment` | **HAS** | `oci_load_balancer` |
| `oci_compartment` | **HAS** | `oci_adb_protected_database` |
| `oci_compartment` | **HAS** | `oci_exadata_vm_cluster` |
| `oci_compartment` | **HAS** | `oci_database_home` |
| `oci_compartment` | **HAS** | `oci_database` |
| `oci_compartment` | **HAS** | `oci_vnic` |
| `oci_compartment` | **HAS** | `oci_subnet` |
| `oci_compartment` | **HAS** | `oci_exadata_infrastructure` |
| `oci_compartment` | **HAS** | `oci_data_safe` |
| `oci_compartment` | **HAS** | `oci_container_instance_service` |
| `oci_compartment` | **HAS** | `oci_container_instance` |
| `oci_compartment` | **HAS** | `oci_fastconnect` |
| `oci_compartment` | **HAS** | `oci_fastconnect_virtual_circuit` |
| `oci_compartment` | **HAS** | `oci_audit` |
| `oci_compartment` | **HAS** | `oci_service_connector` |
| `oci_compartment` | **HAS** | `oci_goldengate_deployment` |
| `oci_compartment` | **HAS** | `oci_goldengate_connection` |
| `oci_compute_instance` | **HAS** | `oci_boot_volume` |
| `oci_container_instance` | **HAS** | `oci_container` |
| `oci_container_instance` | **USES** | `oci_subnet` |
| `oci_container_instance` | **USES** | `oci_network_security_group` |
| `oci_container_instance` | **USES** | `oci_vault_secret` |
| `oci_container_instance_service` | **HAS** | `oci_container_instance` |
| `oci_data_safe` | **HAS** | `oci_data_safe_private_endpoint` |
| `oci_data_safe` | **HAS** | `oci_data_safe_security_policy` |
| `oci_data_safe` | **HAS** | `oci_data_safe_target_database` |
| `oci_data_safe` | **HAS** | `oci_data_safe_audit_policy` |
| `oci_data_safe_audit_policy` | **MONITORS** | `oci_data_safe_target_database` |
| `oci_data_safe_private_endpoint` | **USES** | `oci_subnet` |
| `oci_data_safe_target_database` | **USES** | `oci_data_safe_private_endpoint` |
| `oci_database` | **USES** | `oci_kms_vault` |
| `oci_database_home` | **HAS** | `oci_database` |
| `oci_dedicated_vm_host` | **HAS** | `oci_compute_instance` |
| `oci_devops_project` | **USES** | `oci_devops_deploy_pipeline` |
| `oci_devops_project` | **USES** | `oci_devops_deploy_environment` |
| `oci_devops_project` | **USES** | `oci_devops_build_pipeline` |
| `oci_devops_project` | **USES** | `oci_devops_repository` |
| `oci_devops_service` | **HAS** | `oci_devops_project` |
| `oci_domain` | **HAS** | `oci_group` |
| `oci_domain` | **HAS** | `oci_user` |
| `oci_exadata_infrastructure` | **HOSTS** | `oci_exadata_vm_cluster` |
| `oci_exadata_vm_cluster` | **USES** | `oci_subnet` |
| `oci_exadata_vm_cluster` | **USES** | `oci_network_security_group` |
| `oci_exadata_vm_cluster` | **HAS** | `oci_database_home` |
| `oci_fastconnect` | **HAS** | `oci_fastconnect_provider_service` |
| `oci_fastconnect` | **HAS** | `oci_fastconnect_virtual_circuit` |
| `oci_fastconnect_provider_service` | **HAS** | `oci_fastconnect_provider_service_key` |
| `oci_fastconnect_virtual_circuit` | **HAS** | `oci_fastconnect_cross_connect_mapping` |
| `oci_fastconnect_virtual_circuit` | **USES** | `oci_fastconnect_provider_service` |
| `oci_file_system` | **HAS** | `oci_file_system_snapshot` |
| `oci_file_system` | **HAS** | `oci_kms_key` |
| `oci_file_system` | **USES** | `oci_file_system_snapshot_policy` |
| `oci_file_system_replication` | **CONNECTS** | `oci_file_system` |
| `oci_file_system_replication` | **USES** | `oci_file_system_replication_target` |
| `oci_functions` | **HAS** | `oci_functions_function` |
| `oci_functions_function` | **USES** | `oci_subnet` |
| `oci_functions_function` | **USES** | `oci_network_security_group` |
| `oci_functions_function` | **USES** | `oci_kms_key` |
| `oci_goldengate_connection` | **USES** | `oci_subnet` |
| `oci_goldengate_connection` | **USES** | `oci_kms_vault` |
| `oci_goldengate_connection` | **USES** | `oci_vault_secret` |
| `oci_goldengate_deployment` | **HAS** | `oci_goldengate_deployment_backup` |
| `oci_goldengate_deployment` | **HAS** | `oci_goldengate_deployment_upgrade` |
| `oci_goldengate_deployment` | **USES** | `oci_subnet` |
| `oci_goldengate_deployment` | **USES** | `oci_domain` |
| `oci_goldengate_deployment` | **USES** | `oci_vault_secret` |
| `oci_group` | **HAS** | `oci_user` |
| `oci_kms_key` | **PROTECTS** | `oci_streaming_stream_pool` |
| `oci_kms_key` | **PROTECTS** | `oci_block_volume` |
| `oci_kms_key` | **PROTECTS** | `oci_oac_analytics_instance` |
| `oci_kms_key` | **PROTECTS** | `oci_database_home` |
| `oci_kms_key` | **PROTECTS** | `oci_database` |
| `oci_kms_key` | **PROTECTS** | `oci_goldengate_connection` |
| `oci_kms_vault` | **HAS** | `oci_kms_key` |
| `oci_kms_vault` | **HAS** | `oci_vault_secret` |
| `oci_load_balancer` | **HAS** | `oci_subnet` |
| `oci_log` | **LOGS** | `oci_subnet` |
| `oci_log` | **LOGS** | `oci_virtual_cloud_network` |
| `oci_log` | **LOGS** | `oci_network_security_group` |
| `oci_log` | **LOGS** | `oci_objectstorage_bucket` |
| `oci_log` | **LOGS** | `oci_kms_vault` |
| `oci_log` | **LOGS** | `oci_kms_key` |
| `oci_log` | **LOGS** | `oci_vault_secret` |
| `oci_log` | **USES** | `oci_logging_service_summary` |
| `oci_log` | **LOGS** | `oci_file_system` |
| `oci_log` | **LOGS** | `oci_mount_target` |
| `oci_log` | **LOGS** | `oci_goldengate_deployment` |
| `oci_logging_object` | **HAS** | `oci_log` |
| `oci_monitoring_alarm` | **MONITORS** | `oci_streaming_stream` |
| `oci_monitoring_alarm` | **MONITORS** | `oci_streaming_stream_pool` |
| `oci_monitoring_alarm` | **MONITORS** | `oci_functions_function` |
| `oci_monitoring_alarm` | **USES** | `oci_notification_topic` |
| `oci_monitoring_alarm` | **MONITORS** | `oci_logging_object` |
| `oci_monitoring_alarm` | **MONITORS** | `oci_file_system` |
| `oci_monitoring_alarm` | **MONITORS** | `oci_mount_target` |
| `oci_mount_target` | **USES** | `oci_subnet` |
| `oci_mount_target` | **USES** | `oci_vault_secret` |
| `oci_network_security_group` | **PROTECTS** | `oci_streaming_stream_pool` |
| `oci_network_security_group` | **PROTECTS** | `oci_mount_target` |
| `oci_network_security_group` | **HAS** | `oci_network_security_rule` |
| `oci_network_security_group` | **PROTECTS** | `oci_data_safe_private_endpoint` |
| `oci_network_security_group` | **PROTECTS** | `oci_goldengate_deployment` |
| `oci_network_security_group` | **PROTECTS** | `oci_goldengate_connection` |
| `oci_nosql` | **HAS** | `oci_nosql_table` |
| `oci_nosql` | **HAS** | `oci_nosql_index` |
| `oci_nosql_table` | **HAS** | `oci_nosql_index` |
| `oci_notification_topic` | **HAS** | `oci_subscription` |
| `oci_oac_analytics_instance` | **ALLOWS** | `oci_virtual_cloud_network` |
| `oci_objectstorage` | **HAS** | `oci_objectstorage_bucket` |
| `oci_oic_integration_instance` | **ALLOWS** | `oci_virtual_cloud_network` |
| `oci_resource` | **HAS** | `oci_cloudguard_problem` |
| `oci_resourcemanager` | **HAS** | `oci_resourcemanager_stack` |
| `oci_service_connector` | **USES** | `oci_logging_object` |
| `oci_service_connector` | **USES** | `oci_log` |
| `oci_service_connector` | **USES** | `oci_streaming_stream` |
| `oci_service_connector` | **LOGS** | `oci_objectstorage_bucket` |
| `oci_service_connector` | **LOGS** | `oci_streaming_stream` |
| `oci_service_connector` | **TRIGGERS** | `oci_functions_function` |
| `oci_service_connector` | **SENDS** | `oci_notification_topic` |
| `oci_streaming` | **HAS** | `oci_streaming_stream_pool` |
| `oci_streaming_stream_pool` | **USES** | `oci_subnet` |
| `oci_streaming_stream_pool` | **HAS** | `oci_streaming_stream` |
| `oci_use_case` | **ASSIGNED** | `oci_compartment` |
| `oci_use_case` | **ASSIGNED** | `oci_group` |
| `oci_vault` | **HAS** | `oci_kms_vault` |
| `oci_virtual_cloud_network` | **HAS** | `oci_network_security_group` |
| `oci_virtual_cloud_network` | **HAS** | `oci_security_list` |
| `oci_virtual_cloud_network` | **HAS** | `oci_subnet` |
| `oci_volume_group` | **HAS** | `oci_block_volume` |
| `oci_volume_group` | **HAS** | `oci_boot_volume` |

### Oci Audit

`oci_audit` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isEnabled` | `boolean` | Always true — OCI Audit captures every API call in every compartment automatically and cannot be turned off. Provided for CloudTrail parity queries. |  |
| `region` | `string` | Home region the tenancy-global Audit configuration was read in (informational; the config itself is tenancy-wide). |  |
| `retentionPeriodDays` | `number` **|** `null` | Number of days audit records are retained (90–365). Null if the Audit configuration could not be read. |  |

---

### Oci Compute Instance

`oci_compute_instance` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `availabilityDomain` | `string` |  |  |
| `compartmentId` | `string` |  |  |
| `faultDomain` | `string` |  |  |
| `imageId` | `string` |  |  |
| `lifecycleState` | `string` |  |  |
| `region` | `string` |  |  |
| `securityAttributesState` | `string` |  |  |
| `shape` | `string` |  |  |

---

### Oci Container

`oci_container` inherits from [Container](/data-model/schemas/Container.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `availabilityDomain` | `string` |  |  |
| `compartmentId` | `string` |  |  |
| `containerInstanceId` | `string` |  |  |
| `faultDomain` | `string` **|** `null` |  |  |
| `imageUrl` | `string` |  |  |
| `isNonRootUserCheckEnabled` | `boolean` **|** `null` |  |  |
| `isResourcePrincipalDisabled` | `boolean` **|** `null` |  |  |
| `isRootFileSystemReadonly` | `boolean` **|** `null` |  |  |
| `lifecycleDetails` | `string` **|** `null` |  |  |
| `lifecycleState` | `string` |  |  |
| `memoryLimitInGBs` | `number` **|** `null` |  |  |
| `region` | `string` |  |  |
| `runAsGroup` | `number` **|** `null` |  |  |
| `runAsUser` | `number` **|** `null` |  |  |
| `vcpusLimit` | `number` **|** `null` |  |  |

---

### Oci Container Instance

`oci_container_instance` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `availabilityDomain` | `string` |  |  |
| `compartmentId` | `string` |  |  |
| `containerCount` | `number` |  |  |
| `containerRestartPolicy` | `string` |  |  |
| `encrypted` | `boolean` |  |  |
| `encryptionKeyId` | `string` **|** `null` |  |  |
| `faultDomain` | `string` **|** `null` |  |  |
| `gracefulShutdownTimeoutInSeconds` | `number` **|** `null` |  |  |
| `lifecycleDetails` | `string` **|** `null` |  |  |
| `lifecycleState` | `string` |  |  |
| `memoryInGBs` | `number` |  |  |
| `networkingBandwidthInGbps` | `number` **|** `null` |  |  |
| `ocpus` | `number` |  |  |
| `region` | `string` |  |  |
| `shape` | `string` |  |  |
| `vnicIds` | `array` **|** `null` |  |  |
| `volumeCount` | `number` **|** `null` |  |  |

---

### Oci Dedicated Vm Host

`oci_dedicated_vm_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `availabilityDomain` | `string` |  |  |
| `faultDomain` | `string` |  |  |
| `lifecycleState` | `string` |  |  |
| `region` | `string` |  |  |

---

### Oci Goldengate Connection

`oci_goldengate_connection` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `compartmentId` | `string` | OCID of the compartment that owns this connection. |  |
| `connectionType` | `string` | Broad family of the connected system, e.g. ORACLE, KAFKA, MYSQL, POSTGRESQL, AMAZON\_S3, SNOWFLAKE, OCI\_OBJECT\_STORAGE. |  |
| `goldenGateConnectionId` | `string` | OCID of the GoldenGate connection. |  |
| `ingressIpAddresses` | `array` **|** `null` | Source IP addresses from which GoldenGate deployments connect to this target private IP. These are the addresses ingress security rules on the target need to allow. |  |
| `isUsingSecretIds` | `boolean` **|** `null` | True when sensitive connection attributes are supplied as OCI Vault secret references rather than inline values. Reported by the API as doesUseSecretIds. |  |
| `keyId` | `string` **|** `null` | OCID of the customer-managed KMS master key protecting this connection secrets. Absent when Oracle-managed keys are used. Drives the oci\_kms\_key\_protects\_goldengate\_connection relationship. |  |
| `lifecycleDetails` | `string` **|** `null` | Human-readable detail about the current lifecycle state. |  |
| `lifecycleState` | `string` **|** `null` | Connection lifecycle state (CREATING, UPDATING, ACTIVE, DELETING, DELETED, FAILED). Deleted connections are not ingested. |  |
| `nsgIds` | `array` **|** `null` | OCIDs of the network security groups applied to the connection endpoint. Drives the oci\_network\_security\_group\_protects\_goldengate\_connection relationship. |  |
| `region` | `string` | OCI region in which the connection is defined. |  |
| `routingMethod` | `string` **|** `null` | How deployment traffic reaches the target: SHARED\_SERVICE\_ENDPOINT (through the GoldenGate service network to public hosts), SHARED\_DEPLOYMENT\_ENDPOINT (out of the deployment subnet), or DEDICATED\_ENDPOINT (a private endpoint in the target VCN subnet). SHARED\_SERVICE\_ENDPOINT implies traffic leaves the customer VCN. |  |
| `secretIds` | `array` **|** `null` | Distinct OCIDs of every Vault secret referenced by this connection, collected from all of its \*SecretId attributes (password, wallet, key store, and so on). Drives the oci\_goldengate\_connection\_uses\_vault\_secret relationship. |  |
| `subnetId` | `string` **|** `null` | OCID of the VCN subnet hosting the dedicated private endpoint for this connection. Set when routingMethod is DEDICATED\_ENDPOINT. Drives the oci\_goldengate\_connection\_uses\_subnet relationship. |  |
| `technologyType` | `string` **|** `null` | Specific technology within the connection family, e.g. OCI\_AUTONOMOUS\_DATABASE, AMAZON\_RDS\_ORACLE, APACHE\_KAFKA, AZURE\_SYNAPSE\_ANALYTICS. Distinguishes a managed OCI target from an external third-party one. |  |
| `vaultId` | `string` **|** `null` | OCID of the customer OCI Vault in which GoldenGate manages this connection secrets. Drives the oci\_goldengate\_connection\_uses\_vault relationship. |  |

---

### Oci Goldengate Deployment

`oci_goldengate_deployment` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `backupScheduleBucketName` | `string` **|** `null` | Object Storage bucket that scheduled backups are written to. |  |
| `backupScheduleCompartmentId` | `string` **|** `null` | OCID of the compartment holding the scheduled-backup bucket. May differ from the deployment compartment, which matters when reasoning about who can read backup contents. |  |
| `backupScheduledOn` | `number` **|** `null` | Time of day, as an epoch timestamp in milliseconds, at which the scheduled backup runs. |  |
| `backupScheduleFrequency` | `string` **|** `null` | Cadence of the automatic backup schedule: DAILY, WEEKLY, or MONTHLY. Null when no automatic backup schedule is configured. |  |
| `backupScheduleNamespaceName` | `string` **|** `null` | Object Storage namespace containing the scheduled-backup bucket. |  |
| `compartmentId` | `string` | OCID of the compartment that owns this deployment. |  |
| `cpuCoreCount` | `number` **|** `null` | Number of OCPUs assigned to the deployment. Acts as the auto-scaling baseline when isAutoScalingEnabled is true. |  |
| `deploymentType` | `string` **|** `null` | Kind of GoldenGate deployment, e.g. DATABASE\_ORACLE, BIGDATA, DATABASE\_MICROSOFT\_SQLSERVER, DATABASE\_POSTGRESQL, DATA\_TRANSFORMS. |  |
| `deploymentUrl` | `string` **|** `null` | URL of the GoldenGate deployment console, where the deployment-local REST API and encryption settings are administered. |  |
| `environmentType` | `string` **|** `null` | Deployment environment tier: PRODUCTION or DEVELOPMENT\_OR\_TESTING. Useful for scoping policy to production replication only. |  |
| `fqdn` | `string` **|** `null` | Fully qualified domain name assigned to the deployment console. |  |
| `goldenGateDeploymentId` | `string` | OCID of the GoldenGate deployment. |  |
| `isAutoScalingEnabled` | `boolean` **|** `null` | True when the deployment scales OCPUs automatically up to three times the configured cpuCoreCount. |  |
| `isBackupScheduleMetadataOnly` | `boolean` **|** `null` | True when scheduled backups capture deployment metadata only, excluding trail data. Metadata-only backups are not sufficient for full recovery. |  |
| `isHealthy` | `boolean` **|** `null` | True when OCI reports the deployment as healthy. False indicates the deployment is running but degraded. |  |
| `isLatestVersion` | `boolean` **|** `null` | True when the deployment runs the latest available GoldenGate version. False means a newer version — potentially carrying security fixes — is available. |  |
| `isPublic` | `boolean` **|** `null` | True when the deployment console and endpoints are reachable from the public internet via a public IP. Security-relevant: a public GoldenGate deployment exposes its admin console beyond the VCN. |  |
| `isStorageUtilizationLimitExceeded` | `boolean` **|** `null` | True when the deployment has exceeded its storage limit, which stalls replication until storage is reclaimed. |  |
| `licenseModel` | `string` **|** `null` | Licensing model for the deployment: LICENSE\_INCLUDED or BRING\_YOUR\_OWN\_LICENSE. |  |
| `lifecycleDetails` | `string` **|** `null` | Human-readable detail about the current lifecycle state; carries the actionable reason when the deployment is FAILED or NEEDS\_ATTENTION. |  |
| `lifecycleState` | `string` **|** `null` | Deployment lifecycle state (CREATING, UPDATING, ACTIVE, INACTIVE, DELETING, DELETED, FAILED, NEEDS\_ATTENTION, IN\_PROGRESS, CANCELING, CANCELED, SUCCEEDED, WAITING). Only ACTIVE deployments are running replication. |  |
| `lifecycleSubState` | `string` **|** `null` | Finer-grained state within the lifecycle state, e.g. RECOVERING, STARTING, STOPPING, UPGRADING, RESTORING, BACKUP\_IN\_PROGRESS, ROLLBACK\_IN\_PROGRESS. |  |
| `maintenanceBundleReleaseUpgradePeriodInDays` | `number` **|** `null` | Grace period, in days, before an available bundle release is applied automatically. |  |
| `maintenanceInterimReleaseUpgradePeriodInDays` | `number` **|** `null` | Grace period, in days, before an available interim release is applied automatically. |  |
| `maintenanceIsInterimReleaseAutoUpgradeEnabled` | `boolean` **|** `null` | True when the deployment automatically takes interim releases, which include out-of-cycle security fixes. |  |
| `maintenanceMajorReleaseUpgradePeriodInDays` | `number` **|** `null` | Grace period, in days, before an available major release is applied automatically. |  |
| `maintenanceSecurityPatchUpgradePeriodInDays` | `number` **|** `null` | Grace period, in days, before an available security patch is applied automatically. A long period leaves known vulnerabilities unpatched. |  |
| `nsgIds` | `array` **|** `null` | OCIDs of the network security groups applied to the deployment endpoint. Drives the oci\_network\_security\_group\_protects\_goldengate\_deployment relationship. |  |
| `oggAdminUsername` | `string` **|** `null` | Administrator username for the GoldenGate deployment console. |  |
| `oggCredentialStore` | `string` **|** `null` | Where deployment credentials are held: GOLDENGATE (the deployment-local credential store) or IAM (OCI Identity Domains). IAM centralises authentication and is the stronger posture. |  |
| `oggIdentityDomainId` | `string` **|** `null` | OCID of the OCI Identity Domain backing deployment authentication. Present when oggCredentialStore is IAM. |  |
| `oggVersion` | `string` **|** `null` | GoldenGate software version running in the deployment. Compare against isLatestVersion to spot unpatched deployments. |  |
| `privateIpAddress` | `string` **|** `null` | Private IP address of the deployment within its VCN subnet. |  |
| `publicIpAddress` | `string` **|** `null` | Public IP address of the deployment. Present only when isPublic is true. |  |
| `region` | `string` | OCI region in which the deployment resides. |  |
| `secretIds` | `array` **|** `null` | Distinct OCIDs of the Vault secrets holding this deployment own credentials: the console admin password and the SSL private key. Drives the oci\_goldengate\_deployment\_uses\_vault\_secret relationship. Absent when the deployment could not be enriched beyond its list summary. |  |
| `storageUtilizationInBytes` | `number` **|** `null` | Storage currently consumed by the deployment, in bytes. |  |
| `subnetId` | `string` **|** `null` | OCID of the VCN subnet the deployment private endpoint is attached to. Drives the oci\_goldengate\_deployment\_uses\_subnet relationship. |  |

---

### Oci Goldengate Deployment Backup

`oci_goldengate_deployment_backup` inherits from [Backup](/data-model/schemas/Backup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `backupOn` | `number` **|** `null` | Epoch timestamp in milliseconds at which the backup was started. |  |
| `backupType` | `string` **|** `null` | Backup type: INCREMENTAL or FULL. |  |
| `bucketName` | `string` **|** `null` | Object Storage bucket holding the backup object. Bucket-level access controls determine who can read the backup contents. |  |
| `compartmentId` | `string` | OCID of the compartment that owns this backup. |  |
| `deploymentType` | `string` **|** `null` | Kind of deployment the backup was taken from, e.g. DATABASE\_ORACLE or BIGDATA. |  |
| `goldenGateBackupId` | `string` | OCID of the deployment backup. |  |
| `isAutomatic` | `boolean` **|** `null` | True when the backup was produced by the deployment backup schedule rather than taken on demand. |  |
| `isMetadataOnly` | `boolean` **|** `null` | True when the backup captures deployment metadata only, excluding trail data. Metadata-only backups are not sufficient for full recovery. |  |
| `lifecycleDetails` | `string` **|** `null` | Human-readable detail about the current lifecycle state; carries the failure reason for a FAILED backup. |  |
| `lifecycleState` | `string` **|** `null` | Backup lifecycle state (CREATING, ACTIVE, DELETING, DELETED, FAILED, NEEDS\_ATTENTION, IN\_PROGRESS, CANCELING, CANCELED). Only ACTIVE backups are restorable. |  |
| `namespaceName` | `string` **|** `null` | Object Storage namespace containing the bucket. |  |
| `objectName` | `string` **|** `null` | Name of the backup object within the bucket. |  |
| `oggVersion` | `string` | GoldenGate version the backup was taken from, which constrains the deployments it can be restored into. |  |
| `region` | `string` | OCI region in which the backup resides. |  |
| `sizeInBytes` | `number` **|** `null` | Size of the backup object, in bytes. |  |
| `timeBackupFinishedOn` | `number` **|** `null` | Epoch timestamp in milliseconds at which the backup completed. |  |

---

### Oci Goldengate Deployment Upgrade

`oci_goldengate_deployment_upgrade` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `compartmentId` | `string` | OCID of the compartment that owns this upgrade. |  |
| `deploymentUpgradeType` | `string` **|** `null` | How the upgrade is driven: MANUAL (customer-initiated) or AUTOMATIC (applied by OCI under the deployment maintenance configuration). |  |
| `goldenGateUpgradeId` | `string` | OCID of the deployment upgrade. |  |
| `isCancelAllowed` | `boolean` **|** `null` | True when the upgrade can still be cancelled. |  |
| `isRescheduleAllowed` | `boolean` **|** `null` | True when the upgrade can still be rescheduled. |  |
| `isRollbackAllowed` | `boolean` **|** `null` | True when the deployment can still be rolled back to previousOggVersion. |  |
| `isSecurityFix` | `boolean` **|** `null` | True when the upgrade carries a security fix. A pending security-fix upgrade means the deployment currently runs a known-vulnerable version. |  |
| `isSnoozed` | `boolean` **|** `null` | True when the upgrade has been deferred. A snoozed security-fix upgrade is a deliberately deferred patch. |  |
| `lifecycleDetails` | `string` **|** `null` | Human-readable detail about the current lifecycle state; carries the failure reason for a FAILED upgrade. |  |
| `lifecycleState` | `string` **|** `null` | Upgrade lifecycle state (CREATING, ACTIVE, IN\_PROGRESS, SUCCEEDED, FAILED, CANCELING, CANCELED, WAITING, NEEDS\_ATTENTION, DELETING, DELETED). |  |
| `lifecycleSubState` | `string` **|** `null` | Finer-grained state within the upgrade lifecycle, e.g. UPGRADING, ROLLBACK\_IN\_PROGRESS, RECOVERING. |  |
| `oggVersion` | `string` **|** `null` | GoldenGate version the deployment is being upgraded to. |  |
| `previousOggVersion` | `string` **|** `null` | GoldenGate version the deployment ran before this upgrade, and the version a rollback would return it to. |  |
| `region` | `string` | OCI region in which the upgrade applies. |  |
| `releaseType` | `string` **|** `null` | Release channel of the target version: MAJOR, BUNDLE, or INTERIM. |  |
| `timeFinishedOn` | `number` **|** `null` | Epoch timestamp in milliseconds at which the upgrade completed. |  |
| `timeOggVersionSupportedUntilOn` | `number` **|** `null` | Epoch timestamp in milliseconds after which the current GoldenGate version is no longer supported. A past value means the deployment runs an end-of-support version. |  |
| `timeReleasedOn` | `number` **|** `null` | Epoch timestamp in milliseconds at which the target version was released by Oracle. The gap to now measures patch latency. |  |
| `timeScheduledOn` | `number` **|** `null` | Epoch timestamp in milliseconds at which the upgrade is scheduled to run. |  |
| `timeScheduleMaxOn` | `number` **|** `null` | Latest epoch timestamp in milliseconds to which the upgrade may be rescheduled before OCI applies it. |  |
| `timeSnoozedUntilOn` | `number` **|** `null` | Epoch timestamp in milliseconds until which the upgrade has been deferred. |  |
| `timeStartedOn` | `number` **|** `null` | Epoch timestamp in milliseconds at which the upgrade began. |  |

---

### Oci Log

`oci_log` inherits from [Logs](/data-model/schemas/Logs.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `compartmentId` | `string` | OCID of the compartment that owns this log. |  |
| `configurationCompartmentId` | `string` **|** `null` | OCID from configuration.compartmentId; may differ from compartmentId for cross-compartment log configurations. |  |
| `isArchivingEnabled` | `boolean` **|** `null` | Whether legacy archiving is enabled (configuration.archiving.isEnabled). Deprecated by OCI in favour of Service Connector Hub but still surfaced for security visibility. |  |
| `isEnabled` | `boolean` **|** `null` | Whether the log is actively ingesting. Disabled logs on sensitive resources are a security signal. |  |
| `lifecycleState` | `string` | Lifecycle state of the log: CREATING, ACTIVE, INACTIVE, UPDATING, DELETING, FAILED. |  |
| `logType` | `string` | Type of log: CUSTOM (agent-emitted) or SERVICE (OCI service-emitted). Security-relevant: SERVICE logs are audited differently. |  |
| `region` | `string` | OCI region of the log. |  |
| `retentionDuration` | `number` **|** `null` | Retention duration in days. CIS-relevant: minimum retention is 90 days for many regulatory frameworks. |  |
| `sourceCategory` | `string` **|** `null` | Log category from configuration.source.category, e.g. read, write, all. |  |
| `sourceResource` | `string` **|** `null` | OCID (or bucket name, for objectstorage) of the resource being logged. Flattened from configuration.source.resource. ADR-005 exception: kept as flat property because cross-tenancy / cross-region / not-yet-ingested OCIDs cannot resolve to relationships. |  |
| `sourceService` | `string` **|** `null` | Service that emits this log (flattened from configuration.source.service). Examples: flowlogs, objectstorage, kms, vaultsecret. Drives the Log→ServiceSummary join. |  |
| `sourceType` | `string` **|** `null` | Source-type discriminator from configuration.source.sourceType, typically OCISERVICE. |  |
| `tenancyId` | `string` **|** `null` | OCID of the tenancy that owns this log. Populated from `getLog` enrichment; null if enrichment failed. |  |
| `timeLastModified` | `number` **|** `null` | Epoch milliseconds of last modification. Parsed via parseTimePropertyValue from timeLastModified. |  |

---

### Oci Log Analytics Entity

`oci_log_analytics_entity` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `areLogsCollected` | `boolean` **|** `null` | Security-critical flag: false means LA is registered but not actively shipping logs. |  |
| `cloudResourceId` | `string` **|** `null` | OCID of the underlying OCI resource (when applicable). Kept flat — not all targets are guaranteed ingested. |  |
| `compartmentId` | `string` | OCID of the compartment. |  |
| `creationSourceDetails` | `string` **|** `null` | creationSource.details. |  |
| `creationSourceType` | `string` **|** `null` | creationSource.type if non-null. |  |
| `entityTypeInternalName` | `string` | Internal entity-type identifier used by LA queries. |  |
| `entityTypeName` | `string` | Human-readable entity type (e.g. 'Linux Host'). |  |
| `hostname` | `string` **|** `null` | Hostname when applicable. |  |
| `lastDiscoveredOn` | `number` **|** `null` | Epoch milliseconds when the entity was last discovered. Parsed via parseTimePropertyValue from timeLastDiscovered. |  |
| `lifecycleDetails` | `string` **|** `null` | Substep/agent-deployment details for the lifecycle state. |  |
| `lifecycleState` | `string` | Entity lifecycle state. |  |
| `managementAgentCompartmentId` | `string` **|** `null` | Compartment OCID of the management agent. |  |
| `managementAgentDisplayName` | `string` **|** `null` | Display name of the management agent. |  |
| `managementAgentId` | `string` **|** `null` | Optional OCID of the Management Agent that ships logs for this entity. |  |
| `metadataItemCount` | `number` **|** `null` | Count of metadata items if present. |  |
| `propertyCount` | `number` **|** `null` | Count of LA properties on the entity (flattened from `properties` keys — never stringify per pr-review.md). |  |
| `region` | `string` | OCI region. |  |
| `sourceId` | `string` **|** `null` | Enterprise Manager repo ID when applicable. |  |
| `timezoneRegion` | `string` **|** `null` | Timezone of the entity for log timestamp normalisation. |  |

---

### Oci Logging Service Summary

`oci_logging_service_summary` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `categoryDisplayNames` | `array` **|** `null` | Deduped list of category display names (resourceTypes\[\].categories\[\].displayName). |  |
| `categoryNames` | `array` **|** `null` | Deduped list of category names across all resource types (resourceTypes\[\].categories\[\].name). |  |
| `endpoint` | `string` | Logging endpoint URL for this service. |  |
| `namespace` | `string` **|** `null` | Logging Analytics namespace if applicable. |  |
| `region` | `string` | Region in which this catalog was fetched (home region by Q7). |  |
| `resourceTypeNames` | `array` **|** `null` | Flattened list of resource-type names this service can emit logs for (resourceTypes\[\].name). |  |
| `serviceId` | `string` **|** `null` | Optional service OCID. |  |
| `serviceName` | `string` | Human-readable service name (mapped from ServiceSummary.name). Also mirrored to inherited displayName. |  |
| `servicePrincipalName` | `string` | Service principal identifier (e.g. 'flowlogs', 'objectstorage'). Used as the join key against oci\_log.sourceService. |  |
| `tenantId` | `string` | OCID of the tenancy in which the service catalog applies. |  |

---

### Oci Monitoring Alarm

`oci_monitoring_alarm` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `alarmSummary` | `string` **|** `null` | Short human-readable alarm summary text from OCI. Surfaces on the inherited Rule.summary property. |  |
| `body` | `string` **|** `null` | Human-readable notification body content sent when the alarm fires. From getAlarm enrichment; null if getAlarm failed and the integration fell back to the summary. |  |
| `compartmentId` | `string` | OCID of the compartment that owns this alarm. |  |
| `destinations` | `array` of `string`s | OCIDs of notification destinations (typically oci\_notification\_topic). Drives the alarm-uses-notification-topic relationship; orphan/cross-tenancy OCIDs are skipped silently. |  |
| `evaluationSlackDuration` | `string` **|** `null` | ISO 8601 duration the evaluator waits for late-arriving metrics before scoring a window. Range PT3M-PT2H; default PT3M. |  |
| `isEnabled` | `boolean` | Whether the alarm is currently active. Disabled alarms do not evaluate or notify. Also surfaces on the inherited Rule.active property. |  |
| `isNotificationsPerMetricDimensionEnabled` | `boolean` **|** `null` | When true, the alarm splits notifications per distinct metric dimension stream rather than aggregating. |  |
| `lifecycleState` | `string` | Lifecycle state of the alarm resource. The integration filters listAlarms to lifecycleState=ACTIVE, so this field is effectively always ACTIVE in the graph today. |  |
| `messageFormat` | `string` **|** `null` | Message format used to render the notification body (e.g. RAW, PRETTY\_JSON, ONS\_OPTIMIZED). From getAlarm enrichment. |  |
| `metricCompartmentId` | `string` | OCID of the compartment whose metrics this alarm evaluates. May differ from compartmentId for cross-compartment alarms. |  |
| `namespace` | `string` | The OCI Monitoring namespace this alarm queries (e.g. oci\_streaming, oci\_faas, oci\_computeagent). Drives which resource type can be the alarm target. Also surfaces on the inherited Rule.category property. |  |
| `notificationTitle` | `string` **|** `null` | Customizable notification title shown in delivered messages. |  |
| `notificationVersion` | `string` | Version of the notification payload format delivered when the alarm fires. |  |
| `overrideCount` | `number` | Number of conditional overrides configured on this alarm. Overrides allow per-dimension severity/predicate variation and complicate audit review. |  |
| `pendingDuration` | `string` **|** `null` | ISO 8601 duration the alarm waits in the firing state before triggering notifications. Used to suppress noisy short-lived breaches. From getAlarm enrichment. |  |
| `query` | `string` | The MQL expression evaluated by this alarm. Includes the metric name, dimension filters (e.g. resourceId="ocid1.stream..."), aggregation, and predicate. This field is the source of truth for the alarm-monitors-resource relationships. |  |
| `region` | `string` | OCI region in which the alarm is configured. |  |
| `repeatNotificationDuration` | `string` **|** `null` | ISO 8601 duration between repeated notifications while the alarm remains in the firing state. From getAlarm enrichment. |  |
| `resolution` | `string` **|** `null` | Time grain at which the metric is evaluated (e.g. 1m, 5m, 1h). From getAlarm enrichment. |  |
| `resourceGroup` | `string` **|** `null` | Optional MQL resource group filter, used for custom metrics. Null when the alarm targets a built-in namespace. |  |
| `ruleName` | `string` | Identifier of the alarm rule whose values this configuration represents. Defaults to "BASE". |  |
| `severity` | `string` | Operator-perceived severity when the alarm fires. One of CRITICAL, ERROR, WARNING, INFO. Mapped to the inherited Rule.criticality numeric (10/7/4/1) for queryability. |  |
| `suppressionDescription` | `string` **|** `null` | Reason for the active suppression window, if any. Flattened from suppression.description. |  |
| `suppressionFromOn` | `number` **|** `null` | Epoch ms when the active suppression window starts. Null if no suppression configured. Parsed via parseTimePropertyValue from suppression.timeSuppressFrom. |  |
| `suppressionUntilOn` | `number` **|** `null` | Epoch ms when the active suppression window ends. Parsed via parseTimePropertyValue from suppression.timeSuppressUntil. |  |

---

### Oci Oac Analytics Instance

`oci_oac_analytics_instance` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `capacityType` | `string` |  |  |
| `capacityValue` | `number` |  |  |
| `featureSet` | `string` |  |  |
| `lifecycleState` | `string` |  |  |
| `networkEndpointType` | `string` |  |  |
| `region` | `string` |  |  |

---

### Oci Oic Integration Instance

`oci_oic_integration_instance` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `consumptionModel` | `string` |  |  |
| `customEndpointAlias` | `string` |  |  |
| `customEndpointCertificateSecretId` | `string` |  |  |
| `customEndpointCertificateSecretVersion` | `number` |  |  |
| `customEndpointHostname` | `string` |  |  |
| `instanceUrl` | `string` |  |  |
| `integrationInstanceType` | `string` |  |  |
| `isByol` | `boolean` |  |  |
| `isFileServerEnabled` | `boolean` |  |  |
| `isIntegrationVcnAllowlisted` | `boolean` |  |  |
| `isVisualBuilderEnabled` | `boolean` |  |  |
| `lifecycleState` | `string` |  |  |
| `messagePacks` | `number` |  |  |
| `networkEndpointDetailsType` | `string` |  |  |
| `region` | `string` |  |  |
| `stateMessage` | `string` |  |  |

---

### Oci Service Connector

`oci_service_connector` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `batchRolloverSizeInMBs` | `number` **|** `null` | Batch rollover size (MB) for an objectStorage target. |  |
| `batchRolloverTimeInMs` | `number` **|** `null` | Batch rollover time (ms) for an objectStorage target. |  |
| `compartmentId` | `string` | OCID of the compartment that owns this connector. |  |
| `isAuditSource` | `boolean` | True when the connector reads from the tenancy \_Audit log group (i.e. it is routing audit logs). OCI represents this source with the reserved literal \_Audit/\_AuditIncludeSubcompartment rather than a log-group OCID, so it is captured here rather than in sourceLogGroupIds. |  |
| `isEnabled` | `boolean` | True when lifecycleState is ACTIVE (data is flowing). False means the connector exists but is not delivering data. |  |
| `isFormattedMessagingEnabled` | `boolean` **|** `null` | Whether formatted messaging is enabled for a notifications target. |  |
| `isFunctionTaskEnabled` | `boolean` | True when the connector has a function task that transforms/masks source data by invoking a function before delivery. |  |
| `isLogFilterEnabled` | `boolean` | True when the connector has a logRule task that filters/masks source data before delivery. |  |
| `lifecycleDetails` | `string` **|** `null` | Human-readable detail about the current lifecycle state. |  |
| `lifecycleState` | `string` **|** `null` | Connector lifecycle state (CREATING, UPDATING, ACTIVE, INACTIVE, DELETING, DELETED, FAILED). Only ACTIVE connectors are actually delivering data. |  |
| `logFilterCondition` | `string` **|** `null` | The logRule task condition applied to source data before delivery. |  |
| `region` | `string` | OCI region in which the connector is configured. |  |
| `sourceKind` | `string` **|** `null` | Source type: logging, streaming, monitoring, or plugin. |  |
| `sourceLogGroupIds` | `array` of `string`s | OCIDs of the Logging log groups read by this connector (logging source). Excludes the reserved audit log group — see isAuditSource. |  |
| `sourceLogIds` | `array` of `string`s | OCIDs of the specific Logging logs read by this connector (logging source). |  |
| `sourceMonitoringNamespaces` | `array` of `string`s | Metric namespaces read by this connector (monitoring source). |  |
| `sourcePluginName` | `string` **|** `null` | Plugin name when the source is a plugin (e.g. QueueSource). |  |
| `sourceStreamId` | `string` **|** `null` | OCID of the stream read by this connector (streaming source). |  |
| `targetBucketName` | `string` **|** `null` | Object Storage bucket name the connector delivers to (objectStorage target). |  |
| `targetFunctionId` | `string` **|** `null` | OCID of the function the connector invokes (functions target). |  |
| `targetKind` | `string` **|** `null` | Target sink type: objectStorage, streaming, functions, notifications, monitoring, or loggingAnalytics. |  |
| `targetLoggingAnalyticsLogGroupId` | `string` **|** `null` | OCID of the Logging Analytics log group the connector delivers to (loggingAnalytics target). No local entity is modelled for this sink. |  |
| `targetMonitoringMetric` | `string` **|** `null` | Metric name the connector writes to (monitoring target). |  |
| `targetMonitoringNamespace` | `string` **|** `null` | Metric namespace the connector writes to (monitoring target). |  |
| `targetNamespace` | `string` **|** `null` | Object Storage namespace of the target bucket. |  |
| `targetObjectNamePrefix` | `string` **|** `null` | Object name prefix applied to delivered objects (objectStorage target). |  |
| `targetStreamId` | `string` **|** `null` | OCID of the stream the connector delivers to (streaming target). |  |
| `targetTopicId` | `string` **|** `null` | OCID of the notification topic the connector delivers to (notifications target). |  |
| `taskFunctionId` | `string` **|** `null` | OCID of the function invoked by the connector function task, if any. |  |

---

### Oci Streaming Stream

`oci_streaming_stream` inherits from [DataCollection](/data-model/schemas/DataCollection.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `classification` | `string` | The lifecycle state of the stream (e.g., ACTIVE, DELETED) — surfaces as the DataCollection classification |  |
| `compartmentId` | `string` | The OCID of the compartment containing the stream |  |
| `messagesEndpoint` | `string` | The endpoint URL used to publish/consume messages on the stream |  |
| `oracleStreamingStreamId` | `string` | The OCID of the stream |  |
| `partitions` | `number` | Number of partitions in the stream |  |
| `region` | `string` | The OCI region of the stream |  |

---

### Oci Streaming Stream Pool

`oci_streaming_stream_pool` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `compartmentId` | `string` | The OCID of the compartment containing the stream pool |  |
| `endpointFqdn` | `string` **|** `null` | The fully qualified domain name (FQDN) of the stream pool endpoint |  |
| `isPrivate` | `boolean` | Whether the stream pool uses a private endpoint inside a customer VCN |  |
| `kafkaLogRetentionHours` | `number` **|** `null` | The number of hours to retain Kafka log files in the stream pool (OCI KafkaSettings.logRetentionHours) |  |
| `kmsKeyId` | `string` **|** `null` | The OCID of the customer-managed KMS key used to encrypt the stream pool |  |
| `kmsKeyState` | `string` **|** `null` | The state of the customer-managed KMS key (e.g., ACTIVE, REVOKED) |  |
| `lifecycleState` | `string` | The lifecycle state of the stream pool (e.g., ACTIVE, CREATING, DELETED) |  |
| `nsgIds` | `array` **|** `null` | OCIDs of network security groups attached to the stream pool private endpoint |  |
| `oracleStreamingPoolId` | `string` | The OCID of the stream pool |  |
| `privateEndpointIp` | `string` **|** `null` | The private IP address of the stream pool endpoint |  |
| `region` | `string` | The OCI region of the stream pool |  |
| `subnetId` | `string` **|** `null` | The OCID of the subnet hosting the stream pool private endpoint |  |

---

### Oci User

`oci_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `compartmentId` | `string` |  |  |

---

## Release Notes

-   **2026-04-30** — Added OCI Monitoring alarm ingestion, with relationships to monitored streams, stream pools, functions, and notification topics.
-   **2026-04-08** — Improved OS type and OS details accuracy on Oracle Cloud host and container instance entities.
-   **2026-03-26** — Added multi-region support to the Oracle Cloud integration, allowing ingestion across multiple OCI regions in a single run.
-   **2026-03-23** — Added OCI FastConnect data model, ingesting virtual circuits and cross-connect groups.
-   **2026-03-13** — Added OCI Container Instance data model, ingesting container instances and their containers.
-   **2026-03-13** — Added OCI Data Safe data model, ingesting target databases and security assessments.
-   **2026-02-19** — Promoted raw data properties to five OCI entity types including functions and networking resources.
-   **2026-02-17** — Extended OCI NoSQL table data model with new properties (lifecycle details, multi-region support, auto-reclaimable status, max read units, max write units, max storage in GBs, and capacity mode) and added CloudGuard problem mapping for NoSQL table resources.
-   **2025-12-15** — Added ingestion of OCI databases, Exadata infrastructure and VM clusters, dedicated VM hosts, network security rules, boot disk images, and NFS mount targets with full compartment relationship mapping.
-   **2025-12-04** — Added support for OCI Identity Domains, ingesting domain users and groups as Oracle IAM user and Oracle IAM group entities with user-group membership relationships.
-   **2025-11-13** — Added OCI CloudGuard Recipes and CloudGuard Recipe Rules as new ingested entity types.
-   **2025-11-04** — Promoted additional Oracle Database properties including database edition, character set, and connection string details.
-   **2025-10-16** — Added OCI Exadata Database Service resources including Exadata infrastructure and VM cluster entities.
-   **2025-10-02** — Added resource to CloudGuard problem relationships linking OCI resources to their associated CloudGuard problems.
-   **2025-09-10** — Promoted compartment ID from raw data to OCI compartment entities for easier querying.
-   **2025-08-25** — Added OCI Vault ingestion as vault entities with secret and key relationships.
-   **2025-05-06** — Added OCI Exadata Infrastructure ingestion and enhanced host entity properties.
-   **2025-05-06** — Added OCI Load Balancer ingestion as load balancer entities with listener and backend relationships.

---

Source: /integrations/directory/orca

# Orca Security

Visualize Orca Security assets, findings, roles, users, and user groups, map Orca users to employees, and monitor changes through queries and alerts.

## Installation

To initiate this integration in JupiterOne, you will first need to create an API token within Orca to use in JupiterOne.

### Configuration in Orca

**To create an API token:**

1.  Log into the [Orca dashboard](https://app.orcasecurity.io) and navigate to **Settings > Modules > Integrations**.
2.  Scroll to the `SIEM/SOAR` section.
3.  Find the JupiterOne tile and press `CONFIGURE`
4.  Enter a `Name` and `Description` (optional)
5.  Select the `Internal Viewer` role. If a lesser role is provided, the integration will attempt to run as many steps as it is able to.
6.  Select the desired unit `Scope`. To ingest all data from all units, select `All Cloud Accounts`
7.  Press `CREATE TOKEN` and copy the token value that appears for use in JupiterOne. The token value will not be available after closing this screen.

> **NOTE**
> 
> Legacy API Keys will continue to be supported until Orca removes support for them. For more information about API Tokens, see [Orca's documentation](https://docs.orcasecurity.io).

### Configuration in JupiterOne

To install the Orca integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Orca. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Orca account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **Orca Security Account Email** (the email address used within Orca to generate the API credentials).
    
-   Lastly, the Orca **API Key**, corresponding **Token**, and **Orca API Base URL** from your Orca account.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `orca_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `orca_finding_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Asset | `orca_asset` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Finding | `orca_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Finding | `orca_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Host | `orca_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Role | `orca_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| User | `orca_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| UserGroup | `orca_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `orca_account` | **HAS** | `orca_group` |
| `orca_account` | **HAS** | `orca_asset` |
| `orca_asset` | **IS** | `orca_host` |
| `orca_asset` | **HAS** | `orca_finding` |
| `orca_finding` | **IS** | `cve` |
| `orca_group` | **HAS** | `orca_user` |
| `orca_host` | **HAS** | `orca_finding` |
| `orca_user` | **ASSIGNED** | `orca_role` |

### Orca Finding

`orca_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`affectedPackages` \*

 | `array` of `string`s |  |  |
| 

`assetCategory` \*

 | `string` |  |  |
| 

`assetDistributionName` \*

 | `string` |  |  |
| 

`assetLabels` \*

 | `array` of `string`s |  |  |
| 

`assetType` \*

 | `string` |  |  |
| 

`assetVendorId` \*

 | `string` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`cloudVendorId` \*

 | `string` |  |  |
| 

`clusterType` \*

 | `string` |  |  |
| 

`cvss2Score` \*

 | `number` |  |  |
| 

`cvss3Score` \*

 | `number` |  |  |
| 

`fixable` \*

 | `boolean` |  |  |
| 

`groupType` \*

 | `string` |  |  |
| 

`orcaScore` \*

 | `number` |  |  |
| 

`orcaSeverity` \*

 | `string` |  |  |
| 

`packages` \*

 | `array` of `string`s |  |  |
| 

`type` \*

 | `string` |  |  |
| 

`vmId` \*

 | `string` |  |  |

---

### Orca Finding

`orca_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`affectedPackages` \*

 | `array` of `string`s |  |  |
| 

`assetCategory` \*

 | `string` |  |  |
| 

`assetDistributionName` \*

 | `string` |  |  |
| 

`assetLabels` \*

 | `array` of `string`s |  |  |
| 

`assetType` \*

 | `string` |  |  |
| 

`assetVendorId` \*

 | `string` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`cloudVendorId` \*

 | `string` |  |  |
| 

`clusterType` \*

 | `string` |  |  |
| 

`cvss2Score` \*

 | `number` |  |  |
| 

`cvss3Score` \*

 | `number` |  |  |
| 

`fixable` \*

 | `boolean` |  |  |
| 

`groupType` \*

 | `string` |  |  |
| 

`orcaScore` \*

 | `number` |  |  |
| 

`orcaSeverity` \*

 | `string` |  |  |
| 

`packages` \*

 | `array` of `string`s |  |  |
| 

`type` \*

 | `string` |  |  |
| 

`vmId` \*

 | `string` |  |  |

---

## Release Notes

-   **2026-03-31** — Added OS kernel version property to Orca host and asset entities.

---

Source: /integrations/directory/pagerduty

# PagerDuty

Visualize PagerDuty services, teams, and users, map PagerDuty users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create a General Access REST API key on PagerDuty for use in JupiterOne. See [their documentation](https://support.pagerduty.com/docs/generating-api-keys#section-generating-a-general-access-rest-api-key) for more information.

### Configuration in JupiterOne

To install the PagerDuty integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select PagerDuty. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the PagerDuty account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Lastly, your PagerDuty **API Key**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Service | `pagerduty_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Team | `pagerduty_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team) |
| User | `pagerduty_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `pagerduty_service` | **ASSIGNED** | `pagerduty_team` |
| `pagerduty_team` | **HAS** | `pagerduty_user` |
| `pagerduty_user` | **MONITORS** | `pagerduty_service` |

### Pagerduty User

`pagerduty_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admin` | `boolean` |  |  |
| `billed` | `boolean` |  |  |
| `description` | `string` |  |  |
| `invitationSent` | `boolean` |  |  |
| `jobTitle` | `string` |  |  |
| `role` | `string` |  |  |
| `timeZone` | `string` |  |  |
| `type` | `string` |  |  |
| `webLink` | `string` |  |  |

---

---

Source: /integrations/directory/palo-alto

# Palo Alto Cortex XDR

Strengthen your endpoint security with JupiterOne's Palo Alto Cortex XDR integration. Our guide offers detailed instructions on setting up the integration and utilizing its comprehensive data model to gain visibility into your device and endpoint security data. Learn how the integration can help you detect potential security threats and streamline your security operations.

## Installation

> **INFO**
> 
> Before you begin, create an API key in Palo Alto Cortex XDR. See the [Cortex XDR documentation](https://cortex-docs.paloaltonetworks.com/xdr-5-api/create-a-new-api-key) for step-by-step instructions.

To install the Palo Alto Cortex XDR integration in JupiterOne, navigate to the **Integrations** tab and select **Palo Alto Cortex XDR**. Click **New Instance** to begin.

### Prerequisites

Creating a Palo Alto Cortex XDR integration instance requires the following:

-   A Cortex XDR API key and API key ID. In Cortex XDR, navigate to **Settings** > **Configurations** > **Integrations** > **API Keys** and generate a new key.
    -   Select the **Standard** security level.
    -   Assign the appropriate role:
        -   To ingest Users, User Groups, and Roles, assign the **Instance Administrator** role.
        -   For all other data, the **Viewer** role is sufficient.
    -   After generation, copy the API key value and note the numeric **API Key ID** shown in the table. Your tenant **Host** is the FQDN displayed in the Cortex XDR top-right URL bar (for example, `tenant-id.xdr.us.paloaltonetworks.com`).
-   Your **Host** (the Cortex XDR tenant FQDN, for example `mytenant.xdr.us.paloaltonetworks.com`)
-   Your **API Key** (the generated key value)
-   Your **API Key ID** (the numeric ID displayed next to the key in the API Keys table)

### Create an instance

1.  Sign in to [Cortex Gateway](https://cortex-gateway.paloaltonetworks.com/signin/).
2.  Select the tenant you want to integrate.
3.  In the Cortex XDR console, navigate to **Settings** > **Configurations** > **Integrations** > **API Keys**.
4.  Click **New Key**. Under **Security Level** choose **Standard**; under **Role** choose **Instance Administrator** (for full data access) or **Viewer** (for alerts, incidents, and endpoints only).
5.  Click **Generate**. Copy the API key — it is shown only once.
6.  Note the **API Key ID** (the numeric value in the table) and the FQDN from your browser's address bar.
7.  In JupiterOne, enter the **Host**, **API Key**, and **API Key ID** in the corresponding fields, then click **Create**.

## Data Volume Configuration

### Ingestion Windows

Limit how far back the integration looks when ingesting incidents and alerts. Narrower windows reduce ingestion volume.

| Field | Description | Default |
| --- | --- | --- |
| Incident Ingestion Window | How far back (in days) to look for incidents based on their last modification time. | 90 days |
| Alert Ingestion Window | How far back (in days) to look for alerts based on their detection timestamp. | 90 days |

Available options for both fields: **1 day**, **7 days**, **30 days**, **60 days**, **90 days**.

### Data Filtering Options

Control which incidents are ingested by status.

| Field | Description | Default |
| --- | --- | --- |
| Incident Status | Restrict ingestion to incidents in specific statuses. When left at the default, only open incidents are ingested. | New, Under Investigation |

Available status options: New, Under Investigation, Resolved (auto-resolve), Resolved (duplicate incident), Resolved (false positive), Resolved (true positive), Resolved (known issue), Resolved (threat handled), Resolved (security testing), Resolved (other).

### Next steps

Your integration is now configured. It will run on the polling interval you selected and populate data in JupiterOne. See the [Instance management guide](/integrations/instance-management.md) for more details on working with integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `palo_alto_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `palo_alto_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Alert | `palo_alto_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Endpoint Agent | `palo_alto_endpoint_sensor` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Endpoint Host | `palo_alto_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Endpoint Policy | `palo_alto_endpoint_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Incident | `palo_alto_incident` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Incident | `palo_alto_incident` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Role | `palo_alto_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Service | `palo_alto_endpoint_protection` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `palo_alto_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Group | `palo_alto_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `palo_alto_account` | **HAS** | `palo_alto_endpoint_protection` |
| `palo_alto_endpoint_policy` | **HAS** | `palo_alto_endpoint_protection` |
| `palo_alto_endpoint_sensor` | **ASSIGNED** | `palo_alto_endpoint_policy` |
| `palo_alto_endpoint_sensor` | **PROTECTS** | `palo_alto_host` |
| `palo_alto_endpoint_sensor` | **IDENTIFIED** | `palo_alto_incident` |
| `palo_alto_endpoint_sensor` | **IDENTIFIED** | `palo_alto_alert` |
| `palo_alto_host` | **HAS** | `palo_alto_incident` |
| `palo_alto_incident` | **HAS** | `palo_alto_alert` |
| `palo_alto_user` | **HAS** | `palo_alto_role` |
| `palo_alto_user_group` | **HAS** | `palo_alto_role` |
| `palo_alto_user_group` | **HAS** | `palo_alto_user` |

### Palo Alto Host

`palo_alto_host` inherits from [Host](/data-model/schemas/Host.md)

---

### Palo Alto User

`palo_alto_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `groups` | `array` of `string`s |  |  |
| `lastLoggedIn` | `number` |  |  |
| `role` | `string` |  |  |

---

---

Source: /integrations/directory/palo-alto-panorama

# Palo Alto Panorama

Visualize your Palo Alto Panorama estate in JupiterOne — the managed firewalls, device groups, address objects and address groups, and the security policy rules applied across them — and monitor policy and inventory changes through queries and alerts.

## Installation

This integration reads data from Palo Alto **Panorama** over the [PAN-OS XML API](https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api) — the Panorama instance itself, the firewalls it manages, device groups, address objects and address groups, and the pre- and post-rulebase security policy rules. It is read-only: it issues only configuration read and operational `show` requests, and never commits or modifies your configuration.

Panorama is typically deployed on-premises and not reachable from the internet, so this integration is most often run through a [JupiterOne Collector](/integrations/development/collector.md) inside your network.

### Configuration in Panorama

The integration authenticates as a Panorama administrator and generates an API key with a `type=keygen` request. Create a dedicated administrator for it rather than reusing an existing account.

#### 1\. Create an Admin Role profile with XML API access

1.  Log in to the Panorama web interface as an administrator.
    
2.  Select **Panorama > Admin Roles** and click **Add**.
    
3.  Enter a **Name** for the profile — for example, `jupiterone-readonly`.
    
4.  Set the **Role** type to **Panorama**.
    
    > **INFO**
    > 
    > The **XML API** tab is only available when the Role type is **Panorama**. A **Device Group and Template** role cannot be granted XML API access.
    
5.  Select the **XML API** tab and **Enable** the following two functional areas, leaving the rest **Disabled**:
    
    | XML API functional area | Why the integration needs it |
    | --- | --- |
    | **Configuration** | Reads device groups, address objects, address groups, and security rules (`type=config`). |
    | **Operational Requests** | Runs `show system info`, `show devices all`, and `show dg-hierarchy` (`type=op`). |
    
    **Report**, **Log**, **Commit**, **User-ID Agent**, **Export**, and **Import** are not used and should stay disabled.
    
    > **NOTE**
    > 
    > The XML API functional areas are single **Enabled**/**Disabled** toggles — unlike the Web UI tab, they have no read-only setting. Enabling **Configuration** therefore permits both retrieving and modifying configuration over the XML API. The integration only ever retrieves it.
    
6.  Click **OK**.
    

#### 2\. Create the administrator account

1.  Select **Panorama > Administrators** and click **Add**.
    
2.  Enter a **Name** for the administrator — for example, `jupiterone`.
    
3.  Leave **Authentication Profile** set to **None** and enter a **Password** to authenticate locally, or select an authentication profile if you manage administrators externally.
    
4.  Set **Administrator Type** to **Custom Panorama Admin** and select the Admin Role profile you created above.
    
5.  Click **OK**.
    

#### 3\. Commit your changes

Select **Commit > Commit to Panorama** to apply the new role and administrator.

#### Network and TLS requirements

-   The integration reaches Panorama over HTTPS on port `443`. Ensure the Collector has network access to the Panorama management interface, and that the management interface permits HTTPS access from it.
    
-   If Panorama presents a self-signed or internal-CA TLS certificate, obtain that CA certificate in PEM format so the Collector can verify the connection.
    

Once you have the hostname, username, and password, proceed to JupiterOne to finalize the integration.

### Configuration in JupiterOne

To install the Palo Alto Panorama integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Palo Alto Panorama**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Palo Alto Panorama account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **Panorama Host** — the hostname or IP address of your Panorama instance, without a scheme or path, for example `panorama.example.com`.
    
-   The **Username** and **Password** of the Panorama administrator you created.
    
-   Optionally, a **CA Certificate** in PEM format to trust a self-signed or internal-CA certificate, or enable **Disable TLS Verification** to skip certificate validation entirely (not recommended).
    

Click **Create** once all values are provided to finalize the integration.

#### Data sources

You can narrow what the integration collects from the instance's ingestion source settings. **Fetch Device Groups** underpins the others — device groups are the scope that address objects, address groups, and security rules are read from, and disabling it leaves those steps with only the shared-scope objects.

| Ingestion source | Data collected |
| --- | --- |
| **Fetch Firewalls** | Firewalls managed by Panorama, with model, PAN-OS and content versions, and HA state. |
| **Fetch Device Groups** | Device groups and the parent/child hierarchy between them. |
| **Fetch Address Objects** | Address objects in each device group and in the shared scope. |
| **Fetch Address Groups** | Static and dynamic address groups, and their static members. |
| **Fetch Security Rules** | Pre- and post-rulebase security policy rules in each device group and the shared scope. |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Configure an Admin Role Profile](https://docs.paloaltonetworks.com/panorama/administration/configure-administrative-access-to-panorama/configure-an-admin-role-profile)
-   [Configure a Panorama Administrator Account](https://docs.paloaltonetworks.com/panorama/administration/configure-administrative-access-to-panorama/configure-administrative-accounts-and-authentication/configure-a-panorama-administrator-account)
-   [Panorama > Admin Roles](https://docs.paloaltonetworks.com/ngfw/help/10-2/panorama-web-interface/panorama-admin-roles) — reference for each XML API functional area
-   [Enabling API Access](https://docs.paloaltonetworks.com/ngfw/api/api-authentication-and-security/pan-os-api-authentication)
-   [Get Started with the PAN-OS XML API](https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api)

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (11)

-   `GET /api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group`
-   `GET /api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='*']/address`
-   `GET /api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='*']/address-group`
-   `GET /api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='*']/{pre|post}-rulebase/security/rules`
-   `GET /api/?type=config&action=get&xpath=/config/shared/address`
-   `GET /api/?type=config&action=get&xpath=/config/shared/address-group`
-   `GET /api/?type=config&action=get&xpath=/config/shared/{pre|post}-rulebase/security/rules`
-   `GET /api/?type=op&cmd=<show><devices><all></all></devices></show>`
-   `GET /api/?type=op&cmd=<show><dg-hierarchy></dg-hierarchy></show>`
-   `GET /api/?type=op&cmd=<show><system><info></info></system></show>`
-   `POST /api/?type=keygen`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (4)

-   [https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/pan-os-xml-api-request-types](https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/pan-os-xml-api-request-types)
-   [https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/pan-os-xml-api-use-cases/query-a-firewall-from-panorama-api](https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/pan-os-xml-api-use-cases/query-a-firewall-from-panorama-api)
-   [https://pan.dev/panos/docs/tutorials/rulebase-to-csv/](https://pan.dev/panos/docs/tutorials/rulebase-to-csv/)
-   [https://pan.dev/panos/docs/tutorials/working-with-address-groups/](https://pan.dev/panos/docs/tutorials/working-with-address-groups/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | Endpoints |
| --- | --- |
| Fetch Address Groups | `GET /api/?type=config&action=get&xpath=/config/shared/address-group`, `GET /api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='*']/address-group` |
| Fetch Address Objects | `GET /api/?type=config&action=get&xpath=/config/shared/address`, `GET /api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='*']/address` |
| Fetch Firewalls | `GET /api/?type=op&cmd=<show><devices><all></all></devices></show>` |
| Fetch Security Rules | `GET /api/?type=config&action=get&xpath=/config/shared/{pre|post}-rulebase/security/rules`, `GET /api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='*']/{pre|post}-rulebase/security/rules` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `palo_alto_panorama_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AddressGroup | `palo_alto_address_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AddressObject | `palo_alto_address_object` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| DeviceGroup | `palo_alto_device_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Firewall | `palo_alto_firewall` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| SecurityRule | `palo_alto_security_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `palo_alto_address_group` | **HAS** | `palo_alto_address_object` |
| `palo_alto_device_group` | **HAS** | `palo_alto_firewall` |
| `palo_alto_device_group` | **HAS** | `palo_alto_device_group` |
| `palo_alto_device_group` | **HAS** | `palo_alto_address_object` |
| `palo_alto_device_group` | **HAS** | `palo_alto_address_group` |
| `palo_alto_device_group` | **HAS** | `palo_alto_security_rule` |
| `palo_alto_panorama_account` | **MANAGES** | `palo_alto_firewall` |
| `palo_alto_panorama_account` | **HAS** | `palo_alto_device_group` |
| `palo_alto_panorama_account` | **HAS** | `palo_alto_address_object` |
| `palo_alto_panorama_account` | **HAS** | `palo_alto_address_group` |
| `palo_alto_panorama_account` | **HAS** | `palo_alto_security_rule` |

### Palo Alto Address Group

`palo_alto_address_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `deviceGroupName` | `string` | Device group the group belongs to ('shared' for shared groups) |  |
| `dynamicFilter` | `string` | Tag match filter expression for a dynamic group |  |
| `groupType` | `string` | Whether the group is static or dynamic |  |
| `members` | `array` of `string`s | Names of the static member address objects |  |
| `scope` | `string` | Scope the group is defined in ('shared' or a device group name) |  |

---

### Palo Alto Address Object

`palo_alto_address_object` inherits from [NetworkEndpoint](/data-model/schemas/NetworkEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `addressType` | `string` | Type of the address value (ip-netmask, ip-range, ip-wildcard, or fqdn) |  |
| `deviceGroupName` | `string` | Device group the object belongs to ('shared' for shared objects) |  |
| `scope` | `string` | Scope the object is defined in ('shared' or a device group name) |  |
| `value` | `string` | The address value (IP/netmask, range, wildcard, or FQDN) |  |

---

### Palo Alto Device Group

`palo_alto_device_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `parentDeviceGroup` | `string` **|** `null` | Name of the parent device group in the Panorama hierarchy, or null for top-level groups |  |

---

### Palo Alto Firewall

`palo_alto_firewall` inherits from [Device](/data-model/schemas/Device.md), [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appVersion` | `string` | Application content database version installed |  |
| `avVersion` | `string` | Antivirus content version installed |  |
| `family` | `string` | Hardware family of the firewall |  |
| `haPeerSerial` | `string` | Serial number of the HA peer firewall, if any |  |
| `haState` | `string` | High-availability state of the firewall (e.g. active) |  |
| `ipAddress` | `string` | Management IP address of the firewall |  |
| `isConnected` | `boolean` | Whether the firewall is currently connected to Panorama |  |
| `isMultiVsys` | `boolean` | Whether the firewall has multiple virtual systems |  |
| `macAddress` | `string` | MAC address of the firewall |  |
| `operationalMode` | `string` | Operational mode of the firewall (e.g. normal) |  |
| `swVersion` | `string` | PAN-OS software version of the firewall |  |
| `threatVersion` | `string` | Threat content version installed |  |
| `uptime` | `string` | System uptime reported by the firewall |  |
| `wildfireVersion` | `string` | WildFire content version installed |  |

---

### Palo Alto Panorama Account

`palo_alto_panorama_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `family` | `string` | Hardware family of the Panorama instance |  |
| `model` | `string` | Hardware (or VM) model of the Panorama instance |  |
| `serial` | `string` | Serial number of the Panorama instance |  |
| `uptime` | `string` | System uptime reported by the Panorama instance |  |
| `version` | `string` | PAN-OS software version running on the Panorama instance |  |

---

### Palo Alto Security Rule

`palo_alto_security_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `string` | Action taken on matching traffic (e.g. allow, deny, drop) |  |
| `application` | `array` of `string`s | Matched applications |  |
| `destination` | `array` of `string`s | Destination address objects/groups |  |
| `deviceGroupName` | `string` | Device group the rule belongs to |  |
| `from` | `array` of `string`s | Source zones |  |
| `groupTag` | `string` | Group tag assigned to the rule |  |
| `isDisabled` | `boolean` | Whether the rule is disabled |  |
| `isLogEnd` | `boolean` | Whether to log at session end |  |
| `isLogStart` | `boolean` | Whether to log at session start |  |
| `isNegateDestination` | `boolean` | Whether the destination match is negated |  |
| `isNegateSource` | `boolean` | Whether the source match is negated |  |
| `logSetting` | `string` | Name of the log forwarding profile applied |  |
| `rulebase` | `string` | Rulebase the rule belongs to (pre or post) |  |
| `ruleType` | `string` | Rule type (universal, intrazone, or interzone) |  |
| `schedule` | `string` | Name of the schedule the rule is bound to |  |
| `service` | `array` of `string`s | Matched services/ports |  |
| `source` | `array` of `string`s | Source address objects/groups |  |
| `sourceUser` | `array` of `string`s | Source users or user groups matched |  |
| `to` | `array` of `string`s | Destination zones |  |
| `urlCategories` | `array` of `string`s | URL categories matched by the rule |  |
| `uuid` | `string` | Panorama-assigned UUID of the rule |  |

---

---

Source: /integrations/directory/palo-alto-prisma-cloud

# Palo Alto Prisma Cloud

Visualize Palo Alto Prisma Cloud hosts, defender agents, container images, and vulnerabilities, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> Before configuring this integration in JupiterOne, you need to set up API access in Palo Alto Prisma Cloud Compute:
> 
> **Required in Prisma Cloud:**
> 
> -   Your Prisma Cloud Compute Console URL
> -   Your Prisma Cloud Compute version number
> -   A dedicated service account username and password with read-only permissions
> 
> **Authentication:** This integration uses HTTP Basic authentication to connect to the Prisma Cloud Compute API.
> 
> **Required Permissions:** The service account should have the **Auditor** role or any role with read access to:
> 
> -   Monitor data (hosts and defender agents)
> -   Vulnerabilities data (container images and host vulnerabilities)
> 
> **Supported Edition:** This integration currently supports **Prisma Cloud Compute Edition**. Please inform your customer success rep if you are interested in integrating with **Prisma Cloud Enterprise Edition**.
> 
> For more information about API access and roles, see the [Prisma Cloud Compute API documentation](https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/api/access-api).

This integration connects to Palo Alto Prisma Cloud **Compute Edition** to ingest hosts, defender agents, deployed images, and vulnerability data.

> **NOTE**
> 
> This integration currently supports **Prisma Cloud Compute Edition**. Please inform your customer success rep if you are interested in integrating with **Prisma Cloud Enterprise Edition**.

### Prerequisites in Palo Alto Prisma Cloud

Before configuring the integration in JupiterOne, you need to gather the following information:

#### 1\. Console URL

Your Prisma Cloud Compute Console URL can be found by:

1.  Log into your Prisma Cloud Console
2.  Navigate to **Compute** > **Manage** > **System** > **Downloads**
3.  The Console URL is displayed on this page

The URL format varies by deployment type:

-   **SaaS deployments**: `https://[region].cloud.twistlock.com/[tenant-id]`
-   **Self-hosted deployments**: Your self-hosted Console URL

#### 2\. Version

Find your Prisma Cloud Compute version:

1.  Log into your Prisma Cloud Compute console
2.  Click the **bell icon** in the top right of the page
3.  Your version is displayed (e.g., `34.02`)

#### 3\. Username and Password

Create a dedicated service account for JupiterOne with read-only permissions to access the Compute API.

**Required Permissions**: The account must be able to:

-   Read host information and vulnerabilities
-   Read defender agent data
-   Read container image information

A user with the **Auditor** role or any role with read access to Monitor and Vulnerabilities data will work for this integration.

### Configuration in JupiterOne

To install the Palo Alto Prisma Cloud integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Palo Alto Prisma Cloud. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Palo Alto Prisma Cloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Palo Alto Prisma Cloud Compute **Console URL**, **Version**, **Username**, and **Password**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Defender | `palo_alto_prisma_cloud_defender` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Deployed Image | `palo_alto_prisma_cloud_deployed_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Host | `palo_alto_prisma_cloud_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Host Vulnerability | `palo_alto_prisma_cloud_host_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Image Vulnerability | `palo_alto_prisma_cloud_image_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Service | `palo_alto_prisma_cloud_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `palo_alto_prisma_cloud_defender` | **PROTECTS** | `palo_alto_prisma_cloud_host` |
| `palo_alto_prisma_cloud_deployed_image` | **HAS** | `palo_alto_prisma_cloud_image_vulnerability` |
| `palo_alto_prisma_cloud_host` | **HAS** | `palo_alto_prisma_cloud_host_vulnerability` |
| `palo_alto_prisma_cloud_host` | **HAS** | `palo_alto_prisma_cloud_image_vulnerability` |
| `palo_alto_prisma_cloud_host` | **USES** | `palo_alto_prisma_cloud_deployed_image` |

### Palo Alto Prisma Cloud Defender

`palo_alto_prisma_cloud_defender` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` |  |  |
| 

`cluster` \*

 | `string` |  |  |
| 

`collections` \*

 | `array` of `string`s |  |  |
| 

`compatibleVersion` \*

 | `boolean` |  |  |
| 

`connected` \*

 | `boolean` |  |  |
| 

`isARM64` \*

 | `boolean` |  |  |
| 

`port` \*

 | `number` |  |  |
| 

`remoteLoggingSupported` \*

 | `boolean` |  |  |
| 

`remoteMgmtSupported` \*

 | `boolean` |  |  |
| 

`type` \*

 | `string` |  |  |
| 

`version` \*

 | `string` |  |  |
| 

`vpcObserver` \*

 | `boolean` |  |  |

---

### Palo Alto Prisma Cloud Deployed Image

`palo_alto_prisma_cloud_deployed_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`collections` \*

 | `array` of `string`s |  |  |
| 

`digest` \*

 | `string` |  |  |
| 

`distro` \*

 | `string` |  |  |
| 

`registry` \*

 | `string` |  |  |
| 

`repository` \*

 | `string` |  |  |
| 

`tag` \*

 | `string` |  |  |

---

### Palo Alto Prisma Cloud Host

`palo_alto_prisma_cloud_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`collections` \*

 | `array` **|** `null` |  |  |
| 

`distro` \*

 | `string` **|** `null` |  |  |
| 

`isARM64` \*

 | `boolean` **|** `null` |  |  |
| 

`osDistroRelease` \*

 | `string` **|** `null` |  |  |

---

### Palo Alto Prisma Cloud Host Vulnerability

`palo_alto_prisma_cloud_host_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cause` | `string` |  |  |
| `cvss` | `number` |  |  |
| `description` | `string` |  |  |
| `firstSeenOn` | `number` |  |  |
| `fixLink` | `string` |  |  |
| `fixOn` | `number` |  |  |
| `publishedOn` | `number` |  |  |
| 
`riskFactors` \*

 | `array` **|** `null` |  |  |
| `status` | `string` |  |  |
| `title` | `string` |  |  |
| `type` | `string` |  |  |
| `vecStr` | `string` |  |  |
| `webLink` | `string` |  |  |

---

### Palo Alto Prisma Cloud Image Vulnerability

`palo_alto_prisma_cloud_image_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cause` \*

 | `string` |  |  |
| 

`complianceId` \*

 | `string` |  |  |
| 

`cvss` \*

 | `number` |  |  |
| 

`description` \*

 | `string` |  |  |
| `discoveredOn` | `number` |  |  |
| `fixedOn` | `number` |  |  |
| 

`fixStatus` \*

 | `string` |  |  |
| 

`graceDays` \*

 | `string` |  |  |
| 

`packageLicense` \*

 | `string` |  |  |
| 

`packagePath` \*

 | `string` |  |  |
| 

`packages` \*

 | `string` |  |  |
| 

`packageVersion` \*

 | `string` |  |  |
| `publishedOn` | `number` |  |  |
| 

`purl` \*

 | `string` |  |  |
| 

`result` \*

 | `string` |  |  |
| 

`riskFactors` \*

 | `string` |  |  |
| 

`sourcePackage` \*

 | `string` |  |  |
| 

`type` \*

 | `string` |  |  |
| 

`vulnerabilityLink` \*

 | `string` |  |  |
| 

`vulnerabilityTags` \*

 | `string` |  |  |

---

### Palo Alto Prisma Cloud Service

`palo_alto_prisma_cloud_service` inherits from [Service](/data-model/schemas/Service.md)

---

## Release Notes

-   **2025-10-29** — Added risk factor properties to Palo Alto Prisma Cloud host vulnerability entities.
-   **2025-09-01** — Added CVE ID as the display name and entity name for Prisma Cloud host vulnerability and image vulnerability findings.
-   **2025-06-18** — Added deployed container image ingestion with image vulnerability relationships to Palo Alto Prisma Cloud.
-   **2025-06-16** — Added Palo Alto Prisma Cloud integration, ingesting host vulnerabilities, defenders, and accounts as new entity types.

---

Source: /integrations/directory/pillar

# Pillar Security

Visualize your Pillar Security AI-asset inventory and findings in the JupiterOne graph. Map the AI coding assistants, agents, tools, and MCP clients Pillar discovers across your developer endpoints and source-control repositories, relate them to the users and repositories that own them, and monitor Pillar's security findings — secret leaks, sensitive data in metaprompts, and prompt-injection risks — through custom queries and alerts.

## Installation

The Pillar integration ingests your Pillar Security AI-asset inventory and findings using the Pillar API (`https://api.pillar.security`). It reads the endpoint inventory (`/api/v1/inventory/endpoints`), the repository inventory (`/api/v1/inventory/repositories`), and security issues (`/api/v1/issues`) to build a graph of the AI coding assistants, agents, tools, and MCP clients discovered across your developer machines and source-control repositories, along with the users and repositories that own them. Before setting up the integration in JupiterOne, you will need to create an **API key** in the Pillar dashboard.

### Prerequisites

-   A **Pillar Security** account with at least one application configured in the Inventory.
-   Permission in the Pillar dashboard to create an API key for that application.
-   Access to JupiterOne with permission to configure integrations.

### Creating an API key in Pillar

1.  Log in to the [Pillar Security dashboard](https://app.pillar.security/).
2.  Navigate to **Inventory** and select the application you want JupiterOne to ingest.
3.  Open **Settings > API Keys**.
4.  Create a new API key and give it a recognizable name (for example, `JupiterOne Integration`).
5.  Copy the generated key — it is used as a bearer token and is shown only once.

> **NOTE**
> 
> The integration only reads from Pillar. The API key is used as a `Bearer` token against the inventory and issues endpoints — no write scopes are required. If your Pillar API key serves multiple applications (for example, gateway integrations such as LiteLLM, Kong, or ngrok), note the **Application ID** you want to scope ingestion to; you can supply it during configuration below. Most installs leave this unset.

### Configuration in JupiterOne

To install the Pillar integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Pillar. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Pillar account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Pillar **API Key** — the key created above. This field is required.
    
-   Optionally, an **API Base URL** to override the Pillar API endpoint. Leave blank to use the default `https://api.pillar.security`. Only override this for self-hosted Pillar Stack deployments.
    
-   Optionally, an **Application ID** — the `x-plr-app-id` value used to scope requests to a specific Pillar application when a single API key serves multiple applications. Most installs leave this unset.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Pillar Account | `pillar_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Pillar AI Agent | `pillar_agent` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Pillar Coding Assistant | `pillar_coding_assistant` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Pillar Endpoint | `pillar_endpoint` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Pillar Issue | `pillar_issue` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Pillar MCP Client | `pillar_mcp_client` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Pillar Platform Integration | `pillar_platform_integration` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Pillar Repository | `pillar_repository` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Pillar Tool | `pillar_tool` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Pillar User | `pillar_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `pillar_account` | **HAS** | `pillar_endpoint` |
| `pillar_account` | **HAS** | `pillar_repository` |
| `pillar_account` | **HAS** | `pillar_issue` |
| `pillar_endpoint` | **HAS** | `pillar_agent` |
| `pillar_issue` | **EXPLOITS** | `pillar_tool` |
| `pillar_repository` | **HAS** | `pillar_coding_assistant` |
| `pillar_repository` | **HAS** | `pillar_platform_integration` |
| `pillar_repository` | **HAS** | `pillar_tool` |
| `pillar_repository` | **HAS** | `pillar_mcp_client` |
| `pillar_user` | **HAS** | `pillar_agent` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `pillar_repository` | **SCANS** | `code_repo` | FORWARD |

### Pillar Account

`pillar_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiBaseUrl` | `string` | The Pillar API base URL the integration is configured against (e.g. `https://api.pillar.security`). Set when self-hosted Pillar Stack is in use. |  |
| `appId` | `string` | Optional `x-plr-app-id` value used to scope requests to a specific Pillar application. Echoed onto the account so consumers can see which Pillar tenant each ingestion run covered. |  |

---

### Pillar Agent

`pillar_agent` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentName` \*

 | `string` **|** `null` | Agent identifier (e.g. `claude-code`, `cursor`, `windsurf`). Sourced from `agents[].agentName`. |  |
| 

`agentType` \*

 | `string` **|** `null` | Agent form factor (`cli`, `ide`, etc.). Sourced from `agents[].agentType`. |  |
| 

`agentVersion` \*

 | `string` **|** `null` | Installed agent version, when reported. Sourced from `agents[].agentVersion`. |  |
| 

`mcpCount` \*

 | `number` **|** `null` | Number of MCP servers the agent has configured. Sourced from `agents[].mcpCount`. |  |
| 

`organization` \*

 | `string` **|** `null` | Organisation affiliation reported by the agent's logged-in user. Sourced from `agents[].organization`. |  |
| 

`permissionMode` \*

 | `string` **|** `null` | Permission mode in effect for the agent (`ask`, `auto`, `bypass`). Sourced from `agents[].permissionMode`. |  |
| 

`sandboxEnabled` \*

 | `boolean` **|** `null` | Whether the agent is configured to run in sandbox mode. Sourced from `agents[].sandboxEnabled`. |  |

---

### Pillar Coding Assistant

`pillar_coding_assistant` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `null` | Pillar-side classification of the assistant. Sourced from `codingAssistants[].category`. |  |
| 

`hasMcp` \*

 | `boolean` **|** `null` | Whether Pillar found MCP server configuration for this assistant in the repository. |  |
| 

`hasRuleFiles` \*

 | `boolean` **|** `null` | Whether Pillar found rule / configuration files for this assistant in the repository. |  |
| 

`tool` \*

 | `string` **|** `null` | Coding assistant tool name (e.g. `claude-code`, `cursor`, `copilot`). Sourced from `codingAssistants[].tool`. |  |

---

### Pillar Endpoint

`pillar_endpoint` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`criticalFindings` \*

 | `number` **|** `null` | Critical-severity findings from the latest scan. |  |
| 

`firstSeenOn` \*

 | `number` **|** `null` | Epoch ms of the first Pillar scan against this machine. Parsed from `firstSeen`. (Host base class supplies `lastSeenOn`.) |  |
| 

`highFindings` \*

 | `number` **|** `null` | High-severity findings from the latest scan. |  |
| 

`latestReportId` \*

 | `string` **|** `null` | Pillar UUID for the most recent endpoint scan — feed into `/inventory/scans/:id?source=endpoint` to fetch the full report. |  |
| 

`lowFindings` \*

 | `number` **|** `null` | Low-severity findings from the latest scan. |  |
| 

`mediumFindings` \*

 | `number` **|** `null` | Medium-severity findings from the latest scan. |  |
| 

`totalFindings` \*

 | `number` **|** `null` | Total finding count from the latest scan. |  |
| 

`totalReports` \*

 | `number` **|** `null` | All-time count of scan reports submitted from this machine. |  |
| 

`username` \*

 | `string` **|** `null` | OS username under which the latest Pillar scan ran. Sourced from Pillar `username`. |  |

---

### Pillar Issue

`pillar_issue` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetType` \*

 | `string` **|** `null` | Type of asset where the issue was found (`metaprompts`, `tools`). Sourced from `issues[].assetType`. |  |
| 

`currentStatus` \*

 | `string` **|** `null` | Issue status (`open`, `closed`). Sourced from `issues[].currentStatus`. |  |
| 

`evidenceCategory` \*

 | `string` **|** `null` | Category of evidence (`secret`, `pii`, `pci`, `access_capabilities`, `prompt_injection`, `evasion`). Sourced from `issues[].evidenceCategory`. |  |
| 

`evidencePath` \*

 | `string` **|** `null` | URL path to the location where the issue was found. Sourced from `issues[].evidence.path`. |  |
| 

`evidenceType` \*

 | `string` **|** `null` | Specific finding type (e.g. `github_token`, `credit_card`, `email_address`). Sourced from `issues[].evidence.finding.type`. |  |
| 

`issueDetailDescription` \*

 | `string` **|** `null` | Human-readable issue description. Sourced from `issues[].issueDetailDescription`. |  |
| 

`source` \*

 | `string` **|** `null` | Source of the discovery (e.g. `Discovery Scan`). Sourced from `issues[].source`. |  |

---

### Pillar Mcp Client

`pillar_mcp_client` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`framework` \*

 | `string` **|** `null` | Framework the MCP client was detected within. |  |
| 

`mcpName` \*

 | `string` **|** `null` | MCP client name. Sourced from `mcpClients[].name`. |  |
| 

`mcpType` \*

 | `string` **|** `null` | Pillar-side MCP type classification. |  |
| 

`transport` \*

 | `string` **|** `null` | MCP transport (e.g. `stdio`, `http`, `sse`). Sourced from `mcpClients[].transport`. |  |

---

### Pillar Platform Integration

`pillar_platform_integration` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`framework` \*

 | `string` **|** `null` | Framework Pillar attributed this integration to (e.g. `LangChain`, `OpenAI SDK`). |  |
| 

`isPureAIService` \*

 | `boolean` **|** `null` | Whether the platform is exclusively an AI service (true) or a general-purpose platform that happens to host AI (false). |  |
| 

`pillarService` \*

 | `string` **|** `null` | The Pillar-side service classification for this integration (e.g. `chat completions`, `embeddings`). Sourced from `platformIntegrations[].service`. |  |
| 

`platform` \*

 | `string` **|** `null` | Upstream AI platform (e.g. `OpenAI`, `Anthropic`, `AWS Bedrock`). Sourced from `platformIntegrations[].platform`. |  |

---

### Pillar Repository

`pillar_repository` inherits from [CodeRepo](/data-model/schemas/CodeRepo.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`codingAssistantsCount` \*

 | `number` **|** `null` | Number of distinct AI coding assistants detected in the repo (rule files, MCP configs). |  |
| 

`defaultBranch` \*

 | `string` **|** `null` | Default branch name as observed by Pillar at scan time. Sourced from Pillar `defaultBranch`. |  |
| 

`hasLlmUsage` \*

 | `boolean` **|** `null` | Whether Pillar detected LLM (generative AI) usage in the repository. |  |
| 

`hasMlUsage` \*

 | `boolean` **|** `null` | Whether Pillar detected ML (classical machine learning) usage in the repository. |  |
| 

`language` \*

 | `string` **|** `null` | Primary repository language detected by the SCM. Sourced from Pillar `language`. |  |
| 

`llmFrameworks` \*

 | `array` **|** `null` | LLM frameworks detected in the repository (e.g. `LangChain`, `LangGraph`, `OpenAI SDK`). Sourced from Pillar `llmFrameworks`. |  |
| 

`mcpClientsCount` \*

 | `number` **|** `null` | Number of MCP client configs detected in the repo. |  |
| 

`mlFrameworks` \*

 | `array` **|** `null` | ML frameworks detected in the repository (e.g. `TensorFlow`, `PyTorch`, `Scikit-learn`). Sourced from Pillar `mlFrameworks`. |  |
| 

`platformIntegrationsCount` \*

 | `number` **|** `null` | Number of AI platform integrations detected in the repo. |  |
| 

`scanId` \*

 | `string` **|** `null` | Pillar scan UUID for the most recent scan of this repo. |  |
| 

`scannedOn` \*

 | `number` **|** `null` | Epoch ms of the most recent Pillar scan. Parsed from Pillar `scanDate`. |  |
| 

`scanStatus` \*

 | `string` **|** `null` | Status of the most recent Pillar scan. |  |
| 

`scm` \*

 | `string` **|** `null` | Source-control platform that hosts the repo (`github`, `gitlab`, `azure_devops`). Sourced from Pillar `scm`. |  |
| 

`toolsCount` \*

 | `number` **|** `null` | Number of AI tool definitions detected in the repo. |  |

---

### Pillar Tool

`pillar_tool` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`fileLine` \*

 | `number` **|** `null` | Line number where the tool is defined. Sourced from `tools[].line`. |  |
| 

`filePath` \*

 | `string` **|** `null` | Repo-relative file path where the tool is defined (e.g. `src/app.py`). Sourced from `tools[].path`; null for scans predating tool-location capture. |  |
| 

`framework` \*

 | `string` **|** `null` | Framework the tool is defined in (e.g. `LangChain`, `LangGraph`). Sourced from `tools[].framework`. |  |
| 

`isPoisoned` \*

 | `boolean` **|** `null` | Whether Pillar has flagged the tool as poisoned (contains prompt-injection or other attacker-controlled content). Sourced from `tools[].postureSummary.isPoisoned`. |  |
| 

`postureCategory` \*

 | `string` **|** `null` | Pillar's posture category for the tool (e.g. `read_only`, `code_execution`). Sourced from `tools[].postureSummary.category`. |  |
| 

`postureFindingsCount` \*

 | `number` **|** `null` | Number of posture findings against the tool. Sourced from `tools[].postureSummary.findingsCount`. |  |
| 

`toolName` \*

 | `string` **|** `null` | Tool name. Sourced from `tools[].name`. |  |
| 

`toolType` \*

 | `string` **|** `null` | Pillar-side tool classification. Sourced from `tools[].type`. |  |

---

### Pillar User

`pillar_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`organization` \*

 | `string` **|** `null` | Organisation affiliation reported by Pillar for this user, when present. Sourced from the agent install's `organization` field. |  |

---

## Release Notes

-   **2026-07-13** — New Pillar Security integration: ingests the account, developer endpoints and their installed AI coding assistants, source-control repositories with their discovered AI assets (coding assistants, platform integrations, tools, and MCP clients), and security issues, and projects a SCANS relationship from Pillar repositories to native code repositories.

---

Source: /integrations/directory/pingidentity

# PingIdentity

Visualize Ping Identity users, groups, applications, and roles, map Ping Identity users to employees, and monitor changes through queries and alerts.

## Installation

To install this integration, you will need to configure settings both within PingOne and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your PingOne environment.

### Configuration in PingOne

**Create a PingOne worker application:**

1.  Sign in to the PingOne admin console.
2.  Navigate to **Connections** and click **\+ Add Application**.
3.  Select the **Worker** application type and click **Configure**.
4.  Enter the application profile details:
    -   **Application name**: a unique name for this worker app (for example, `JupiterOne Integration`).
    -   **Description** _(optional)_: a brief description.
5.  Click **Save** and close.
6.  On the Applications page, enable the new application by clicking the **Enable** toggle. The toggle turns green when the application is active.

**Grant roles to the worker application:**

JupiterOne reads environment settings, applications, users, and groups from PingOne. Assign the following roles to the worker application in the **Roles** tab:

-   **Identity Data Admin** — required to read users and groups.
-   **Environment Admin** — required to read environments, applications, and role assignments.

> **NOTE**
> 
> Assign only the minimum roles required. For more information on PingOne role assignments, see [Administrator permissions and role assignments](https://developer.pingidentity.com/pingone-api/foundations/pingone-roles-scopes-and-permissions/administrator-permissions-and-role-assignments.html).

#### Get the application access token

1.  Navigate to the application's **Configuration** tab.
2.  Expand the **General** section.
3.  Scroll to the **Advanced** section and click **Get Access Token**.
4.  Copy the access token for use in JupiterOne.

> **INFO**
> 
> For more information on creating worker app connections and retrieving access tokens, see [Create an admin Worker app](https://developer.pingidentity.com/pingone-api/getting-started/create-an-admin-worker-app.html).

#### Acquire your Environment ID

Navigate to **Environment** > **Properties** and copy the **Environment ID**.

### Configuration in JupiterOne

To install the PingIdentity integration in JupiterOne, navigate to the **Integrations** tab and select **PingIdentity**. Click **New Instance** to begin.

Creating an instance requires the following:

-   **Account Name**: a label for this PingIdentity account in JupiterOne. Ingested entities include this value in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** _(optional)_: a note to help identify this integration instance.
    
-   **Polling Interval**: how often JupiterOne should collect data. Set to `DISABLED` to run manually.
    
-   **PingOne Environment ID**: your PingOne environment ID, found under **Environment** > **Properties**.
    
-   **PingOne Location**: the region where your PingOne environment is hosted (for example, `eu` for Europe, `com` for North America). This is used to construct the API base URL (`https://api.pingone.{location}/v1/`).
    
-   **PingOne Access Token**: the access token from the worker application created above (found under **Connections** > **Applications** > your worker app > **Configuration** > **Advanced**).
    

Click **Create** to finalize the integration.

### Next steps

Once configured, the integration runs on the polling interval you set and populates data in JupiterOne. See the [Instance management guide](/integrations/instance-management.md) for information on managing and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `pingone_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `pingone_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Ping Identity User | `pingone_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Role | `pingone_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| UserGroup | `pingone_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `pingone_account` | **HAS** | `pingone_user` |
| `pingone_account` | **HAS** | `pingone_group` |
| `pingone_account` | **HAS** | `pingone_role` |
| `pingone_account` | **HAS** | `pingone_application` |
| `pingone_application` | **ASSIGNED** | `pingone_role` |
| `pingone_group` | **HAS** | `pingone_user` |
| `pingone_group` | **HAS** | `pingone_group` |
| `pingone_user` | **ASSIGNED** | `pingone_role` |

### Pingone User

`pingone_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountCanAuthenticate` | `boolean` |  |  |
| `accountStatus` | `string` |  |  |
| `active` | `boolean` |  |  |
| `createdAt` | `string` |  |  |
| `enabled` | `boolean` |  |  |
| `environmentId` | `string` |  |  |
| `identityProviderType` | `string` |  |  |
| `isActive` | `boolean` |  |  |
| `lastSignOnAt` | `string` |  |  |
| `lastSignOnRemoteIp` | `string` |  |  |
| `lifecycleStatus` | `string` |  |  |
| `mfaEnabled` | `boolean` |  |  |
| `nameFamily` | `string` |  |  |
| `nameGiven` | `string` |  |  |
| `populationId` | `string` |  |  |
| `updatedAt` | `string` |  |  |
| `verifyStatus` | `string` |  |  |
| `webLink` | `string` |  |  |

---

---

Source: /integrations/directory/polymer

# Polymer

## Installation

> **INFO**
> 
> You will need your Polymer API token and organization name to set up this integration.

### Configuration in Polymer

1.  Log in to your Polymer instance.
2.  Navigate to the settings or API section.
3.  Create a new API token with appropriate permissions to read the resources you want to ingest into JupiterOne.
4.  Note your organization name from your Polymer URL (the subdomain before `.polymerhq.io`).

### Configuration in JupiterOne

To install the Polymer integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Polymer. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Polymer account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Polymer **API Token** used to authenticate requests.
    
-   Your Polymer **Organization** name extracted from your Polymer URL.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `polymer_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Rule | `polymer_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Violation | `polymer_violation` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `polymer_account` | **HAS** | `polymer_rule` |
| `polymer_rule` | **IDENTIFIED** | `polymer_violation` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `polymer_violation` | **HAS** | `github_user` | REVERSE |
| `polymer_violation` | **HAS** | `google_user` | REVERSE |
| `polymer_violation` | **HAS** | `slack_user` | REVERSE |
| `polymer_violation` | **HAS** | `slack_channel` | REVERSE |

---

Source: /integrations/directory/probely

# Probely

Visualize Probely targets, users, and findings, and monitor changes through queries and alerts.

## Installation

To install this integration, you will need to first create an API access token within Probely to use in JupiterOne.

### Configuration in Probely

**To create an API token:**

1.  From the Probely dashboard, go to **Overview > Target**.
2.  Navigate to the **Settings > Integrations** tab.
3.  Under **API Keys**, generate a new key for JupiterOne.

> **INFO**
> 
> For more information on creating Access Tokens on Probely, see [their documentation](https://developers.probely.com/#tag/Quickstart)

### Configuration in JupiterOne

To install the Probely integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Probely. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Probely account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The Probely **Access Token** generated for use within JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `probely_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Finding | `probely_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Target | `probely_target` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| User | `probely_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `probely_account` | **HAS** | `probely_user` |
| `probely_account` | **HAS** | `probely_target` |
| `probely_target` | **HAS** | `probely_finding` |
| `probely_user` | **ASSIGNED** | `probely_finding` |

### Probely User

`probely_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `isApiUser` | `boolean` |  |  |
| `isBillingAdmin` | `boolean` |  |  |
| `modifiedOn` | `number` |  |  |

---

---

Source: /integrations/directory/pulseway

# Pulseway

Visualize Pulseway Account, Group, Host, HostAgent, Policy changes through queries and alerts.

# Installation Guide

## Overview

Pulseway can be deployed either on-premise or in the cloud. If hosting your own server, you need to provide the Pulseway host name.

## Prerequisites

Ensure the following items are available before configuring the integration:

-   **Pulseway API Token**
-   **Pulseway API Secret**
-   **Pulseway Host Name**

## Configuring Pulseway

### Generating a Pulseway API Token and Secret

#### Authentication Method: BASIC Authentication

To authorize Pulseway APIs, this integration requires the API Token and Secret.

#### Steps to Generate an API Token and Secret

1.  **Log in** to the Pulseway web application.
2.  Navigate to **Configuration** in side pane under the **Administration**.
3.  Click on **API Access**.
4.  Under the **Third-Party Access** tab, click **Create Token**.
5.  Provide the following details:
    -   **Name:** Assign a name to the token.
    -   **Description:** Add a description for reference.
    -   **Expiration:** Set the token's expiry date.
    -   **Access:** Enable access to all organizations.
6.  Click **Edit Permissions** and select the following permissions:
    -   **Device:** Get All Devices, Get Device Applied Policies.
    -   **Asset:** Get All Devices and Asset Information.
    -   **Group:** Get All Groups.
    -   **Environment Information:** Get Environment Information.
7.  Confirm the selected permissions.
8.  Click **Create**.
9.  **Copy the Token ID and Token Secret** and save them securely.
10.  Confirm by selecting **I confirm that I saved my Token Secret code**.
11.  Close the Window.

### Get Pulseway Host Name

**Admin > Server Admin > Overview > Server Information > Name**

## Configuring in JupiterOne

1.  In the **J1 Search** homepage, navigate to the **Integrations** section from the top navigation bar.
    
2.  Search for **Pulseway** and select it.
    
3.  Click the **Add Instance** button and configure the following:
    
    -   **Pulseway API Token:** Enter the API Token generated in Pulseway.
    -   **Pulseway API Secret:** Enter the API Secret generated in Pulseway.
    -   **Pulseway Host:** Enter the host name of your Pulseway server. # e.g., test.pulseway.com
    -   **Account Name:** Assign a name to identify this Pulseway instance in JupiterOne. If the **Tag with Account Name** option is enabled, ingested entities will include this value in `tag.AccountName`.
    -   **Description:** Add a description to assist your team in identifying this integration instance.
    -   **Polling Interval (optional):** Select a polling interval appropriate for your monitoring needs. Leave this as `DISABLED` for manual execution if unsure.
4.  Click **Create Configuration** to save the settings.
    

## Next Steps

Your integration instance will now run based on the configured polling interval, populating data within JupiterOne. Refer to our [Instance Management Guide](/integrations/instance-management.md) to learn more about managing and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `pulseway_environment` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Group | `pulseway_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Host | `pulseway_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| HostAgent | `pulseway_hostagent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Policy | `pulseway_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `pulseway_environment` | **HAS** | `pulseway_group` |
| `pulseway_group` | **CONTAINS** | `pulseway_hostagent` |
| `pulseway_hostagent` | **SCANS** | `pulseway_host` |
| `pulseway_policy` | **ASSIGNED** | `pulseway_hostagent` |

### Pulseway Environment

`pulseway_environment` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `expiresOn` | `number` |  |  |
| `productVersion` | `string` |  |  |
| `serverType` | `string` |  |  |

---

### Pulseway Group

`pulseway_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `hasCustomFields` | `boolean` |  |  |
| `parentOrganizationId` | `number` |  |  |
| `parentOrganizationName` | `string` |  |  |
| `parentSiteId` | `number` |  |  |
| `parentSiteName` | `string` |  |  |
| `psaMappingId` | `number` |  |  |
| `psaMappingType` | `string` |  |  |

---

### Pulseway Host

`pulseway_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `antivirusEnabled` | `string` |  |  |
| `antivirusUpToDate` | `string` |  |  |
| `clientVersion` | `string` |  |  |
| `criticalUpdates` | `number` |  |  |
| `groupName` | `string` |  |  |
| `importantUpdates` | `number` |  |  |
| `isFirewallEnabled` | `boolean` |  |  |
| `memoryTotal` | `string` |  |  |
| `organizationId` | `number` |  |  |
| `siteId` | `number` |  |  |
| `uacEnabled` | `boolean` | A Windows security feature that prevents unauthorized changes to the operating system |  |
| `unspecifiedUpdates` | `number` |  |  |

---

### Pulseway Hostagent

`pulseway_hostagent` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `groupId` | `number` |  |  |
| `groupName` | `string` |  |  |
| `hasCustomFields` | `boolean` |  |  |
| `isAgentInstalled` | `boolean` |  |  |
| `isMdmEnrolled` | `boolean` |  |  |
| `organizationId` | `number` |  |  |
| `organizationName` | `string` |  |  |
| `siteId` | `number` |  |  |
| `siteName` | `string` |  |  |

---

### Pulseway Policy

`pulseway_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `policyType` | `string` |  |  |

---

## Release Notes

-   **2025-08-22** — Improved serial number accuracy for Pulseway hosts by using an alternate BIOS field as a fallback source.
-   **2025-08-19** — Improved serial number accuracy on Pulseway host entities by reading the BIOS serial number field.

---

Source: /integrations/directory/puppet

# Puppet

Visualize Visualize Puppet infrastructure, including servers, nodes, catalog, environment, factsets, and resources, and monitor changes through queries and alerts.

# Installation Guide

> **INFO**
> 
> Puppet consists of the **Puppet Server**, which manages configurations, **Puppet Agents**, which apply them on nodes, and **PuppetDB**, which stores configuration, state, and report data. This integration connects to PuppetDB and reads node, environment, fact, resource, and catalog data from it. The integration requires client certificates signed by Puppet's Certificate Authority (CA) for mutual TLS authentication.

## Requirements

-   Network connectivity between the JupiterOne integration and **PuppetDB**.
-   PuppetDB installed and configured: [Install PuppetDB](https://help.puppet.com/pdb/current/topics/install_from_packages.htm)
-   PuppetDB connected to the Puppet Server: [Connect PuppetDB and Puppet Server](https://help.puppet.com/pdb/current/topics/connect_puppet_server.htm)
-   `client-auth` set to `need` (or `want`) in PuppetDB's `jetty.ini` so that TLS client certificates are required.

## Configuration in Puppet

### Generate a Client Certificate

1.  Connect to the Puppet Server using SSH.
    
2.  Run the following command to generate a certificate and key pair:
    
    ```bash
    puppetserver ca generate --certname <Certificate-Name>
    # For example: j1-integration-cert
    ```
    
3.  Verify that the certificate was generated and signed by the CA:
    
    ```bash
    puppetserver ca list --all
    ```
    
4.  Collect the following files — you will upload them when configuring the integration in JupiterOne:
    
    -   **Certificate Authority Certificate:** `/etc/puppetlabs/puppet/ssl/certs/ca.pem`
    -   **Client Certificate:** `/etc/puppetlabs/puppet/ssl/certs/<Certificate-Name>.pem`
    -   **Client Certificate Private Key:** `/etc/puppetlabs/puppet/ssl/private_keys/<Certificate-Name>.pem`

## Configuration in JupiterOne

1.  From the top navigation bar of the **J1 Search** homepage, go to **Integrations**.
    
2.  Search for **Puppet** and select it.
    
3.  Click **Add Instance** and configure the following settings:
    
    -   **PuppetDB URL:** The IP or hostname where PuppetDB is reachable (for example, `https://127.0.0.1`).
    -   **PuppetDB Port:** The port PuppetDB listens on for SSL connections (default: `8081`).
    -   **Certificate Authority Certificate:** The CA certificate file (`ca.pem`).
    -   **Client Certificate:** The client certificate file (for example, `j1-integration-cert.pem`).
    -   **Client Certificate Private Key:** The private key file for the client certificate.
    -   **Account Name:** A name to identify this Puppet instance in JupiterOne. When **Tag with Account Name** is enabled, ingested entities store this value in `tag.AccountName`.
    -   **Description:** An optional description to help identify this integration instance.
    -   **Polling Interval:** How frequently data is refreshed. Leave as `DISABLED` to trigger runs manually.
4.  Click **Create Configuration** to save.
    

## Data Volume Configuration

### Advanced Configuration

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Resource Types Filter** | Limits ingestion to specific Puppet resource types. When no types are selected, all resource types are ingested, including custom module-defined types not listed here (for example, `Firewall` or `Apache::Vhost`). | _(all types)_ | Package, Service, User, Group, File, Cron, Exec, Ssh\_authorized\_key, Mount, Host, Yumrepo, Scheduled\_task, Selboolean, Selmodule, Augeas |

## Troubleshooting

### BAD Certificate Error

This error occurs when the provided CA certificate is malformed or does not match the certificate chain. To regenerate certificates on the Puppet Server:

```bash
# Back up existing certificate files
cp -r /etc/puppetlabs/puppet/ssl /etc/puppetlabs/puppet/ssl_back

# Remove the existing certificates
rm -rf /etc/puppetlabs/puppet/ssl

# Regenerate the CA certificate
puppetserver ca setup

# Restart the Puppet Server
systemctl restart puppetserver
```

### No Alternative Certificate Subject Name Matches Target Hostname

This error occurs when the certificate's common name does not match the hostname in the PuppetDB URL.

1.  Open the Puppet configuration file:
    
    ```bash
    nano /etc/puppetlabs/puppet/puppet.conf
    ```
    
2.  Under the `[main]` section, set `certname` to match the hostname used in the PuppetDB URL:
    
    ```ini
    [main]
    certname = <hostname>
    ```
    
3.  Restart the Puppet Server:
    
    ```bash
    systemctl restart puppetserver
    ```
    

## Next Steps

Once the integration instance is configured, it will run on the polling interval you set and populate Puppet data in JupiterOne. Continue to the [Instance Management Guide](/integrations/instance-management.md) to learn more about working with integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (6)

-   `GET /pdb/query/v4/catalogs`
-   `GET /pdb/query/v4/environments`
-   `GET /pdb/query/v4/factsets`
-   `GET /pdb/query/v4/inventory`
-   `GET /pdb/query/v4/producers`
-   `GET /pdb/query/v4/resources`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (7)

-   [https://puppet.com/docs/puppetdb/latest/api/query/v4/catalogs.html](https://puppet.com/docs/puppetdb/latest/api/query/v4/catalogs.html)
-   [https://puppet.com/docs/puppetdb/latest/api/query/v4/environments.html](https://puppet.com/docs/puppetdb/latest/api/query/v4/environments.html)
-   [https://puppet.com/docs/puppetdb/latest/api/query/v4/factsets.html](https://puppet.com/docs/puppetdb/latest/api/query/v4/factsets.html)
-   [https://puppet.com/docs/puppetdb/latest/api/query/v4/inventory.html](https://puppet.com/docs/puppetdb/latest/api/query/v4/inventory.html)
-   [https://puppet.com/docs/puppetdb/latest/api/query/v4/producers.html](https://puppet.com/docs/puppetdb/latest/api/query/v4/producers.html)
-   [https://puppet.com/docs/puppetdb/latest/api/query/v4/resources.html](https://puppet.com/docs/puppetdb/latest/api/query/v4/resources.html)
-   [https://puppet.com/docs/puppetdb/latest/configure.html](https://puppet.com/docs/puppetdb/latest/configure.html)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | Endpoints |
| --- | --- |
| Fetch Puppet Catalogs | `GET /pdb/query/v4/catalogs` |
| Fetch Puppet Factsets | `GET /pdb/query/v4/factsets` |
| Fetch Puppet Nodes | `GET /pdb/query/v4/inventory` |
| Fetch Puppet Resources | `GET /pdb/query/v4/resources` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Catalog | `puppet_catalog` | [DataObject](https://docs.jupiterone.io/data-model/schemas/DataObject) |
| Environment | `puppet_environment` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| FactSet | `puppet_factset` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Node | `puppet_node` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Resource | `puppet_resource` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Server | `puppet_server` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `puppet_catalog` | **CONTAINS** | `puppet_resource` |
| `puppet_environment` | **HAS** | `puppet_node` |
| `puppet_node` | **USES** | `puppet_factset` |
| `puppet_node` | **HAS** | `puppet_resource` |
| `puppet_server` | **MANAGES** | `puppet_node` |
| `puppet_server` | **GENERATED** | `puppet_catalog` |

### Puppet Catalog

`puppet_catalog` inherits from [DataObject](/data-model/schemas/DataObject.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`codeId` \*

 | `string` **|** `null` |  |  |
| 

`environment` \*

 | `string` |  |  |
| `hash` | `string` |  |  |
| 

`node` \*

 | `string` |  |  |
| `replacedCatalogOn` | `number` | A string representing the time at which the replace\_catalog command for a given catalog was submitted from the Puppet Server. Origin property is producer\_timestamp. |  |
| `transactionUuid` | `string` |  |  |
| 

`version` \*

 | `string` |  |  |

---

### Puppet Environment

`puppet_environment` inherits from [Group](/data-model/schemas/Group.md)

---

### Puppet Factset

`puppet_factset` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`nodeEnvironment` \*

 | `string` |  |  |
| 

`puppetServer` \*

 | `string` |  |  |
| `submittedOn` | `number` | A string representing the timestamp at which the data was submitted to PuppetDB from Puppet Server. |  |

---

### Puppet Node

`puppet_node` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `submittedOn` | `number` | A string representing the timestamp at which the data was submitted to PuppetDB from Puppet Server. |  |

---

### Puppet Resource

`puppet_resource` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`certname` \*

 | `string` | The certname of the puppet\_node this resource belongs to. |  |
| 

`environment` \*

 | `string` |  |  |
| 

`exported` \*

 | `boolean` |  |  |
| `filePath` | `string` |  |  |
| `lines` | `number` |  |  |
| 

`resource` \*

 | `string` | The PuppetDB-assigned resource hash that uniquely identifies this resource within its catalog. |  |
| 

`title` \*

 | `string` |  |  |
| 

`type` \*

 | `string` |  |  |

---

### Puppet Server

`puppet_server` inherits from [Control](/data-model/schemas/Control.md)

---

---

Source: /integrations/directory/push-security

# Push Security

Visualize Push Security applications, employees, and findings, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need your Push Security API Key to set up this integration. You can create an API key by going to the Settings page in the Push Security admin console.

### Configuration in Push Security

1.  Log in to your Push Security admin console.
2.  Navigate to the **Settings** page.
3.  Create a new API key for JupiterOne integration.
4.  Copy the API key for use in JupiterOne configuration.

### Configuration in JupiterOne

To install the Push Security integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Push Security. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Push Security account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Push Security **API Key** created in the Settings page.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Push Security Account | `pushsecurity_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Push Security Application | `pushsecurity_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Push Security Employee | `pushsecurity_employee` | [Person](https://docs.jupiterone.io/data-model/schemas/Person) |
| Push Security Finding | `pushsecurity_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `pushsecurity_account` | **IDENTIFIED** | `pushsecurity_application` |
| `pushsecurity_application` | **HAS** | `pushsecurity_finding` |
| `pushsecurity_employee` | **HAS** | `pushsecurity_account` |
| `pushsecurity_employee` | **HAS** | `pushsecurity_finding` |
| `pushsecurity_employee` | **OWNS** | `pushsecurity_application` |

---

Source: /integrations/directory/qualys

# Qualys

Visualize Qualys scanners and findings, monitor findings and changes through queries and alerts.

## Installation

This integration connects to the Qualys API using a username and password. The Qualys user must have the **Manager** role, or a custom role with equivalent read access to the modules you want to ingest. The built-in **Reader** role is not sufficient — it does not grant access to host detection data. See the [Qualys VM and PA API documentation](https://docs.qualys.com/en/vm/qweb-all-api/get_started/get_started.htm) for details.

> **NOTE**
> 
> If you use Container Security ingestion, the Qualys user must also have the Container Security module enabled and the **CS API Access** permission assigned in your Qualys account.

## Configuration in JupiterOne

To add the Qualys integration, navigate to **Integrations** in JupiterOne and select **Qualys**. Click **New Instance** to begin.

Creating an instance requires the following:

-   **Qualys Username** — the username of the Qualys account used for API access. Must belong to a non-test account user.
-   **Qualys Password** — the password for the Qualys user account.
-   **API URL** — your Qualys platform API URL (for example, `https://qualysapi.qg3.apps.qualys.com`). See [Identify your Qualys platform](https://www.qualys.com/platform-identification/) to find the correct URL for your account.

Click **Create** to finalize the instance.

## Data Volume Configuration

Control how much data is ingested from Qualys.

### Ingestion Windows

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Host scan age Filter** | Process only scans completed within this many days. | 7 | Any number |
| **Findings age Filter** | Process only findings identified or updated within this many days. | 7 | Any number |
| **Images Ingestion Window** | Process only container images updated within this many days. | 90 | 90, 180, 275, 365 |
| **Fixed Host Findings Age Filter (Days)** | When **Fixed** status is selected below, only fixed host findings within this age window are ingested. Has no effect unless **Fixed** is selected under **Host Finding Statuses**. | — | 30, 90, 180, 365 |
| **Software Installed Since (Days)** | Limit installed software ingestion to items installed within this many days. | — | 30, 90, 180, 365 |

### Host Detection Filtering Options

| Field | Description | Default |
| --- | --- | --- |
| **Host Finding Severities** | Limit host findings to these severity levels (1–5, comma-separated). | 3, 4, 5 |
| **Host Finding Types** | Limit host findings to these detection types. Valid values: `Info`, `Potential`, `Confirmed`. | Potential, Confirmed |
| **Host Finding Statuses** | Limit host findings to these statuses. Options: **New**, **Active**, **Re-Opened**, **Fixed**. | New, Active, Re-Opened |
| **Include Detection Results** | When enabled, includes the first 300 bytes of raw detection result data for each host finding (such as file paths). This significantly increases run time. | Disabled |
| **Include Only Asset Tags** | Restrict host detection ingestion to hosts that match these tag names or IDs (comma-separated). Leave empty to ingest all hosts. | — |

### Web Application Scan Options

| Field | Description | Default |
| --- | --- | --- |
| **Web Application IDs** | Only ingest web applications and findings for these application IDs (comma-separated). Leave empty to ingest all scanned web applications. | — |

### Container Image Options

| Field | Description | Default |
| --- | --- | --- |
| **Container images Finding Severities** | Limit container image vulnerability findings to these severity levels (1–5, comma-separated). | 3, 4, 5 |
| **Skip Unassociated Container Images** | When enabled, skips container images that are not associated with any running or stopped container. | Disabled |

### Compliance Options

| Field | Description | Default |
| --- | --- | --- |
| **Policy IDs** | Only ingest compliance findings for these policy IDs (comma-separated). Leave empty to ingest all policies. | — |
| **Compliance Finding Statuses** | Limit compliance finding ingestion to these statuses. Options: **Passed**, **Failed**, **Error**, **Exception**. Leave empty to ingest all statuses. | — |
| **Include Evidence** | When enabled, includes evidence data in compliance findings. This significantly increases run time. | Disabled |
| **Include Cause of Failure** | When enabled, includes detailed cause-of-failure information in compliance findings. This significantly increases run time. | Disabled |

### Installed Software Options

| Field | Description | Default |
| --- | --- | --- |
| **Software Types** | Limit installed software ingestion to these types. Options: **Application**, **Unknown**, **Others**. | Application |
| **Authorization Status** | Filter installed software by authorization status. Options: **Authorized**, **Not Reviewed**, **Blacklisted**. Leave empty to include all. | — |

## Troubleshooting

If the integration fails with authorization errors, confirm that the Qualys user has the **Manager** role (or an equivalent custom role with API access). Note that a successful HTTP 200 response does not always mean access was granted — some Qualys endpoints return 200 with an `UNAUTHORIZED` body when the user lacks the required module permission. Check the integration job logs for `UNAUTHORIZED` error messages to identify which endpoint is failing.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (2)

-   `CS.CONTAINER.VIEW`
-   `CS.IMAGE.VIEW`

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `Manager`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (18)

-   `GET {qualysApiUrl}/api/2.0/fo/asset/host/`
-   `GET {qualysApiUrl}/api/2.0/fo/asset/host/vm/detection/`
-   `GET {qualysApiUrl}/api/2.0/fo/knowledge_base/vuln/`
-   `GET {qualysApiUrl}/api/3.0/fo/knowledge_base/qvs/`
-   `GET {qualysApiUrl}/api/4.0/fo/compliance/control/`
-   `GET {qualysApiUrl}/api/4.0/fo/compliance/policy/`
-   `GET {qualysApiUrl}/api/5.0/fo/asset/host/`
-   `GET {qualysApiUrl}/csapi/v1.3/containers`
-   `GET {qualysApiUrl}/csapi/v1.3/images`
-   `GET {qualysApiUrl}/csapi/v1.3/images/{imageSha}/vuln`
-   `GET {qualysApiUrl}/qps/rest/portal/version`
-   `POST {qualysApiUrl}/api/2.0/fo/compliance/posture/info/`
-   `POST {qualysApiUrl}/csapi/v1.3/containers/list`
-   `POST {qualysApiUrl}/csapi/v1.3/images/list`
-   `POST {qualysApiUrl}/qps/rest/2.0/search/am/hostasset`
-   `POST {qualysApiUrl}/qps/rest/3.0/search/was/finding/`
-   `POST {qualysApiUrl}/qps/rest/3.0/search/was/webapp`
-   `POST {qualysApiUrl}/rest/2.0/search/am/asset`

### Licenses

Product licenses or SKUs required in the target environment.

Show Licenses (4)

-   `Qualys Container Security`
-   `Qualys Policy Compliance`
-   `Qualys VM`
-   `Qualys WAS`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (3)

-   [https://docs.qualys.com/en/cs/api/get\_started/get\_started.htm](https://docs.qualys.com/en/cs/api/get_started/get_started.htm)
-   [https://docs.qualys.com/en/vm/qweb-all-api/get\_started/get\_started.htm](https://docs.qualys.com/en/vm/qweb-all-api/get_started/get_started.htm)
-   [https://docs.qualys.com/en/was/api/get\_started/get\_started.htm](https://docs.qualys.com/en/was/api/get_started/get_started.htm)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (10)

| Step | Permissions | Roles | Endpoints | Licenses |
| --- | --- | --- | --- | --- |
| Fetch Compliance Policies | \- | `Manager` | `GET {qualysApiUrl}/api/4.0/fo/compliance/policy/` | `Qualys Policy Compliance` |
| Fetch Compliance Posture Information | \- | `Manager` | `POST {qualysApiUrl}/api/2.0/fo/compliance/posture/info/` | `Qualys Policy Compliance` |
| Fetch Containers | `CS.CONTAINER.VIEW` | \- | `GET {qualysApiUrl}/csapi/v1.3/containers`, `POST {qualysApiUrl}/csapi/v1.3/containers/list` | `Qualys Container Security` |
| Fetch Image Findings | `CS.IMAGE.VIEW` | \- | `GET {qualysApiUrl}/csapi/v1.3/images/{imageSha}/vuln` | `Qualys Container Security` |
| Fetch Installed Software | \- | `Manager` | `POST {qualysApiUrl}/rest/2.0/search/am/asset` | `Qualys VM` |
| Fetch Issues | \- | `Manager` | `GET {qualysApiUrl}/api/2.0/fo/asset/host/vm/detection/` | `Qualys VM` |
| Fetch Repositories | `CS.IMAGE.VIEW` | \- | \- | `Qualys Container Security` |
| Fetch Scanned Host Details | \- | `Manager` | `GET {qualysApiUrl}/api/2.0/fo/asset/host/`, `POST {qualysApiUrl}/qps/rest/2.0/search/am/hostasset` | `Qualys VM` |
| Fetch Scanned Host Findings | \- | `Manager` | `GET {qualysApiUrl}/api/2.0/fo/asset/host/vm/detection/`, `GET {qualysApiUrl}/api/2.0/fo/knowledge_base/vuln/`, `GET {qualysApiUrl}/api/3.0/fo/knowledge_base/qvs/` | `Qualys VM` |
| Fetch Scanned Web App Findings | \- | `Manager` | `POST {qualysApiUrl}/qps/rest/3.0/search/was/finding/` | `Qualys WAS` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `qualys_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Compliance Control | `qualys_compliance_control` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Compliance Finding | `qualys_compliance_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Compliance Policy | `qualys_compliance_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Compliance Technology | `qualys_compliance_technology` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Container | `qualys_container` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| CSAM Tag | `qualys_tag` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Host | `qualys_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Host Detection | `qualys_host_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Host Detection | `qualys_host_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Image | `qualys_container_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Image Finding | `qualys_image_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Installed Software | `qualys_installed_software` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Issue | `qualys_issue` | [Issue](https://docs.jupiterone.io/data-model/schemas/Issue) |
| Repository | `qualys_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| Vulnerability Manager | `qualys_vulnerability_manager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Web App Finding | `qualys_web_app_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Web Application Scanner | `qualys_web_app_scanner` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `qualys_account` | **HAS** | `qualys_web_app_scanner` |
| `qualys_account` | **HAS** | `qualys_vulnerability_manager` |
| `qualys_compliance_control` | **USES** | `qualys_compliance_technology` |
| `qualys_compliance_control` | **IDENTIFIED** | `qualys_compliance_finding` |
| `qualys_compliance_policy` | **HAS** | `qualys_compliance_control` |
| `qualys_compliance_policy` | **ENFORCES** | `qualys_host` |
| `qualys_container` | **USES** | `qualys_container_image` |
| `qualys_container_image` | **USES** | `qualys_repository` |
| `qualys_host` | **HAS** | `qualys_issue` |
| `qualys_host` | **HAS** | `qualys_host_finding` |
| `qualys_host` | **INSTALLED** | `qualys_installed_software` |
| `qualys_host` | **HAS** | `qualys_compliance_finding` |
| `qualys_host_finding` | **HAS** | `qualys_tag` |
| `qualys_image_finding` | **IS** | `qualys_vuln` |
| `qualys_issue` | **REPORTED** | `qualys_host_finding` |
| `qualys_issue` | **HAS** | `qualys_tag` |
| `qualys_vulnerability_manager` | **SCANS** | `qualys_host` |
| `qualys_web_app_scanner` | **SCANS** | `web_app` |
| `qualys_web_app_scanner` | **IDENTIFIED** | `qualys_web_app_finding` |

### Qualys Compliance Control

`qualys_compliance_control` inherits from [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `autoUpdates` | `boolean` |  |  |
| 
`category` \*

 | `string` |  |  |
| `checkType` | `string` |  |  |
| `comment` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `criticality` | `number` |  |  |
| `criticalityLabel` | `string` |  |  |
| `deprecatedOn` | `number` |  |  |
| `errorSetStatus` | `string` |  |  |
| `frameworks` | `array` of `string`s |  |  |
| 

`id` \*

 | `string` |  |  |
| `ignoresErrors` | `boolean` |  |  |
| `ignoresItemNotFound` | `boolean` |  |  |
| `isActive` | `boolean` | Whether Qualys has the control active at the vendor level. Distinct from isDeprecated (sunset/replaced) and from the per-policy isActive on POLICY\_HAS\_CONTROL relationships. |  |
| `isDeprecated` | `boolean` |  |  |
| 

`statement` \*

 | `string` |  |  |
| 

`subCategory` \*

 | `string` |  |  |
| `updatedOn` | `number` |  |  |
| `usesAgentOnly` | `boolean` |  |  |

---

### Qualys Compliance Finding

`qualys_compliance_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`controlId` \*

 | `number` |  |  |
| `evaluatedOn` | `number` |  |  |
| `exceptionAssignee` | `string` |  |  |
| `exceptionCreatedBy` | `string` |  |  |
| `exceptionCreatedOn` | `number` |  |  |
| `exceptionEndsOn` | `number` |  |  |
| `exceptionLastModifiedBy` | `string` |  |  |
| `exceptionLastModifiedOn` | `number` |  |  |
| `exceptionStatus` | `string` |  |  |
| `firstFailedOn` | `number` |  |  |
| `firstPassedOn` | `number` |  |  |
| `hasException` | `boolean` |  |  |
| 

`hostId` \*

 | `number` |  |  |
| 

`id` \*

 | `string` |  |  |
| `instance` | `string` |  |  |
| `lastFailedOn` | `number` |  |  |
| `lastPassedOn` | `number` |  |  |
| `postureModifiedOn` | `number` |  |  |
| `previousStatus` | `string` |  |  |
| `remediation` | `string` |  |  |
| 

`technologyId` \*

 | `number` |  |  |

---

### Qualys Compliance Policy

`qualys_compliance_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetGroupIds` | `array` of `string`s |  |  |
| `controlCount` | `number` |  |  |
| `createdBy` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `evaluatesImmediately` | `boolean` |  |  |
| 
`id` \*

 | `string` |  |  |
| `includesAgentIps` | `boolean` |  |  |
| `isLocked` | `boolean` |  |  |
| `lastEvaluatedOn` | `number` |  |  |
| `lastModifiedBy` | `string` |  |  |
| `lastModifiedOn` | `number` |  |  |
| `status` | `string` |  |  |
| `tagExcludeSelector` | `string` |  |  |
| `tagIncludeSelector` | `string` |  |  |
| `tagSetExclude` | `array` of `string`s |  |  |
| `tagSetInclude` | `array` of `string`s |  |  |
| 

`title` \*

 | `string` |  |  |

---

### Qualys Compliance Technology

`qualys_compliance_technology` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`controlId` \*

 | `number` |  |  |
| `dataPointCardinality` | `string` |  |  |
| `dataPointOperator` | `string` |  |  |
| `description` | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| `rationale` | `string` |  |  |
| `usesScanValue` | `boolean` |  |  |

---

### Qualys Host

`qualys_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activatedModules` | `array` of `string`s |  |  |
| `agentId` | `string` | Agent ID |  |
| `agentLastCheckedInOn` | `number` | Agent last checked date |  |
| `agentStatus` | `string` | Agent Status |  |
| `agentVersion` | `string` | Agent Version |  |
| `alibabaAccountId` | `string` | Alibaba Cloud Account ID associated with the instance |  |
| `alibabaDnsServer` | `string` | DNS server used by the Alibaba Cloud instance |  |
| `alibabaFirstDiscoveredOn` | `number` | Timestamp when the Alibaba Cloud instance was first discovered |  |
| `alibabaImageId` | `string` | Image ID used to launch the Alibaba Cloud instance |  |
| `alibabaInstanceType` | `string` | Type of Alibaba Cloud instance (e.g., ecs.g6.large) |  |
| `alibabaLastUpdatedOn` | `number` | Timestamp when the Alibaba Cloud instance was last updated |  |
| `alibabaNetworkInterfaceId` | `string` | Network Interface ID associated with the instance |  |
| `alibabaNetworkType` | `string` | Network type of the Alibaba Cloud instance (e.g., VPC, Classic) |  |
| `alibabaRegion` | `string` | Region where the Alibaba Cloud instance is deployed |  |
| `alibabaState` | `string` | Current state of the Alibaba Cloud instance (e.g., Running, Stopped) |  |
| `alibabaVpcCidr` | `string` | CIDR block of the VPC associated with the instance |  |
| `alibabaVpcId` | `string` | VPC ID associated with the Alibaba Cloud instance |  |
| `alibabaVSwitchCIDR` | `string` | CIDR block of the VSwitch associated with the instance |  |
| `alibabaVSwitchId` | `string` | VSwitch ID where the Alibaba Cloud instance is deployed |  |
| `alibabaZone` | `string` | Zone where the Alibaba Cloud instance is located |  |
| `asn` | `string` | Autonomous System Number for the asset, populated by Qualys EASM module |  |
| `assignedLocation` | `string` | Physical or logical location assigned to the asset, populated by Qualys CSAM module |  |
| `azureFirstDiscoveredOn` | `number` | Timestamp when the Azure VM was first discovered |  |
| `azureLastUpdatedOn` | `number` | Timestamp when the Azure VM was last updated |  |
| `azureLocation` | `string` | Azure region where the VM is deployed |  |
| `azureOffer` | `string` | Azure offer associated with the VM |  |
| `azureOsType` | `string` | Operating system type of the Azure VM (e.g., Linux, Windows) |  |
| `azurePublisher` | `string` | Publisher of the VM image |  |
| `azureResourceGroupName` | `string` | Name of the resource group containing the Azure VM |  |
| `azureState` |  |  | `[object Object]`, `[object Object]` |
| `azureSubnet` | `string` | Subnet ID where the Azure VM is deployed |  |
| `azureSubscriptionId` | `string` | Azure Subscription ID associated with the VM |  |
| `azureVersion` | `string` | Version of the VM image |  |
| `azureVmSize` | `string` | Size of the Azure VM (e.g., Standard\_D2s\_v3) |  |
| `businessAppListData` | `string` | Serialized business application mapping for the asset, populated by Qualys CSAM module |  |
| `businessInformation` | `string` | Business information context for the asset, populated by Qualys CSAM module |  |
| `criticalityScore` | `number` | Qualys asset criticality score (typically 1-5) |  |
| `easmTags` | `string` | Comma-separated EASM tags applied by Qualys External Attack Surface Management module |  |
| `ec2AccountId` | `string` | AWS Account ID associated with the EC2 instance |  |
| `ec2AvailabilityZone` | `string` | Availability Zone where the EC2 instance is running |  |
| `ec2FirstDiscoveredOn` | `number` | Timestamp when the EC2 instance was first discovered |  |
| `ec2ImageId` | `string` | AMI ID used to launch the EC2 instance |  |
| `ec2InstanceType` | `string` | Type of EC2 instance (e.g., t2.micro, m5.large) |  |
| `ec2LastUpdatedOn` | `number` | Timestamp when the EC2 instance was last updated |  |
| `ec2PrivateDnsName` | `string` | Private DNS name assigned to the EC2 instance |  |
| `ec2PublicDnsName` | `string` | Public DNS name assigned to the EC2 instance (if applicable) |  |
| `ec2Region` | `string` | AWS Region where the EC2 instance is located |  |
| `ec2ReservationId` | `string` | Reservation ID associated with the EC2 instance |  |
| `ec2State` | `string` | Current state of the EC2 instance (e.g., running, stopped) |  |
| `ec2SubnetId` | `string` | Subnet ID where the EC2 instance is deployed |  |
| `ec2VpcId` | `string` | VPC ID associated with the EC2 instance |  |
| `firstEasmScannedOn` | `number` | Timestamp when Qualys EASM first scanned this asset |  |
| `gcpFirstDiscoveredOn` | `number` | Timestamp when the GCP instance was first discovered |  |
| `gcpImageId` | `string` | Image ID used to launch the GCP instance |  |
| `gcpLastUpdatedOn` | `number` | Timestamp when the GCP instance was last updated |  |
| `gcpMachineType` | `string` | Type of GCP machine (e.g., n1-standard-1, e2-medium) |  |
| `gcpNetwork` | `string` | Network configuration associated with the GCP instance |  |
| `gcpProjectId` | `string` | Project ID associated with the GCP instance |  |
| `gcpProjectIdNo` | `number` | Numerical Project ID associated with the GCP instance |  |
| `gcpState` | `string` | Current state of the GCP instance (e.g., RUNNING, TERMINATED) |  |
| `gcpZone` | `string` | GCP zone where the instance is deployed (e.g., us-central1-a) |  |
| `hostingCategory1` | `string` | Primary hosting category classification for the asset, populated by Qualys EASM/CSAM enrichment |  |
| `ibmDatacenterId` | `string` | Identifier for the IBM Cloud datacenter hosting the instance |  |
| `ibmDomain` | `string` | Domain name associated with the IBM Cloud instance |  |
| `ibmLocation` | `string` | Geographical location where the IBM Cloud instance is deployed |  |
| `ibmPrivateVlan` | `string` | Private VLAN ID associated with the IBM Cloud instance |  |
| `ibmPublicVlan` | `string` | Public VLAN ID associated with the IBM Cloud instance |  |
| `lastEasmScannedOn` | `number` | Timestamp when Qualys EASM last scanned this asset |  |
| `lastScannedOn` | `number` | Last scanned date |  |
| `ociAvailabilityDomain` | `string` | Availability domain where the OCI instance is located |  |
| `ociCompartmentName` | `string` | Name of the compartment containing the OCI instance |  |
| `ociDisplayName` | `string` | Display name of the OCI instance |  |
| `ociFaultDomain` | `string` | Fault domain where the OCI instance is deployed |  |
| `ociFirstDiscoveredOn` | `number` | Timestamp when the OCI instance was first discovered |  |
| `ociImage` | `string` | Image ID or name used to launch the OCI instance |  |
| `ociLastUpdatedOn` | `number` | Timestamp when the OCI instance was last updated |  |
| `ociRegion` | `string` | Region where the OCI instance is deployed |  |
| `ociShape` | `string` | Shape of the OCI instance (e.g., VM.Standard2.1) |  |
| `ociState` | `string` | Current state of the OCI instance (e.g., RUNNING, TERMINATED) |  |
| `ociTenantId` | `string` | Tenant ID associated with the OCI instance |  |
| `ociTenantName` | `string` | Tenant name associated with the OCI instance |  |
| `processor` | `array` of `string`s |  |  |
| `qualysAssetId` | `number` | Qualys Asset ID |  |
| `qualysCreatedOn` | `number` | Qualys created date |  |
| `qualysQwebHostId` | `number` | Qualys Qweb Host ID |  |
| `riskScore` | `number` | Qualys TruRisk Score for the asset, 0-1000 (Severe 850-1000, High 700-849, Medium 500-699, Low 0-499), derived from the asset's criticality and the QDS of its detections |  |
| `scannedBy` | `string` | Scanned by |  |
| `totalMemory` | `number` | Total amount of allocated RAM on Host |  |
| `volume` | `array` of `string`s |  |  |
| `whois` | `string` | WHOIS record data for the asset, populated by Qualys EASM module |  |

---

### Qualys Host Finding

`qualys_host_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `awsAccountId` | `string` |  |  |
| `azureSubscriptionId` | `string` |  |  |
| `azureVmSourceId` | `string` |  |  |
| `details` | `string` | Raw detection results from the Qualys scan output (truncated to 300 bytes for storage). Sourced from the Qualys VM/PC detection `HOST_DETECTION.RESULTS` field. |  |
| `ec2InstanceArn` | `string` |  |  |
| `firstFoundOn` | `number` |  |  |
| `fqdn` | `string` |  |  |
| `gcpInstanceSelfLink` | `string` |  |  |
| `gcpProjectId` | `string` |  |  |
| `hostId` | `number` |  |  |
| 
`id` \*

 | `string` |  |  |
| `isDisabled` | `number` |  |  |
| `isIgnored` | `number` |  |  |
| `lastFixedOn` | `number` | Timestamp when Qualys marked the detection Fixed. Populated only when STATUS=Fixed. |  |
| `lastFoundOn` | `number` |  |  |
| `lastProcessedOn` | `number` |  |  |
| `lastTestedOn` | `number` |  |  |
| `lastUpdatedOn` | `number` |  |  |
| `numTimesFound` | `number` |  |  |
| `port` | `number` |  |  |
| `protocol` | `string` |  |  |
| `qds` | `number` | Qualys Detection Score (0-100), risk-based prioritization metric incorporating QVS, CVSS, EPSS, exploit maturity, and asset-level mitigations |  |
| `qdsSeverity` | `string` | QDS severity category derived from score: Critical (90-100), High (70-89), Medium (40-69), Low (1-39) |  |
| `qid` | `string` | Qualys vulnerability identifier (QID) from the Qualys knowledge base. Stored as a string because a QID is an opaque identifier, not a quantity: as a number it renders with locale thousands separators (`385,437`). |  |
| `qualysSeverity` | `number` |  |  |
| `qvs` | `number` | Qualys Vulnerability Score (0-100), CVE-level score measuring likelihood of exploitation based on CVSS, exploit maturity, and threat intelligence |  |
| `ssl` | `number` |  |  |
| `type` | `string` |  |  |

---

### Qualys Host Finding

`qualys_host_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `awsAccountId` | `string` |  |  |
| `azureSubscriptionId` | `string` |  |  |
| `azureVmSourceId` | `string` |  |  |
| `details` | `string` | Raw detection results from the Qualys scan output (truncated to 300 bytes for storage). Sourced from the Qualys VM/PC detection `HOST_DETECTION.RESULTS` field. |  |
| `ec2InstanceArn` | `string` |  |  |
| `firstFoundOn` | `number` |  |  |
| `fqdn` | `string` |  |  |
| `gcpInstanceSelfLink` | `string` |  |  |
| `gcpProjectId` | `string` |  |  |
| `hostId` | `number` |  |  |
| 
`id` \*

 | `string` |  |  |
| `isDisabled` | `number` |  |  |
| `isIgnored` | `number` |  |  |
| `isPatchable` | `boolean` |  |  |
| `lastFixedOn` | `number` | Timestamp when Qualys marked the detection Fixed. Populated only when STATUS=Fixed. |  |
| `lastFoundOn` | `number` |  |  |
| `lastProcessedOn` | `number` |  |  |
| `lastTestedOn` | `number` |  |  |
| `lastUpdatedOn` | `number` |  |  |
| `numTimesFound` | `number` |  |  |
| `port` | `number` |  |  |
| `protocol` | `string` |  |  |
| `qds` | `number` | Qualys Detection Score (0-100), risk-based prioritization metric incorporating QVS, CVSS, EPSS, exploit maturity, and asset-level mitigations |  |
| `qdsSeverity` | `string` | QDS severity category derived from score: Critical (90-100), High (70-89), Medium (40-69), Low (1-39) |  |
| `qid` | `string` | Qualys vulnerability identifier (QID) from the Qualys knowledge base. Stored as a string because a QID is an opaque identifier, not a quantity: as a number it renders with locale thousands separators (`385,437`). |  |
| `qualysSeverity` | `number` |  |  |
| `qvs` | `number` | Qualys Vulnerability Score (0-100), CVE-level score measuring likelihood of exploitation based on CVSS, exploit maturity, and threat intelligence |  |
| `recommendationAction` | `string` | Remediation guidance from the Qualys knowledge base for this vulnerability. Sourced from the Qualys KB `VULN.SOLUTION` field (HTML stripped). |  |
| `ssl` | `number` |  |  |
| `threatIntel` | `array` of `string`s |  |  |
| `title` | `string` | Vulnerability title from the Qualys knowledge base. Sourced from the Qualys KB `VULN.TITLE` field. |  |
| `type` | `string` |  |  |

---

### Qualys Installed Software

`qualys_installed_software` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `architecture` | `string` | Software architecture (e.g., x86\_64) |  |
| `authorization` | `string` | Authorization status: Authorized, Not Reviewed, Blacklisted |  |
| `category` | `string` | Software category |  |
| `cpe` | `string` | Common Platform Enumeration string |  |
| `cpeId` | `string` | CPE identifier |  |
| `endOfLifeOn` | `number` | End of Life date |  |
| `endOfSupportOn` | `number` | End of Support date |  |
| `generalAvailabilityOn` | `number` | General Availability date |  |
| `licenseCategory` | `string` | License category |  |
| `publisher` | `string` | Software publisher |  |
| `softwareType` | `string` | Software type: Application, Unknown, Others |  |
| `supportStageDesc` | `string` | Support stage description |  |
| `version` | `string` | Software version |  |

---

### Qualys Issue

`qualys_issue` inherits from [Issue](/data-model/schemas/Issue.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdOn` | `number` |  |  |
| `details` | `string` |  |  |
| `firstFoundOn` | `number` |  |  |
| `fqdn` | `string` | Fully-qualified domain name of the host this issue was detected on, lower-cased, sourced from the Qualys host asset (dnsHostName or fqdn). |  |
| `hostId` | `number` |  |  |
| `hostname` | `string` | Short DNS hostname (first label of the FQDN) of the host this issue was detected on, derived from the Qualys host asset. Enables correlating the issue to external asset inventories (e.g. ServiceNow vulnerable items) on hostname + QID without requiring a shared numeric asset id. |  |
| `isDisabled` | `number` |  |  |
| `isIgnored` | `number` |  |  |
| `lastFixedOn` | `number` | Timestamp when Qualys marked the detection Fixed. Populated only when STATUS=Fixed. |  |
| `lastFoundOn` | `number` |  |  |
| `lastProcessedOn` | `number` |  |  |
| `lastTestedOn` | `number` |  |  |
| `lastUpdatedOn` | `number` |  |  |
| `numTimesFound` | `number` |  |  |
| `port` | `number` |  |  |
| `protocol` | `string` |  |  |
| `qds` | `number` | Qualys Detection Score (0-100), risk-based prioritization metric incorporating QVS, CVSS, EPSS, exploit maturity, and asset-level mitigations |  |
| `qdsSeverity` | `string` | QDS severity category derived from score: Critical (90-100), High (70-89), Medium (40-69), Low (1-39) |  |
| 
`qid` \*

 | `string` | Qualys vulnerability identifier (QID) from the Qualys knowledge base. Stored as a string because a QID is an opaque identifier, not a quantity: as a number it renders with locale thousands separators (`385,437`). |  |
| `severity` | `number` |  |  |
| `ssl` | `number` |  |  |
| `status` | `string` |  |  |
| `type` | `string` |  |  |
| `updatedOn` | `number` |  |  |

---

### Qualys Repository

`qualys_repository` inherits from [Repository](/data-model/schemas/Repository.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`registry` \*

 | `string` | Registry name |  |
| 

`repository` \*

 | `string` | Repository name |  |
| 

`tag` \*

 | `string` | Tag name |  |

---

### Qualys Tag

`qualys_tag` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `color` | `string` | Hex color code for tag UI display |  |
| `criticalityScore` | `number` | Qualys tag criticality score (1-5) |  |
| `ruleText` | `string` | Search query used to evaluate this dynamic tag, verbatim from Qualys. For VULN\_EXIST and ASSET\_SEARCH rules it encodes the vulnerability and asset criteria that make the tag apply. |  |
| `ruleType` | `string` | Tag rule type as answered by the Qualys Asset Management Tag API: STATIC, GROOVY, OS\_REGEX, NETWORK\_RANGE, NAME\_CONTAINS, INSTALLED\_SOFTWARE, OPEN\_PORTS, VULN\_EXIST, ASSET\_SEARCH, CLOUD\_ASSET or BUSINESS\_INFORMATION. |  |
| 
`tagId` \*

 | `number` | Qualys numeric tag ID |  |

---

## Release Notes

-   **2026-08-07** — Added ingestion of Qualys CSAM vulnerability tags as queryable entities, with optional configuration to enable tag ingestion and linking to host findings.
-   **2026-08-04** — Qualys vulnerability findings now consistently include a hostname property, improving cross-integration host correlation.
-   **2026-03-23** — Improved last seen timestamp accuracy on Qualys host entities by using the last scanned date as a fallback when agent check-in data is unavailable.
-   **2026-03-11** — Added ingestion of installed software as Qualys installed software entities, relating them to their host.
-   **2026-03-05** — Added Qualys compliance policy to host relationships, linking compliance policies to their evaluated hosts.
-   **2026-02-10** — Added Qualys issue entities as a new step, creating structured issue records from host vulnerability data.
-   **2026-02-03** — Added VMDR fixed findings since days configuration option to control how far back to ingest fixed VMDR findings.
-   **2026-01-29** — Added patchable and threat intelligence properties (CVSS v3 base score, exploitability) to Qualys vulnerability entities.
-   **2026-01-28** — Added compliance finding to host relationship for compliance findings to their associated hosts.
-   **2026-01-23** — Improved rendering of Qualys vulnerability solution and recommendation text by converting HTML markup to plain text.
-   **2025-12-02** — Added Qualys Policy Audit (PC module) support, ingesting compliance policies and compliance findings as new entity types.
-   **2025-11-18** — Added host finding status filter configuration option to limit findings to active, fixed, or new states.
-   **2025-10-27** — Normalized additional properties on Qualys host finding entities including severity override and QDS.
-   **2025-08-20** — Added remediation actions normalization to Qualys vulnerability entities.
-   **2025-07-31** — Added hostname parsing from the asset name field on global Qualys host entities.
-   **2025-05-05** — Added Qualys Container Security repositories as container repository entities.
-   **2025-04-29** — Promoted total memory, processor, and volume properties to Qualys host entities.
-   **2025-04-15** — Added Qualys container finding relationship linking container scan findings to their containers.

---

Source: /integrations/directory/qualys-totalcloud

# Qualys TotalCloud

Visualize Qualys TotalCloud cloud assets and CSPM control evaluations across AWS, Azure, GCP, and OCI, and monitor findings and changes through queries and alerts.

## Installation

This integration reads data from the Qualys **TotalCloud** (CloudView) module over its REST API — cloud connectors, cloud assets, controls, and control evaluations (findings) across AWS, Azure, GCP, and OCI. Because it is read-only, a Qualys user with the **Reader** role is sufficient, provided that user's role has the **TotalCloud API Access** permission enabled.

> **INFO**
> 
> You will need the following:
> 
> -   A Qualys **username** and **password** for a user whose role:
>     
>     -   Has access to the **TotalCloud** module (the predefined _TOTALCLOUD User_ role, a custom role, or **Manager**).
>     -   Has the **TotalCloud API Access** permission enabled under TotalCloud. Without it, the API responds that the user is not authorized to access the module. See [User Roles and Permissions](https://docs.qualys.com/en/cloudview/latest/users/user_roles.htm) and [Assign Role to Users](https://docs.qualys.com/en/cloudview/latest/users/assign_role.htm).
> -   Your Qualys **API URL** for the platform that hosts your account — for example, `https://qualysapi.qg3.apps.qualys.com`. Use the URL that matches your login platform. See [Qualys Platform Identification](https://www.qualys.com/platform-identification) to find yours.
>     

> **NOTE**
> 
> The integration authenticates with HTTP Basic authentication against the CloudView/TotalCloud REST API. Use a username and password associated with a non-test (subscription) account user.

## Data Volume Configuration

Control how much data is ingested from Qualys TotalCloud to manage storage and processing.

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Findings History Days** | How many days of TotalCloud control evaluations (findings) to fetch per cloud resource. | 90 | 7, 30, 90, 180, 365 |

**How it affects data volume:** Larger windows pull more evaluation history per resource and meaningfully increase the number of API calls for large multi-cloud tenants.

All ingestion sources are **disabled by default**. Enable only the providers (AWS, Azure, GCP, OCI) and data types you need from the integration instance's ingestion source settings to keep ingestion scoped to what you use.

### Configuration in JupiterOne

To install the Qualys TotalCloud integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Qualys TotalCloud**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Qualys TotalCloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Qualys **Username**, **Password**, and **API URL**.
    
-   Optionally, the **Findings History Days** window under the **Findings** configuration section.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (1)

-   `TotalCloud API Access`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (18)

-   `/cloudview-api/rest/v1/aws/connectors`
-   `/cloudview-api/rest/v1/aws/evaluations/{accountId}`
-   `/cloudview-api/rest/v1/aws/evaluations/{accountId}/resources/{controlId}`
-   `/cloudview-api/rest/v1/azure/connectors`
-   `/cloudview-api/rest/v1/azure/evaluations/{accountId}`
-   `/cloudview-api/rest/v1/azure/evaluations/{accountId}/resources/{controlId}`
-   `/cloudview-api/rest/v1/controls/metadata/list`
-   `/cloudview-api/rest/v1/gcp/connectors`
-   `/cloudview-api/rest/v1/gcp/evaluations/{accountId}`
-   `/cloudview-api/rest/v1/gcp/evaluations/{accountId}/resources/{controlId}`
-   `/cloudview-api/rest/v1/oci/connectors`
-   `/cloudview-api/rest/v1/oci/evaluations`
-   `/cloudview-api/rest/v1/oci/evaluations/resources/{controlId}`
-   `/cloudview-api/rest/v1/resource/{resourceType}/AWS`
-   `/cloudview-api/rest/v1/resource/{resourceType}/Azure`
-   `/cloudview-api/rest/v1/resource/{resourceType}/GCP`
-   `/cloudview-api/rest/v1/resource/{resourceType}/OCI`
-   `/cloudview-api/rest/v2/policies`

### Licenses

Product licenses or SKUs required in the target environment.

Show Licenses (1)

-   `Qualys TotalCloud (CloudView)`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (2)

-   [https://docs.qualys.com/en/cloudview/latest/users/user\_roles.htm](https://docs.qualys.com/en/cloudview/latest/users/user_roles.htm)
-   [https://docs.qualys.com/en/tc/api/](https://docs.qualys.com/en/tc/api/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (12)

| Step | Permissions | Endpoints | Licenses |
| --- | --- | --- | --- |
| Fetch AWS Cloud Assets | `TotalCloud API Access` | `/cloudview-api/rest/v1/resource/{resourceType}/AWS` | `Qualys TotalCloud (CloudView)` |
| Fetch AWS Findings | `TotalCloud API Access` | `/cloudview-api/rest/v1/aws/evaluations/{accountId}`, `/cloudview-api/rest/v1/aws/evaluations/{accountId}/resources/{controlId}` | `Qualys TotalCloud (CloudView)` |
| Fetch Azure Cloud Assets | `TotalCloud API Access` | `/cloudview-api/rest/v1/resource/{resourceType}/Azure` | `Qualys TotalCloud (CloudView)` |
| Fetch Azure Connectors | `TotalCloud API Access` | `/cloudview-api/rest/v1/azure/connectors` | `Qualys TotalCloud (CloudView)` |
| Fetch Azure Findings | `TotalCloud API Access` | `/cloudview-api/rest/v1/azure/evaluations/{accountId}`, `/cloudview-api/rest/v1/azure/evaluations/{accountId}/resources/{controlId}` | `Qualys TotalCloud (CloudView)` |
| Fetch CSPM Policies | `TotalCloud API Access` | `/cloudview-api/rest/v2/policies` | `Qualys TotalCloud (CloudView)` |
| Fetch GCP Cloud Assets | `TotalCloud API Access` | `/cloudview-api/rest/v1/resource/{resourceType}/GCP` | `Qualys TotalCloud (CloudView)` |
| Fetch GCP Connectors | `TotalCloud API Access` | `/cloudview-api/rest/v1/gcp/connectors` | `Qualys TotalCloud (CloudView)` |
| Fetch GCP Findings | `TotalCloud API Access` | `/cloudview-api/rest/v1/gcp/evaluations/{accountId}`, `/cloudview-api/rest/v1/gcp/evaluations/{accountId}/resources/{controlId}` | `Qualys TotalCloud (CloudView)` |
| Fetch OCI Cloud Assets | `TotalCloud API Access` | `/cloudview-api/rest/v1/resource/{resourceType}/OCI` | `Qualys TotalCloud (CloudView)` |
| Fetch OCI Connectors | `TotalCloud API Access` | `/cloudview-api/rest/v1/oci/connectors` | `Qualys TotalCloud (CloudView)` |
| Fetch OCI Findings | `TotalCloud API Access` | `/cloudview-api/rest/v1/oci/evaluations`, `/cloudview-api/rest/v1/oci/evaluations/resources/{controlId}` | `Qualys TotalCloud (CloudView)` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `qualys_totalcloud_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AWS Auto Scaling Group | `qualys_totalcloud_aws_auto_scaling_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS EBS Volume | `qualys_totalcloud_aws_ebs` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| AWS EC2 Instance | `qualys_totalcloud_aws_ec2_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS EKS Cluster | `qualys_totalcloud_aws_eks_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS EKS Fargate Profile | `qualys_totalcloud_aws_eks_fargate_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS EKS Node Group | `qualys_totalcloud_aws_eks_nodegroup` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS IAM User | `qualys_totalcloud_aws_iam_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| AWS Internet Gateway | `qualys_totalcloud_aws_internet_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Lambda Function | `qualys_totalcloud_aws_lambda` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| AWS Load Balancer | `qualys_totalcloud_aws_load_balancer` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Network ACL | `qualys_totalcloud_aws_network_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS RDS Instance | `qualys_totalcloud_aws_rds` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Route Table | `qualys_totalcloud_aws_route_table` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS S3 Bucket | `qualys_totalcloud_aws_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Security Group | `qualys_totalcloud_aws_vpc_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Subnet | `qualys_totalcloud_aws_subnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS VPC | `qualys_totalcloud_aws_vpc` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Azure Function App | `qualys_totalcloud_azure_function_app` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| Azure Network Security Group | `qualys_totalcloud_azure_network_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Azure Resource Group | `qualys_totalcloud_azure_resource_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Azure SQL Database | `qualys_totalcloud_azure_sql_server_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Azure SQL Server | `qualys_totalcloud_azure_sql_server` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Azure Virtual Machine | `qualys_totalcloud_azure_virtual_machine` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Azure Virtual Network | `qualys_totalcloud_azure_virtual_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Azure Web App | `qualys_totalcloud_azure_web_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Cloud Asset | `qualys_totalcloud_cloud_asset` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Connector | `qualys_totalcloud_connector` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Control | `qualys_totalcloud_control` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Finding | `qualys_totalcloud_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| GCP Cloud Function | `qualys_totalcloud_gcp_cloud_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| GCP Compute Firewall | `qualys_totalcloud_gcp_firewall_rules` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| GCP Compute Instance | `qualys_totalcloud_gcp_vm_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| GCP Compute Network | `qualys_totalcloud_gcp_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| GCP Compute Subnetwork | `qualys_totalcloud_gcp_subnetwork` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| OCI Block Volume | `qualys_totalcloud_oci_block_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| OCI Compute Instance | `qualys_totalcloud_oci_compute_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| OCI Database System | `qualys_totalcloud_oci_db_system` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| OCI Function | `qualys_totalcloud_oci_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| OCI Identity User | `qualys_totalcloud_oci_identity_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| OCI Load Balancer | `qualys_totalcloud_oci_load_balancer` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| OCI Network Security Group | `qualys_totalcloud_oci_network_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| OCI Object Storage Bucket | `qualys_totalcloud_oci_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| OCI Security List | `qualys_totalcloud_oci_security_list` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| OCI Subnet | `qualys_totalcloud_oci_subnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| OCI Virtual Cloud Network | `qualys_totalcloud_oci_vcn` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Policy | `qualys_totalcloud_policy` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `qualys_totalcloud_account` | **HAS** | `qualys_totalcloud_connector` |
| `qualys_totalcloud_cloud_asset` | **HAS** | `qualys_totalcloud_finding` |
| `qualys_totalcloud_connector` | **HAS** | `qualys_totalcloud_cloud_asset` |
| `qualys_totalcloud_control` | **IDENTIFIED** | `qualys_totalcloud_finding` |
| `qualys_totalcloud_policy` | **HAS** | `qualys_totalcloud_control` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_ebs_volume` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_s3_bucket` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_rds_instance` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_iam_user` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_lambda_function` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_vpc` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_subnet` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_internet_gateway` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_network_acl` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_route_table` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_security_group` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_lb` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_autoscaling_group` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_eks_cluster` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_eks_nodegroup` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_eks_fargate_profile` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `azure_vnet` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `azure_security_group` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `azure_resource_group` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `azure_sql_database` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `azure_web_app` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `azure_function_app` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `google_compute_network` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `google_compute_subnetwork` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `google_compute_firewall` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `google_cloud_function` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `oci_objectstorage_bucket` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `oci_virtual_cloud_network` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `oci_subnet` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `oci_security_list` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `oci_network_security_group` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `oci_block_volume` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `oci_user` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `oci_load_balancer` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `oci_functions_function` | FORWARD |
| `qualys_totalcloud_connector` | **IS** | `aws_account` | FORWARD |
| `qualys_totalcloud_connector` | **IS** | `azure_subscription` | FORWARD |
| `qualys_totalcloud_connector` | **IS** | `google_cloud_project` | FORWARD |
| `qualys_totalcloud_connector` | **IS** | `oci_compartment` | FORWARD |
| `qualys_totalcloud_policy` | **EVALUATES** | `qualys_totalcloud_connector` | FORWARD |

### Qualys Totalcloud Account

`qualys_totalcloud_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Connector

`qualys_totalcloud_connector` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`awsAccountAlias` \*

 | `string` **|** `null` | AWS-only: human-readable account alias. |  |
| 

`awsAccountId` \*

 | `string` **|** `null` | AWS-only: the 12-digit AWS account ID. |  |
| 

`awsBaseAccountId` \*

 | `string` **|** `null` | AWS-only: base/payer account ID when present. |  |
| 

`awsExternalId` \*

 | `string` **|** `null` | AWS-only: external ID for the assume-role. |  |
| 

`awsRoleArn` \*

 | `string` **|** `null` | AWS-only: assumed-role ARN Qualys uses. |  |
| 

`azureApplicationId` \*

 | `string` **|** `null` | Azure-only: app registration GUID. |  |
| 

`azureSubscriptionId` \*

 | `string` **|** `null` | Azure-only: subscription GUID. |  |
| 

`azureTenantId` \*

 | `string` **|** `null` | Azure-only: tenant GUID. |  |
| 

`connectorId` \*

 | `string` | Qualys-side UUID for the connector. |  |
| 

`connectorState` \*

 | `string` **|** `null` | Connector sync state, e.g. SUCCESS, PENDING, REGIONS\_DISCOVERED, ERROR. |  |
| 

`gcpProjectId` \*

 | `string` **|** `null` | GCP-only: project ID. |  |
| 

`gcpServiceAccountEmail` \*

 | `string` **|** `null` | GCP-only: service account email Qualys impersonates. |  |
| 

`groupNames` \*

 | `array` **|** `null` | Names of Qualys connector groups this connector belongs to. |  |
| 

`isChinaRegion` \*

 | `boolean` **|** `null` | AWS-only: true for China-region connectors. |  |
| 

`isDisabled` \*

 | `boolean` **|** `null` | True when the connector is paused/disabled. |  |
| 

`isGovCloud` \*

 | `boolean` **|** `null` | AWS-only: true for GovCloud-scoped connectors. |  |
| 

`isPortalConnector` \*

 | `boolean` **|** `null` | True when managed by the new central Qualys Connectors app. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys auto-remediation is enabled for this connector. |  |
| 

`lastError` \*

 | `string` **|** `null` | Last error message reported by Qualys (null when healthy). |  |
| 

`lastSyncedOn` \*

 | `number` **|** `null` | Epoch ms of last successful sync. |  |
| 

`ociHomeRegion` \*

 | `string` **|** `null` | OCI-only: home region name. |  |
| 

`ociTenancyOcid` \*

 | `string` **|** `null` | OCI-only: tenancy OCID. |  |
| 

`ociUserOcid` \*

 | `string` **|** `null` | OCI-only: API user OCID. |  |
| 

`pollingFrequencyHours` \*

 | `number` **|** `null` | Polling interval in decimal hours (hours + minutes/60). |  |
| 

`provider` \*

 | `string` | Cloud provider: AWS, AZURE, GCP, or OCI. |  |
| 

`tagIds` \*

 | `array` **|** `null` | Ids of the Qualys asset tags associated with this connector, as strings. Matches `qualys_totalcloud_policy.tagIds` — a tag-scoped policy is evaluated against the connectors carrying its tags. |  |
| 

`tagNames` \*

 | `array` **|** `null` | Names of the Qualys asset tags associated with this connector. |  |
| 

`totalAssets` \*

 | `number` **|** `null` | Asset count Qualys observed at the last sync. |  |

---

### Qualys Totalcloud Control

`qualys_totalcloud_control` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cid` \*

 | `string` | Qualys control identifier. |  |
| 

`controlCriticality` \*

 | `string` **|** `null` | Qualys control criticality (LOW / MEDIUM / HIGH). Separate from the base-class `criticality` (numeric). |  |
| 

`controlType` \*

 | `string` **|** `null` | System Defined or User Defined. |  |
| 

`evaluationDescription` \*

 | `string` **|** `null` | Free-text description of what the control evaluates. |  |
| 

`executionType` \*

 | `string` **|** `null` | Run Time or Build Time. |  |
| 

`failMessage` \*

 | `string` **|** `null` | Message shown for FAIL. |  |
| 

`isCustomizable` \*

 | `boolean` **|** `null` | True when the control may be customized by the tenant. |  |
| 

`isQflowBased` \*

 | `boolean` **|** `null` | True for QFlow-based controls. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys can auto-remediate failures. |  |
| 

`manualRemediation` \*

 | `string` **|** `null` | Manual remediation guidance. |  |
| 

`numericSeverity` \*

 | `number` **|** `null` | Numeric mapping of criticality (LOW=2, MEDIUM=5, HIGH=7, CRITICAL=10). |  |
| 

`passMessage` \*

 | `string` **|** `null` | Message shown for PASS. |  |
| 

`policyNames` \*

 | `array` **|** `null` | Framework/policy names this control belongs to. |  |
| 

`provider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`rationale` \*

 | `string` **|** `null` | Rationale text for the control. |  |
| 

`referenceText` \*

 | `string` **|** `null` | External reference URLs (raw string from Qualys references field). |  |
| 

`resourceType` \*

 | `string` **|** `null` | Provider resource-type the control evaluates. |  |
| 

`serviceType` \*

 | `string` **|** `null` | Provider service category, e.g. IAM, Azure SQL. |  |
| 

`specification` \*

 | `string` **|** `null` | Detailed specification text. |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |

---

### Qualys Totalcloud Finding

`qualys_totalcloud_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cloudAccountAlias` \*

 | `string` **|** `null` | Denormalized cloud account alias from the connector. AWS only — Qualys does not report an alias for the other providers. |  |
| 

`cloudAccountId` \*

 | `string` | Cloud account/subscription/project/tenancy ID. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`connectorGroupNames` \*

 | `array` **|** `null` | Denormalized Qualys connector group names. Use for "all findings in group X" queries without traversing to the connector. |  |
| 

`connectorName` \*

 | `string` **|** `null` | Denormalized name of the Qualys connector that produced this finding. Lets findings be scoped to a connector by name instead of by its UUID. |  |
| 

`connectorTagIds` \*

 | `array` **|** `null` | Denormalized Qualys asset tag ids from the connector that produced this finding, as strings. Matches `qualys_totalcloud_policy.tagIds`, so findings can be scoped to a tag-scoped CSPM policy by property filter instead of resolving the connector list outside the graph. Null when the connector carries no Qualys tags, or when the evaluation names a connector the connectors source did not ingest. |  |
| 

`controlId` \*

 | `string` | Qualys control identifier (CID); numeric or alphanumeric. |  |
| 

`controlName` \*

 | `string` | Denormalized control name (joined from control metadata). |  |
| 

`evidences` \*

 | `array` **|** `null` | Qualys evidence entries supporting this finding, formatted as `settingName=actualValue` strings (or just one side when the other is missing). |  |
| 

`firstEvaluatedOn` \*

 | `number` **|** `null` | Epoch ms; first time this control was evaluated against the resource. |  |
| 

`fixedOn` \*

 | `number` **|** `null` | Epoch ms when the misconfiguration was last observed as fixed. |  |
| 

`isPassWithException` \*

 | `boolean` | True when result === PASS\_WITH\_EXCEPTION. |  |
| 

`lastEvaluatedOn` \*

 | `number` **|** `null` | Epoch ms; most recent evaluation. Null when Qualys reports neither evaluationDates.lastEvaluated nor evaluatedOn. |  |
| 

`policyName` \*

 | `string` **|** `null` | Denormalized primary framework/policy name (first of policyNames; e.g. CIS AWS Foundations). |  |
| 

`policyNames` \*

 | `array` **|** `null` | All framework/policy names the evaluated control belongs to. Use for "findings in policy X" membership queries; a control can belong to more than one policy. |  |
| 

`qualysConnectorId` \*

 | `string` | Qualys connectorId that produced this finding. |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region. |  |
| 

`reopenedOn` \*

 | `number` **|** `null` | Epoch ms when the finding most recently re-opened. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource ID the finding applies to. |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code. |  |
| 

`result` \*

 | `string` | PASS, FAIL, or PASS\_WITH\_EXCEPTION. |  |
| 

`service` \*

 | `string` **|** `null` | Qualys service code, e.g. IAM, S3, VPC. |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |

---

### Qualys Totalcloud Policy

`qualys_totalcloud_policy` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`controlCount` \*

 | `number` **|** `null` | Number of controls the policy contains. |  |
| 

`controlIds` \*

 | `array` **|** `null` | Qualys control identifiers (CIDs) that make up this policy, as strings. |  |
| 

`executionType` \*

 | `string` **|** `null` | RUN\_TIME or BUILD\_TIME. |  |
| 

`isConnectorScoped` \*

 | `boolean` | True when the policy is restricted to tagged connectors (`tagIds` is non-empty). False when it applies to every connector of its `provider`. |  |
| 

`isCustomerCreated` \*

 | `boolean` **|** `null` | True when the tenant authored or cloned this policy. |  |
| 

`policyId` \*

 | `string` | Qualys-side UUID of the policy. |  |
| 

`policyType` \*

 | `string` **|** `null` | SYSTEM\_DEFINED\_POLICY or USER\_DEFINED\_POLICY, as reported by Qualys. |  |
| 

`policyVersion` \*

 | `string` **|** `null` | Qualys policy version string, e.g. "1.0". |  |
| 

`provider` \*

 | `string` **|** `null` | Cloud provider the policy targets: AWS, AZURE, GCP, or OCI (Qualys `cloudType`). |  |
| 

`scope` \*

 | `string` **|** `null` | Visibility scope of the policy — GLOBAL (shipped by Qualys) or CUSTOMER (tenant-scoped). |  |
| 

`tagIds` \*

 | `array` **|** `null` | Qualys asset tag ids the policy is scoped to, as strings. Null when the policy is untagged, which in Qualys means it applies to every connector of its `provider`. Matches `qualys_totalcloud_connector.tagIds`. |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |

---

---

Source: /integrations/directory/rapid7

# Rapid7 Nexpose

Visualize Rapid7 Nexpose users, devices, scanners, findings, and vulnerabilities, map Rapid7 Nexpose users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to acquire and provide the following within JupiterOne:

1.  The **InsightVM Security Console Socket Address**: The publicly-accessible socket (host:port) of your InsightVM Security Console. e.g. `{hostname}:3780`.
2.  An **InsightVM Username and Password**: You will need to use an existing user or create a user that has the **Global Administrator Role**.

> **INFO**
> 
> For more information for InsightVM user management, see [Rapid7 Nexpose's documentation](https://docs.rapid7.com/insightvm/managing-users-and-authentication/#global-administrator).

### Configuration in JupiterOne

To install the Rapid7 Nexpose integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Rapid7. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Rapid7 Nexpose account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **InsightsVM Security Console Socket Address** which is publicly accessible.
    
-   The **InsightsVM Username** and **InsightsVM Password** of an admin user in the security console.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `insightvm_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Asset | `insightvm_asset` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Asset Finding | `insightvm_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Asset Vulnerability | `insightvm_finding` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Scan | `insightvm_scan` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Site | `insightvm_site` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| User | `insightvm_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vulnerability | `insightvm_vulnerability` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `insightvm_account` | **HAS** | `insightvm_user` |
| `insightvm_account` | **HAS** | `insightvm_asset` |
| `insightvm_account` | **HAS** | `insightvm_site` |
| `insightvm_asset` | **HAS** | `insightvm_finding` |
| `insightvm_asset` | **HAS** | `insightvm_vulnerability` |
| `insightvm_finding` | **IS** | `insightvm_vulnerability` |
| `insightvm_site` | **PERFORMED** | `insightvm_scan` |
| `insightvm_site` | **MONITORS** | `insightvm_asset` |
| `insightvm_site` | **HAS** | `insightvm_user` |
| `insightvm_user` | **OWNS** | `insightvm_asset` |

### Insightvm Asset

`insightvm_asset` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `lastScanDate` | `number` |  |  |
| `macAddress` | `string` |  |  |
| `numCriticalVulnerabilities` | `number` |  |  |
| `platform` | `string` |  |  |
| `riskScore` | `number` |  |  |
| `webLink` | `string` |  |  |

---

### Insightvm Finding

`insightvm_finding` inherits from [Finding](/data-model/schemas/Finding.md)

---

### Insightvm Finding

`insightvm_finding` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

---

### Insightvm User

`insightvm_user` inherits from [User](/data-model/schemas/User.md)

---

### Insightvm Vulnerability

`insightvm_vulnerability` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

---

## Release Notes

-   **2025-06-04** — Rapid7 InsightVM vulnerability findings now support the Vulnerability and Finding entity classes together, enabling cross-integration vulnerability queries, and CVE IDs are now normalized for unified querying.

---

Source: /integrations/directory/rapid7-insight

# Rapid7 Insight Platform

The Rapid7 Insight Platform is a cloud-based security solution offering integrated tools for vulnerability management, incident detection, and application security, enhanced by advanced analytics and automation for efficient threat identification and response.

## Installation

### Configuration in Rapid7 Insight Platform

1.  Go to the [Rapid7 Insight Platform](https://insight.rapid7.com/platform#/).
2.  Click in the gear icon at the top right corner and when the dropdown is opened click on API Keys.
3.  Inside API Key Management -> User Keys, click Generate New User Key. Select your Organization and create a name for your API key. `Please make sure the user that generates the API key is Platform Admin. This can be checked inside Settings -> User Management -> Click user -> Navigate to Role Management.`
4.  The created API key will be addded to the JupiterOne integration instance configuration. Your API key will be displayed only one time so make sure to copy it before closing the creation modal.

> **NOTE**
> 
> It is strongly recommended to enable the [Rapid7 Asset Correlation](https://docs.rapid7.com/insightvm/correlate-assets-with-insight-agent-uuids/) feature. This will allow JupiterOne to correlate assets across different products and services as part of the [Unified Device data model](/features/assets/device-unification.md).

### Configuration in JupiterOne

To install the Rapid7 Insight integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Rapid7 Insight Platform. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **Organization ID**: this can be found in Settings -> Organization Settings.
    
-   **API Key**: the created API key should be added here.
    
-   **Insight Region**: the region to ingest Insight data from. This can be found in the top right cornet of your Rapid7 Insight Dashboard. You should be able to see something like: `United States - 2`. Valid region codes: us, us2, us3, eu, ca, au or ap.
    
-   **Product Codes to Ingest**: Here we will add the Insight product codes to ingest. Please select the products that you want to ingest. The unselected ones will be skipped in the integration steps.
    
-   The **Account Name** used to identify the Rapid7 Insight Platform account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Data Source Settigns**: here you will be able to customize the steps to be ingested. If desired, specific steps can be enabled/disabled from here.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `rapid7_insight_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Insight Service | `rapid7_insight_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| InsightAppSec App | `insightappsec_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| InsightAppSec Engine | `insightappsec_engine` | [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| InsightAppSec Engine Group | `insightappsec_engine_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| InsightAppSec Scan | `insightappsec_scan` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| InsightAppSec Scan Config | `insightappsec_scan_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| InsightAppSec Vulnerability | `insightappsec_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| InsightVM Device | `insightvm_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| InsightVM Host | `insightvm_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| InsightVM Site | `insightvm_site` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| InsightVM Vulnerability | `insightvm_vulnerability` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| InsightVM Vulnerability | `insightvm_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `insightappsec_app` | **HAS** | `insightappsec_vulnerability` |
| `insightappsec_engine_group` | **HAS** | `insightappsec_engine` |
| `insightappsec_engine_group` | **USES** | `insightappsec_scan_config` |
| `insightappsec_scan` | **PROTECTS** | `insightappsec_app` |
| `insightappsec_scan_config` | **PERFORMED** | `insightappsec_scan` |
| `insightvm_device` | **HAS** | `insightvm_vulnerability` |
| `insightvm_host` | **HAS** | `insightvm_vulnerability` |
| `insightvm_site` | **MONITORS** | `insightvm_device` |
| `insightvm_site` | **MONITORS** | `insightvm_host` |
| `rapid7_insight_account` | **HAS** | `rapid7_insight_service` |
| `rapid7_insight_service` | **HAS** | `insightvm_site` |
| `rapid7_insight_service` | **HAS** | `insightappsec_engine_group` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `insightvm_vulnerability` | **IS** | `cve` | FORWARD |

### Insightappsec Vulnerability

`insightappsec_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appId` | `string` |  |  |
| `blocking` | `null` |  |  |
| `id` | `string` |  |  |
| `insightUiUrl` | `string` |  |  |
| `lastDiscofirstDiscoveredvered` | `number` |  |  |
| `lastDiscovered` | `number` |  |  |
| `newlyDiscovered` | `boolean` |  |  |
| `numericSeverity` | `number` |  |  |
| `open` | `boolean` |  |  |
| `priority` | `string` |  |  |
| `production` | `boolean` |  |  |
| `public` | `boolean` |  |  |
| `rootCauseMethod` | `string` |  |  |
| `rootCauseParameter` | `string` |  |  |
| `rootCauseUrl` | `string` |  |  |
| `score` | `number` |  |  |
| `severity` | `string` |  |  |
| `status` | `string` |  |  |
| `validated` | `boolean` |  |  |
| `variances` | `array` of `string`s |  |  |
| `vector` | `string` |  |  |
| `vectorString` | `string` |  |  |
| `vulnerabilityScore` | `number` |  |  |

---

### Insightvm Device

`insightvm_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assessedForPolicies` | `boolean` |  |  |
| `assessedForVulnerabilities` | `boolean` |  |  |
| `criticalVulnerabilities` | `integer` |  |  |
| `exploits` | `integer` |  |  |
| `ip` | `string` |  |  |
| `lastAssessedForVulnerabilitiesOn` | `number` |  |  |
| `lastScanEndOn` | `number` |  |  |
| `lastScanStartOn` | `number` |  |  |
| `macAddress` | `string` |  |  |
| `malwareKits` | `integer` |  |  |
| `moderateVulnerabilities` | `integer` |  |  |
| `osArchitecture` | `string` |  |  |
| `osDescription` | `string` |  |  |
| `osFamily` | `string` |  |  |
| `osSystemName` | `string` |  |  |
| `osVendor` | `string` |  |  |
| `riskScore` | `integer` |  |  |
| `risksevereVulnerabilitiesScore` | `integer` |  |  |
| `totalVulnerabilities` | `string` |  |  |

---

### Insightvm Host

`insightvm_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assessedForPolicies` | `boolean` |  |  |
| `assessedForVulnerabilities` | `boolean` |  |  |
| `criticalVulnerabilities` | `integer` |  |  |
| `exploits` | `integer` |  |  |
| `ip` | `string` |  |  |
| `lastAssessedForVulnerabilitiesOn` | `number` |  |  |
| `lastScanEndOn` | `number` |  |  |
| `lastScanStartOn` | `number` |  |  |
| `macAddress` | `string` |  |  |
| `malwareKits` | `integer` |  |  |
| `moderateVulnerabilities` | `integer` |  |  |
| `osArchitecture` | `string` |  |  |
| `osDescription` | `string` |  |  |
| `osFamily` | `string` |  |  |
| `osSystemName` | `string` |  |  |
| `osVendor` | `string` |  |  |
| `physical` | `boolean` |  |  |
| `publicIpAddress` | `string` |  |  |
| `riskScore` | `integer` |  |  |
| `risksevereVulnerabilitiesScore` | `integer` |  |  |
| `totalVulnerabilities` | `string` |  |  |

---

### Insightvm Vulnerability

`insightvm_vulnerability` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

---

### Insightvm Vulnerability

`insightvm_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

---

## Release Notes

-   **2026-04-08** — Improved OS name and OS type accuracy on Rapid7 InsightVM host and device entities, using human-readable OS names for macOS and accurate OS type classification.
-   **2025-08-22** — Added additional properties to Rapid7 InsightVM asset vulnerability relationships, including solution details, port, protocol, first and last found timestamps, and remediation status.
-   **2025-06-05** — Added unified vulnerability ingestion for Rapid7 InsightVM, supporting both vulnerability and finding entity classes.

---

Source: /integrations/directory/reco

# Reco

Visualize changes to Reco Accounts, Users, Identity Users, Identity Accounts, Policies, Devices, Applications, and Alerts through queries and alerts.

## Installation

The Reco integration collects accounts, users, identities, devices, applications, policies, alerts, and AI agents from your Reco environment using the Reco API.

### Prerequisites

-   An active Reco account with Admin-level access.
-   Permission to manage API keys in the Reco portal.

### Creating an API key in Reco

1.  Log in to your Reco portal.
2.  Navigate to **Integrations**.
3.  Navigate to **API Access Keys**.
4.  Click **Add API Access Key** to generate a new key.
5.  Provide a descriptive name for the key (for example, `JupiterOne Integration`) and click **Add**.
6.  Copy the generated API key and store it securely.

> **NOTE**
> 
> You cannot view the full key again after navigating away from the page.

### Configuration in JupiterOne

To install the Reco integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Reco**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **Account Name** — A label used to identify this integration instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **AccountName** toggle is enabled.
    
-   **Description** — An optional description to help distinguish this instance from others.
    
-   **Polling Interval** — How often JupiterOne should collect data from Reco. You may leave this as `DISABLED` and trigger the integration manually.
    
-   **API Key** — The API key generated in the Reco integrations tab (required).
    
-   **Reco Host URL** — The URL of your Reco instance (for example, `https://your-company.reco.ai`) (required).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Once your integration instance is configured, it will begin running on the polling interval you selected. Continue on to our [instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (1)

-   `PERM_AI_AGENTS_READ`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (5)

-   `https://<reco-host>/api/v1/asset-management`
-   `https://<reco-host>/api/v1/asset-management/query`
-   `https://<reco-host>/api/v1/external-api/ai-agents/list`
-   `https://<reco-host>/api/v1/policy-subsystem/alert-inbox/table`
-   `https://<reco-host>/api/v1/users`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://readme.reco.ai/reference](https://readme.reco.ai/reference)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | Endpoints |
| --- | --- |
| Build Identity Account Has Applications Relationships | `https://<reco-host>/api/v1/asset-management/query` |
| Fetch Alerts | `https://<reco-host>/api/v1/policy-subsystem/alert-inbox/table` |
| Fetch Devices | `https://<reco-host>/api/v1/asset-management` |
| Fetch Identity Account | `https://<reco-host>/api/v1/asset-management/query` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account User | `reco_account_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Alert | `reco_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Application | `reco_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Device | `reco_device` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Policy | `reco_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Reco Account | `reco_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Reco AI Agent | `reco_ai_agent` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Reco Identity Account | `reco_identity_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Reco Identity User | `reco_identity_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `reco_account` | **HAS** | `reco_account_user` |
| `reco_account` | **HAS** | `reco_ai_agent` |
| `reco_identity_account` | **HAS** | `reco_application` |
| `reco_identity_user` | **OWNS** | `reco_device` |
| `reco_identity_user` | **HAS** | `reco_identity_account` |
| `reco_policy` | **TRIGGERS** | `reco_alert` |

### Reco Account

`reco_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Reco Account User

`reco_account_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isSingleSignOn` | `boolean` |  |  |
| `lastLoggedInOn` | `number` |  |  |
| `roles` | `array` of `string`s |  |  |
| `ssoAppIds` | `array` of `string`s |  |  |

---

### Reco Ai Agent

`reco_ai_agent` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountsCount` | `number` | Number of accounts touched by the agent. |  |
| `agentType` | `string` | Reco-assigned agent kind (open string — e.g. OAuth app, automation, copilot). |  |
| `aiModel` | `string` | Underlying AI model the agent uses (e.g. gpt-4). The AIASM-33 `nhiAi` enricher may use this as an additional platform signal. |  |
| `appDisplayName` | `string` | Human-readable name of the AI agent application. |  |
| `appId` | `string` | Reco identifier for the AI agent. Mirrored on `clientId` to maximise the AIASM-33 enricher match surface. |  |
| `authorization` | `string` | Authorisation mechanism for the agent (open string — e.g. oauth, api\_key, service\_account). |  |
| `clientId` | `string` | Reco identifier for the AI agent (alias of `appId`). |  |
| `connections` | `number` | Number of other resources / SaaS apps the agent is connected to. |  |
| `instance` | `string` | Identifier of the connected SaaS instance the AI agent runs in (e.g. M365 tenant, Slack workspace). |  |
| `owner` | `string` | Identifier of the human owner Reco has associated with the agent (often an email address). |  |
| `risk` | `number` | Reco's risk score for the agent. |  |
| `tools` | `array` of `string`s | Tools and APIs the agent has access to. |  |
| `visibility` | `string` | Whether the agent is internal- or external-facing (open string). |  |

---

### Reco Alert

`reco_alert` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `extractionSource` | `string` |  |  |
| `instanceId` | `string` |  |  |
| `lastExtractedOn` | `number` |  |  |
| `lastScannedOn` | `number` |  |  |
| `tenantId` | `string` |  |  |
| `totalComments` | `number` |  |  |

---

### Reco Application

`reco_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appCreatedAt` | `number` |  |  |
| `appGroups` | `array` of `string`s |  |  |
| `applicationInstances` | `array` of `string`s |  |  |
| `applicationName` | `string` |  |  |
| `appOwner` | `array` of `string`s |  |  |
| `authorizationStatus` | `string` |  |  |
| `authTypes` | `array` of `string`s |  |  |
| `bkBreachIndex` | `number` |  |  |
| `bkBreachIndexLastUpdatedOn` | `number` |  |  |
| `bkCyberRating` | `number` |  |  |
| `bkCyberRatingLastUpdatedOn` | `number` |  |  |
| `bkGradeLetter` | `string` |  |  |
| `bkRansomwareIndex` | `number` |  |  |
| `bkRansomwareIndexLastUpdatedAt` | `number` |  |  |
| `category` | `string` |  |  |
| `companySize` | `string` |  |  |
| `firstUsedOn` | `number` |  |  |
| `isShadow` | `boolean` |  |  |
| `isSsoEnabled` | `boolean` |  |  |
| `lastThirtyDaysScore` | `number` |  |  |
| `lastUsedOn` | `number` |  |  |
| `logo` | `string` |  |  |
| `numberOfUsers` | `number` |  |  |
| `overrodeUsage` | `string` |  |  |
| `securityScore` | `number` |  |  |
| `securityScoreLetter` | `string` |  |  |
| `securityScoreUrl` | `string` |  |  |
| `tenantId` | `string` |  |  |
| `typeUsage` | `string` |  |  |
| `unusedApp` | `boolean` |  |  |
| `usesAI` | `boolean` |  |  |
| `vendor` | `string` |  |  |
| `website` | `string` |  |  |

---

### Reco Device

`reco_device` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| `hasIdentity` | `boolean` |  |  |
| `instanceId` | `string` |  |  |
| `isRegistered` | `boolean` |  |  |
| `lastApiMessageId` | `string` |  |  |
| `managementStatus` | `string` |  |  |

---

### Reco Identity Account

`reco_identity_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountType` | `string` |  |  |
| `adminLabel` | `string` |  |  |
| `adminLabelUpdatedAt` | `number` |  |  |
| `alerts30Days` | `number` |  |  |
| `alertsCount` | `number` |  |  |
| `deactivatedOn` | `number` |  |  |
| `domainType` | `string` |  |  |
| `email` | `string` |  |  |
| `hasMfa` | `boolean` |  |  |
| `instanceId` | `string` |  |  |
| `isActive` | `boolean` |  |  |
| `isAdmin` | `boolean` |  |  |
| `isGuest` | `boolean` |  |  |
| `isInternal` | `boolean` |  |  |
| `isPrivileged` | `boolean` |  |  |
| `isServiceAccount` | `boolean` |  |  |
| `isStandard` | `boolean` |  |  |
| `lastLoggedInOn` | `number` |  |  |
| `lastSeenOn` | `number` |  |  |
| `location` | `string` |  |  |
| `locationAnalysis` | `array` of `string`s |  |  |
| `numGroups` | `number` |  |  |
| `permissions` | `array` of `string`s |  |  |
| `permissionSets` | `array` of `string`s |  |  |
| `photo` | `string` |  |  |
| `relatedEmails` | `array` of `string`s |  |  |
| `roles` | `array` of `string`s |  |  |
| `tenantId` | `string` |  |  |
| `userTypeDisplay` | `string` |  |  |
| `workspaceId` | `string` |  |  |

---

### Reco Identity User

`reco_identity_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `alertsCount` | `number` |  |  |
| `appInstanceIds` | `array` of `string`s |  |  |
| `departments` | `array` of `string`s |  |  |
| `hasAccess` | `boolean` |  |  |
| `isFormerUser` | `boolean` |  |  |
| `jobTitles` | `array` of `string`s |  |  |
| `labelNames` | `array` of `string`s |  |  |
| `lastLoginOn` | `number` |  |  |
| `lastSeenOn` | `number` |  |  |
| `relatedAccountCount` | `number` |  |  |

---

### Reco Policy

`reco_policy` inherits from [Policy](/data-model/schemas/Policy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `openAlerts` | `number` |  |  |
| `policyType` | `string` |  |  |
| `riskLevel` | `string` |  |  |
| `sources` | `array` of `string`s |  |  |
| `status` | `string` |  |  |
| `tags` | `array` of `string`s |  |  |
| `totalAlerts` | `number` |  |  |

---

## Release Notes

-   **2025-06-11** — Added Reco identity user and identity account entity ingestion, with relationships linking users to accounts and applications, and devices to their owning users.
-   **2025-06-10** — Added initial Reco integration, ingesting users, policies, and alert entities with policy-to-alert trigger relationships.

---

Source: /integrations/directory/red-hat-quay

# Red Hat Quay

Visualize Red Hat Quay accounts and repositories, map Red Hat Quay users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create an OAuth Access key on Red Hat Quay. See [their documentation](https://access.redhat.com/documentation/en-us/red_hat_quay/3/html/red_hat_quay_api_guide/using_the_red_hat_quay_api#create_oauth_access_token) for more information.

### Configuration in JupiterOne

To install the Red Hat Quay integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Red Hat Quay. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Red Hat Quay account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Red Hat Quay **Hostname** and **Access Token** generated for use in JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `red_hat_quay_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Organization | `red_hat_quay_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| OrganizationMember | `red_hat_quay_organization_member` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Repository | `red_hat_quay_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| Team | `red_hat_quay_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `red_hat_quay_account` | **HAS** | `red_hat_quay_organization` |
| `red_hat_quay_organization` | **HAS** | `red_hat_quay_organization_member` |
| `red_hat_quay_organization` | **HAS** | `red_hat_quay_team` |
| `red_hat_quay_organization` | **HAS** | `red_hat_quay_repository` |
| `red_hat_quay_team` | **HAS** | `red_hat_quay_organization_member` |

---

Source: /integrations/directory/rippling

# Rippling

Visualize Rippling users, workers, and organizational structure, map workers to employees and managers, and monitor changes through queries and alerts.

## Installation

### Configuration In Rippling

For this integration, you will need to [generate an API Token in Rippling](https://developer.rippling.com/documentation/rest-api).

1.  Log in to your Rippling account.
2.  Navigate to Company Settings > Developer.
3.  Select the **API Tokens** tab.
4.  Create an API Token.
5.  Copy and securely save the generated API Token for use in JupiterOne.

> **INFO**
> 
> As described in the Rippling documentation, API tokens use the permissions of the owner, so they should be treated as if they were a password. The user must have sufficient permissions to create an API token and access user and worker data. API tokens expire after 30 days of inactivity, or when the user is no longer active with the company. You will need to regenerate the token if it expires.

### Configuration in JupiterOne

To complete the Rippling integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Rippling. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Rippling account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The Rippling **API Token** generated for use with JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Organization | `rippling_organization` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| User | `rippling_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Worker | `rippling_worker` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `rippling_organization` | **HAS** | `rippling_user` |
| `rippling_organization` | **HAS** | `rippling_worker` |
| `rippling_user` | **IS** | `rippling_worker` |
| `rippling_worker` | **MANAGES** | `rippling_worker` |

### Rippling Organization

`rippling_organization` inherits from [Account](/data-model/schemas/Account.md)

---

### Rippling User

`rippling_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `locale` | `string` |  |  |
| `number` | `string` |  |  |
| `preferredFamilyName` | `string` |  |  |
| `preferredGivenName` | `string` |  |  |
| `preferredLanguage` | `string` |  |  |
| `timezone` | `string` |  |  |

---

### Rippling Worker

`rippling_worker` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `country` | `string` |  |  |
| `departmentId` | `string` |  |  |
| `employmentTypeId` | `string` |  |  |
| `endedOn` | `number` |  |  |
| `isManager` | `boolean` |  |  |
| `legalEntityId` | `string` |  |  |
| `levelId` | `string` |  |  |
| `overtimeExemption` | `string` |  |  |
| `startedOn` | `number` |  |  |
| `status` | `string` |  | **Any of**:
-   `INIT`

-   `HIRED`

-   `ACCEPTED`

-   `ACTIVE`

-   `TERMINATED`

 |
| `teamsId` | `string` |  |  |
| `title` | `string` |  |  |
| `titleEffectiveOn` | `number` |  |  |

---

## Release Notes

-   **2025-10-23** — New Rippling integration: ingests users and workers with manager hierarchy relationships.

---

Source: /integrations/directory/rumble

# Rumble

Visualize runZero (previously called Rumble) organizations, users, and assets, map users to employees, discover vulnerable OS assets, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> For this integration, you can configure the runZero integration using either an Account API Key or a single Export Token. The Export Token has more limited read-only permissions which will limit the data that is collected in JupiterOne.

### Configuration in runZero

For this integration, you can configure the runZero integration using either an Account API Key or a single Export Token. The Export Token has more limited read-only permissions which will limit the data that is collected in JupiterOne.

### API Key method

This method is recommended for instances where there are multiple organizations that you wish to ingest data into JupiterOne. It also provides a larger set of ingested entities than solely using an Export Token. You must have a runZero Enterprise License to utilize this method.

To configure this integration via API key, follow the below instructions:

#### Account API Key Generation

1.  Navigate to the [runZero Console](https://console.runzero.com).
2.  In the navigation bar, go to `Account`.
3.  On the Account page under the Account API keys section, click **Generate API Key**.
4.  A new **Account API Key** will be created. Copy this key as it will be used in JupiterOne.

#### Export Token Generation

Next, you'll need to generate an export token for each organization whose assets, services, and wireless data you want to include in the JupiterOne graph. The integration will automatically collect these tokens if they are present. Organizations _without_ export tokens _will not_ have assets, services, or wireless data ingested.

1.  Navigate to the [runZero Console](https://console.runzero.com)
2.  In the navigation bar, go to `Organizations`
3.  Click on the organization in which you want to create an `Export Token`
4.  Press the **Generate Export Token** button.
5.  Repeat for all organizations whose data you want to ingest.

### Export Token method

This method is typically suggested if there is only a single organization for which you intend to populate data into JupiterOne.

If you wish to utilize an Export Token rather than use API credentials, ensure that you have admin access to the runZero organization and follow the below steps for obtaining your Export Token for use with JupiterOne.

**To generate the Export Token:**

1.  Navigate to the [runZero Console](https://console.runzero.com)
2.  In the navigation bar, go to `Organizations`
3.  Click on the organization in which you want to create an `Export Token`
4.  Press the **Generate Export Token** button.
5.  Copy your `Export Token` for use in JupiterOne

### Configuration in JupiterOne

To install the runZero integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select runZero. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the runZero account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Lastly, depending on your authentication preference, input either of the following credentials:
    
    -   For configuring the integration with an Account API Key then put the key in the runZero **Account API Key** field.
    -   For configuring the integration with an Export Token, provide the token in the **Export Token** field.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `rumble_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Asset | `rumble_asset` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Organization | `rumble_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Site | `rumble_site` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| User | `rumble_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `rumble_account` | **HAS** | `rumble_organization` |
| `rumble_account` | **HAS** | `rumble_user` |
| `rumble_account` | **HAS** | `rumble_site` |
| `rumble_organization` | **HAS** | `rumble_site` |
| `rumble_site` | **HAS** | `rumble_asset` |
| `rumble_user` | **ASSIGNED** | `rumble_organization` |

### Rumble Account

`rumble_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Rumble Asset

`rumble_asset` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `alive` | `boolean` |  |  |
| `createdAt` | `number` |  |  |
| `detectedBy` | `string` | **Examples**: icmp |  |
| `firstSeen` | `number` |  |  |
| `hardware` | `string` | **Examples**: Dell PowerEdge 2500 |  |
| `ipAddress` | `array` of `string`s |  | **Examples**: 192.158.1.38 |
| `ipAddresses` | `array` of `string`s |  | **Examples**: 192.158.1.38 |
| `lastAgentId` | `string` |  |  |
| `lastSeen` | `number` |  |  |
| `lastTaskId` | `string` |  |  |
| `macAddress` | `array` of `string`s |  | **Examples**: 11:22:33:44:55:66 |
| `newestMacAddress` | `string` |  |  |
| `newestMacVendor` | `string` | **Examples**: Intel Corporate |  |
| `orgName` | `string` |  |  |
| `osVendor` | `string` |  |  |
| `scanned` | `boolean` |  |  |
| `serviceCount` | `number` |  |  |
| `siteName` | `string` | **Examples**: Primary |  |
| `softwareCount` | `number` |  |  |
| `type` | `string` | **Examples**: Server |  |
| `updatedAt` | `number` |  |  |
| `vulnerabilityCount` | `number` |  |  |

---

### Rumble Organization

`rumble_organization` inherits from [Organization](/data-model/schemas/Organization.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetCount` \*

 | `number` |  |  |
| 

`clientId` \*

 | `string` |  | 

**Format**: `uuid`

  
 |
| `createdAt` | `number` |  |  |
| `deactivatedAt` | `number` |  |  |
| 

`demo` \*

 | `boolean` | Whether the organization is a demo org |  |
| `description` | `string` |  |  |
| `downloadTokenCreatedAt` | `number` |  |  |
| `expirationAssetsOffline` | `number` |  |  |
| `expirationAssetsStale` | `number` |  |  |
| `expirationScans` | `number` |  |  |
| `expirationWarningLastSent` | `number` |  |  |
| `exportTokenCounter` | `number` |  |  |
| `exportTokenCreatedAt` | `number` |  |  |
| `exportTokenLastUsedAt` | `number` |  |  |
| `exportTokenLastUsedBy` | `string` | **Examples**: 127.0.0.1 |  |
| 

`inactive` \*

 | `boolean` |  |  |
| 

`liveAssetCount` \*

 | `number` |  |  |
| 

`parentId` \*

 | `string` |  | 

**Format**: `uuid`

  
 |
| 

`project` \*

 | `boolean` |  |  |
| 

`recentAssetCount` \*

 | `number` |  |  |
| 

`serviceCount` \*

 | `number` |  |  |
| 

`serviceCountARP` \*

 | `number` |  |  |
| 

`serviceCountICMP` \*

 | `number` |  |  |
| 

`serviceCountTCP` \*

 | `number` |  |  |
| 

`serviceCountUDP` \*

 | `number` |  |  |
| 

`softwareCount` \*

 | `number` |  |  |
| `updatedAt` | `number` |  |  |
| 

`vulnerabilityCount` \*

 | `number` |  |  |

---

### Rumble Site

`rumble_site` inherits from [Site](/data-model/schemas/Site.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetAddressCount` | `number` |  |  |
| `assetAddressExtraCount` | `number` |  |  |
| `assetCount` | `number` |  |  |
| `clientId` | `string` |  |  |
| `createdAt` | `number` |  |  |
| `deactivatedAt` | `number` |  |  |
| `excludes` | `string` | **Examples**: "192.168.0.5" |  |
| `inactive` | `boolean` |  |  |
| `lastTaskAt` | `number` |  |  |
| `lastTaskBy` | `string` |  |  |
| `lastTaskDuration` | `number` |  |  |
| `lastTaskId` | `string` |  |  |
| `liveAssetCount` | `number` |  |  |
| `organizationId` | `string` |  |  |
| `recentAssetCount` | `number` |  |  |
| `scope` | `string` |  |  |
| `serviceCount` | `number` |  |  |
| `serviceCountARP` | `number` |  |  |
| `serviceCountICMP` | `number` |  |  |
| `serviceCountTCP` | `number` |  |  |
| `serviceCountUDP` | `number` |  |  |
| `softwareCount` | `number` |  |  |
| `updatedAt` | `number` |  |  |
| `vulnerabilityCount` | `number` |  |  |

---

### Rumble User

`rumble_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `actions` | `number` |  |  |
| 
`admin` \*

 | `boolean` | Derived by client\_admin or org\_default\_role properties from |  |
| `inviteTokenExpiration` | `number` |  |  |
| `lastActionAt` | `number` |  |  |
| `lastActivityAt` | `number` |  |  |
| `lastLoginAt` | `number` |  |  |
| `lastLoginIP` | `string` |  |  |
| `lastLoginUa` | `string` | **Examples**: curl/1.0 |  |
| `loginFailures` | `number` |  |  |
| `orgDefaultRole` | `string` |  |  |
| `resetTokenExpiration` | `number` |  |  |
| `ssoOnly` | `boolean` |  |  |

---

---

Source: /integrations/directory/sailpoint-iiq

# Sailpoint IdentityIQ

Visualize Sailpoint IdentityIQ accounts, users, applications, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need your SailPoint IdentityIQ instance hostname, and a service account username and password with read access to the SCIM v2 API to set up this integration.

### Configuration in SailPoint IdentityIQ

Before configuring this integration in JupiterOne, you need to create API credentials in SailPoint IdentityIQ:

**Required in SailPoint IdentityIQ:**

-   Your SailPoint IdentityIQ instance hostname
-   A service account username and password for API access
-   The service account must have read access to the SCIM v2 API endpoints

**Authentication:** This integration uses HTTP Basic authentication to connect to the SailPoint IdentityIQ SCIM v2 API.

**API Endpoints Used:** The integration accesses the following SCIM v2 endpoints:

-   `/identity/scim/v2/Users` - to retrieve user data
-   `/identity/scim/v2/Accounts` - to retrieve account data
-   `/identity/scim/v2/Applications` - to retrieve application data

**Permissions:** The service account needs read-only access to users, accounts, and applications through the SCIM API. We recommend creating a dedicated service account for JupiterOne rather than using an administrator's personal credentials.

### Configuration in JupiterOne

To install the Sailpoint IdentityIQ integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Sailpoint IdentityIQ. Click **New Instance** to begin configuring your integration, providing the following:

-   **Account Name** used to identify the Sailpoint IdentityIQ account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **AccountName** option is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Hostname** of your Sailpoint IdentityIQ organization.
    
-   **Username** used to authenticate with Sailpoint IdentityIQ.
    
-   **Password** associated with the username.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `sailpoint_iiq_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `sailpoint_iiq_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| User | `sailpoint_iiq_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sailpoint_iiq_account` | **HAS** | `sailpoint_iiq_application` |
| `sailpoint_iiq_account` | **HAS** | `sailpoint_iiq_user` |

### Sailpoint Iiq Account

`sailpoint_iiq_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `hasEntitlements` | `boolean` |  |  |
| `instance` | `string` |  |  |
| `lastRefresh` | `number` |  |  |
| `lastTargetAggregation` | `number` |  |  |
| `locked` | `boolean` |  |  |
| `manuallyCorrelated` | `boolean` |  |  |
| `nativeIdentity` | `string` |  |  |
| `uuid` | `string` |  |  |

---

### Sailpoint Iiq Application

`sailpoint_iiq_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `type` | `string` |  |  |

---

### Sailpoint Iiq User

`sailpoint_iiq_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `capabilities` | `array` of `string`s |  |  |
| `department` | `string` |  |  |
| `employeeId` | `string` |  |  |
| `isManager` | `boolean` |  |  |
| `jobTitle` | `string` |  |  |
| `location` | `string` |  |  |
| `region` | `string` |  |  |
| `riskScore` | `number` |  |  |
| `sailpoint_iiq_user` | `boolean` |  |  |
| `userType` | `string` |  |  |

---

---

Source: /integrations/directory/sailpoint-isc

# SailPoint Identity Security Cloud (IdentityNow)

Visualize your SailPoint Identity Security Cloud tenant in the JupiterOne graph — the identities ISC correlates across every connected source, the sources themselves, and the access model of roles, access profiles and entitlements built on top of them. Each source account is linked to the identity it correlates to, so a person can be traced to every account they hold, and uncorrelated orphan accounts stand out. Governance groups, identity profiles, separation-of-duties policies and certification campaigns are ingested alongside, letting you query privileged entitlements, role assignments and certification coverage, and monitor changes through queries and alerts.

## Installation

### Prerequisites

-   A **SailPoint Identity Security Cloud** tenant. ISC was previously branded IdentityNow; the separate [SailPoint IdentityIQ](/integrations/directory/sailpoint-iiq.md) integration covers the on-premise IdentityIQ product instead.
-   A **Personal Access Token** (Client ID and Client Secret) created by a user whose user level covers the data you want to ingest.
-   Access to **JupiterOne** with permission to configure integrations.

### Create a Personal Access Token

The integration authenticates using **OAuth 2.0 (client credentials)**, exchanging a Personal Access Token for a bearer token against `https://{tenant}.api.identitynow.com/oauth/token`.

To create the token:

1.  Sign in to `https://{tenant}.identitynow.com`.
2.  Open the user menu and go to **Preferences → Personal Access Tokens**.
3.  Select **New Token** and give it a name that identifies JupiterOne.
4.  Copy the **Client ID** and **Client Secret**. The secret is shown only once.

The token inherits the authority of the user who created it, so create it as a user whose level covers the collections you intend to ingest.

The integration issues read-only requests.

> **NOTE**
> 
> ISC grants API authority by **user level** — `ORG_ADMIN`, `SOURCE_ADMIN`, `SOURCE_SUBADMIN`, `CERT_ADMIN`, `HELPDESK` and so on — rather than by granular scope, and the level required differs per endpoint. `ORG_ADMIN` covers everything this integration reads. A token created by a narrower user level still works: the collections it cannot read are skipped with a warning on the job, and the rest are ingested normally. See the [Authorization](/integrations/directory/sailpoint-isc.md?integration-docs=authorization) tab for the user levels, scopes and endpoints each step uses.

### Configure the integration in JupiterOne

To install the SailPoint Identity Security Cloud integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **SailPoint Identity Security Cloud (IdentityNow)**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the SailPoint Identity Security Cloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Personal Access Token** fields below.
    

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **API URL** | Yes | Your ISC API host — for example `https://acme.api.identitynow.com`. |
| **Client ID** | Yes | Client ID of the Personal Access Token. |
| **Client Secret** | Yes | Client Secret paired with the Client ID. Shown only once when the token is created. |

Click **Create** once all values are provided to finalize the integration.

> **NOTE**
> 
> The **API URL** is the `api.` host, not the tenant UI URL. The tenant name alone (`acme`) and the UI host (`acme.identitynow.com`) are both accepted and converted to the API host for you, as are trailing slashes and a pasted `/v2025` suffix. The scheme is always set to `https`, since the token secret is sent in the request body.

#### Data sources

You can narrow what the integration collects from the instance's ingestion source settings.

| Ingestion source | Default | Data collected |
| --- | --- | --- |
| **Identities** | Enabled | ISC identities — the correlated representation of each person across every connected source — and their manager hierarchy. |
| **Sources** | Enabled | Connected systems aggregated by ISC, such as Active Directory or Workday, with connector, health and owner detail. |
| **Identity Profiles** | Enabled | Configuration that maps an authoritative source into identities, and the source each profile derives from. |
| **Governance Groups** | Enabled | Governance groups (workgroups) and their identity membership, used to assign shared ownership and approval duties. |
| **Access Profiles** | Enabled | Access profiles, which bundle entitlements drawn from a single source, and their source and owner. |
| **Roles** | Enabled | Business roles, the access profiles they bundle, their owners, and the identities assigned to them. |
| **Separation of Duties Policies** | Enabled | Separation-of-duties policies defining combinations of access that must not be held together. |
| **Certification Campaigns** | Enabled | Access certification campaigns and their completion progress. |
| **Entitlements** | Disabled | Fine-grained access grants on each connected source, such as Active Directory group memberships, including which are flagged privileged. |
| **Source Accounts** | Disabled | Accounts on each connected source and their correlation to identities. |
| **Account Entitlement Grants** | Disabled | Which entitlements each source account actually holds. |

The three disabled sources are the large ones. A sizeable ISC tenant holds over a million entitlements and several million accounts, so they are opt-in rather than on by default.

**Account Entitlement Grants** is the most expensive to enable: ISC exposes an account's entitlements only one account at a time, so it costs one API request per account. It requires both **Source Accounts** and **Entitlements** to be enabled, and it covers at most 500,000 accounts in a single run — if your tenant has more, the job records that the limit was reached.

**Entitlements** requires **Sources** to be enabled, because entitlements are collected source by source.

Relationships that span two of these sources are only created when both are enabled. Disabling **Identities**, for example, does not stop sources, roles or access profiles being collected — it removes the edges that connect them to identities.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [SailPoint API authentication](https://developer.sailpoint.com/docs/api/authentication/) — creating a Personal Access Token and the client credentials flow
-   [Identity Security Cloud V2025 API](https://developer.sailpoint.com/docs/api/v2025/) — the API version this integration reads
-   [Standard collection parameters](https://developer.sailpoint.com/docs/api/standard-collection-parameters/) — paging, filtering and sorting behaviour

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (7)

-   `CERT_ADMIN`
-   `HELPDESK`
-   `ORG_ADMIN`
-   `REPORT_ADMIN`
-   `ROLE_SUBADMIN`
-   `SOURCE_ADMIN`
-   `SOURCE_SUBADMIN`

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (10)

-   `idn:accounts:read`
-   `idn:campaign:read`
-   `idn:entitlement:read`
-   `idn:identity:read`
-   `idn:role-checked:read`
-   `idn:role-unchecked:read`
-   `idn:sod-policy:read`
-   `idn:sources:read`
-   `idn:workgroup:read`
-   `sp:tenant:read`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (14)

-   `GET /v2025/access-profiles`
-   `GET /v2025/accounts`
-   `GET /v2025/campaigns`
-   `GET /v2025/entitlements`
-   `GET /v2025/entitlements?account-id={id}`
-   `GET /v2025/identities`
-   `GET /v2025/identity-profiles`
-   `GET /v2025/roles`
-   `GET /v2025/roles/{id}/assigned-identities`
-   `GET /v2025/sod-policies`
-   `GET /v2025/sources`
-   `GET /v2025/tenant`
-   `GET /v2025/workgroups`
-   `GET /v2025/workgroups/{workgroupId}/members`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (14)

-   [https://developer.sailpoint.com/docs/api/authentication/](https://developer.sailpoint.com/docs/api/authentication/)
-   [https://developer.sailpoint.com/docs/api/v2025/get-active-campaigns](https://developer.sailpoint.com/docs/api/v2025/get-active-campaigns)
-   [https://developer.sailpoint.com/docs/api/v2025/get-role-assigned-identities](https://developer.sailpoint.com/docs/api/v2025/get-role-assigned-identities)
-   [https://developer.sailpoint.com/docs/api/v2025/get-tenant](https://developer.sailpoint.com/docs/api/v2025/get-tenant)
-   [https://developer.sailpoint.com/docs/api/v2025/list-access-profiles](https://developer.sailpoint.com/docs/api/v2025/list-access-profiles)
-   [https://developer.sailpoint.com/docs/api/v2025/list-accounts](https://developer.sailpoint.com/docs/api/v2025/list-accounts)
-   [https://developer.sailpoint.com/docs/api/v2025/list-entitlements](https://developer.sailpoint.com/docs/api/v2025/list-entitlements)
-   [https://developer.sailpoint.com/docs/api/v2025/list-identities](https://developer.sailpoint.com/docs/api/v2025/list-identities)
-   [https://developer.sailpoint.com/docs/api/v2025/list-identity-profiles](https://developer.sailpoint.com/docs/api/v2025/list-identity-profiles)
-   [https://developer.sailpoint.com/docs/api/v2025/list-roles](https://developer.sailpoint.com/docs/api/v2025/list-roles)
-   [https://developer.sailpoint.com/docs/api/v2025/list-sod-policies](https://developer.sailpoint.com/docs/api/v2025/list-sod-policies)
-   [https://developer.sailpoint.com/docs/api/v2025/list-sources](https://developer.sailpoint.com/docs/api/v2025/list-sources)
-   [https://developer.sailpoint.com/docs/api/v2025/list-workgroup-members](https://developer.sailpoint.com/docs/api/v2025/list-workgroup-members)
-   [https://developer.sailpoint.com/docs/api/v2025/list-workgroups](https://developer.sailpoint.com/docs/api/v2025/list-workgroups)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (9)

| Step | Roles | OAuth Scopes | Endpoints |
| --- | --- | --- | --- |
| Build Access Profile Entitlement Relationships | `ORG_ADMIN`, `ROLE_SUBADMIN`, `SOURCE_SUBADMIN` | \- | `GET /v2025/access-profiles` |
| Build Access Profile Relationships | `ORG_ADMIN`, `ROLE_SUBADMIN`, `SOURCE_SUBADMIN` | \- | `GET /v2025/access-profiles` |
| Build Account Entitlement Relationships | \- | `idn:entitlement:read` | `GET /v2025/entitlements?account-id={id}` |
| Build Governance Group Membership | `ORG_ADMIN` | `idn:workgroup:read` | `GET /v2025/workgroups/{workgroupId}/members` |
| Build Identity Profile Relationships | `ORG_ADMIN` | \- | `GET /v2025/identity-profiles` |
| Build Role Entitlement Relationships | \- | `idn:role-unchecked:read`, `idn:role-checked:read` | `GET /v2025/roles` |
| Build Role Relationships | \- | `idn:role-unchecked:read`, `idn:role-checked:read` | `GET /v2025/roles`, `GET /v2025/roles/{id}/assigned-identities` |
| Build Source Relationships | \- | `idn:sources:read` | `GET /v2025/sources` |
| Fetch Entitlements | \- | `idn:entitlement:read` | `GET /v2025/entitlements` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| AccessProfile | `sailpoint_isc_access_profile` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Account | `sailpoint_isc_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Campaign | `sailpoint_isc_campaign` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Entitlement | `sailpoint_isc_entitlement` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| GovernanceGroup | `sailpoint_isc_governance_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Identity | `sailpoint_isc_identity` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| IdentityProfile | `sailpoint_isc_identity_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Role | `sailpoint_isc_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| SodPolicy | `sailpoint_isc_sod_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Source | `sailpoint_isc_source` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| SourceAccount | `sailpoint_isc_source_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sailpoint_isc_access_profile` | **HAS** | `sailpoint_isc_entitlement` |
| `sailpoint_isc_account` | **HAS** | `sailpoint_isc_source` |
| `sailpoint_isc_account` | **HAS** | `sailpoint_isc_identity_profile` |
| `sailpoint_isc_account` | **HAS** | `sailpoint_isc_governance_group` |
| `sailpoint_isc_account` | **HAS** | `sailpoint_isc_sod_policy` |
| `sailpoint_isc_account` | **HAS** | `sailpoint_isc_campaign` |
| `sailpoint_isc_governance_group` | **HAS** | `sailpoint_isc_identity` |
| `sailpoint_isc_identity` | **MANAGES** | `sailpoint_isc_identity` |
| `sailpoint_isc_identity` | **OWNS** | `sailpoint_isc_source` |
| `sailpoint_isc_identity` | **OWNS** | `sailpoint_isc_access_profile` |
| `sailpoint_isc_identity` | **OWNS** | `sailpoint_isc_role` |
| `sailpoint_isc_identity` | **ASSIGNED** | `sailpoint_isc_role` |
| `sailpoint_isc_identity` | **OWNS** | `sailpoint_isc_entitlement` |
| `sailpoint_isc_identity` | **HAS** | `sailpoint_isc_source_account` |
| `sailpoint_isc_identity_profile` | **USES** | `sailpoint_isc_source` |
| `sailpoint_isc_role` | **HAS** | `sailpoint_isc_access_profile` |
| `sailpoint_isc_role` | **HAS** | `sailpoint_isc_entitlement` |
| `sailpoint_isc_source` | **HAS** | `sailpoint_isc_entitlement` |
| `sailpoint_isc_source` | **HAS** | `sailpoint_isc_access_profile` |
| `sailpoint_isc_source` | **HAS** | `sailpoint_isc_source_account` |
| `sailpoint_isc_source_account` | **ASSIGNED** | `sailpoint_isc_entitlement` |

### Sailpoint Isc Access Profile

`sailpoint_isc_access_profile` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`entitlementCount` \*

 | `number` **|** `null` | The number of entitlements bundled by the access profile. A count rather than a reference: the entitlements themselves are modelled as relationships, and this stays accurate even when the entitlements step is disabled. |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` | Whether the access profile is enabled. A disabled profile grants nothing even where it is assigned. |  |
| 

`isRequestable` \*

 | `boolean` **|** `null` | Whether the access profile can be requested through access request. |  |
| 

`ownerName` \*

 | `string` **|** `null` | The display name of the access profile owner. The owning identity is expressed by the OWNS relationship. |  |
| 

`segmentIds` \*

 | `array` **|** `null` | The IDs of the access segments this access profile is assigned to. |  |
| 

`sourceName` \*

 | `string` **|** `null` | The display name of the access profile source. |  |

---

### Sailpoint Isc Account

`sailpoint_isc_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`apiUrl` \*

 | `string` | The API base URL used to collect from this tenant. |  |
| 

`pod` \*

 | `string` **|** `null` | The SailPoint deployment pod hosting the tenant (e.g. 'stg01-useast1'). |  |
| 

`region` \*

 | `string` **|** `null` | The SailPoint deployment region hosting the tenant (e.g. 'us-east-1'). |  |
| 

`tenantId` \*

 | `string` **|** `null` | The unique identifier of the ISC tenant. |  |
| 

`tenantName` \*

 | `string` **|** `null` | The abbreviated tenant name, which is the tenant slug in the API hostname (e.g. 'acme' in acme.api.identitynow.com). |  |

---

### Sailpoint Isc Campaign

`sailpoint_isc_campaign` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`campaignStatus` \*

 | `string` **|** `null` | The campaign status: PENDING, STAGED, CANCELING, ACTIVATING, ACTIVE, COMPLETING, COMPLETED, ERROR, or ARCHIVED. |  |
| 

`campaignType` \*

 | `string` **|** `null` | The campaign type: MANAGER, SOURCE\_OWNER, SEARCH, ROLE\_COMPOSITION, or MACHINE\_ACCOUNT. |  |
| 

`completedCertifications` \*

 | `number` **|** `null` | The number of certifications in the campaign that reviewers have signed off. |  |
| 

`correlatedStatus` \*

 | `string` **|** `null` | Whether the campaign covers correlated or uncorrelated accounts. Only SOURCE\_OWNER campaigns can be UNCORRELATED. |  |
| 

`deadlineOn` \*

 | `number` **|** `null` | The completion deadline for the campaign. |  |
| 

`isAutoRevokeAllowed` \*

 | `boolean` **|** `null` | Whether access is revoked automatically when a reviewer fails to act before the deadline. |  |
| 

`isEmailNotificationEnabled` \*

 | `boolean` **|** `null` | Whether reviewers are emailed about the campaign. |  |
| 

`isRecommendationsEnabled` \*

 | `boolean` **|** `null` | Whether SailPoint AI-driven identity security recommendations are shown to reviewers. |  |
| 

`isSunsetCommentsRequired` \*

 | `boolean` **|** `null` | Whether reviewers must comment when they change a sunset date. |  |
| 

`mandatoryCommentRequirement` \*

 | `string` **|** `null` | Which review decisions require a comment (e.g. all decisions, revoke-only, or none). |  |
| 

`totalCertifications` \*

 | `number` **|** `null` | The total number of certifications in the campaign. |  |

---

### Sailpoint Isc Entitlement

`sailpoint_isc_entitlement` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`attribute` \*

 | `string` **|** `null` | The source schema attribute the entitlement is carried on (e.g. 'memberOf'). |  |
| 

`isCloudGoverned` \*

 | `boolean` **|** `null` | Whether the entitlement is governed by ISC rather than only by the source system. |  |
| 

`isPrivileged` \*

 | `boolean` **|** `null` | Whether ISC flags this entitlement as privileged. This is the primary signal for locating privileged access across all connected sources. |  |
| 

`isRequestable` \*

 | `boolean` **|** `null` | Whether the entitlement can be requested directly through access request. |  |
| 

`ownerId` \*

 | `string` **|** `null` | The ISC identity ID of the entitlement owner. Retained alongside the OWNS relationship because that relationship is built on a later pass over persisted entities. |  |
| 

`ownerName` \*

 | `string` **|** `null` | The display name of the entitlement owner. The owning identity is expressed by the OWNS relationship. |  |
| 

`segmentIds` \*

 | `array` **|** `null` | The IDs of the access segments this entitlement is assigned to. Segments are not ingested as entities, so the ids stay queryable here. |  |
| 

`sourceName` \*

 | `string` **|** `null` | The display name of the source that owns the entitlement. |  |
| 

`sourceSchemaObjectType` \*

 | `string` **|** `null` | The object type of the entitlement in the source schema (e.g. 'group'). |  |
| 

`value` \*

 | `string` **|** `null` | The raw entitlement value on the source (e.g. an Active Directory group distinguished name). |  |

---

### Sailpoint Isc Governance Group

`sailpoint_isc_governance_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`connectionCount` \*

 | `number` **|** `null` | The number of objects (sources, roles, policies) that reference the group as an owner or approver. |  |
| 

`memberCount` \*

 | `number` **|** `null` | The number of identities that belong to the group. |  |
| 

`ownerId` \*

 | `string` **|** `null` | The ISC identity ID of the governance group owner. |  |
| 

`ownerName` \*

 | `string` **|** `null` | The display name of the governance group owner. |  |

---

### Sailpoint Isc Identity

`sailpoint_isc_identity` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`country` \*

 | `string` **|** `null` | The identity's country, read from the tenant's `country` identity attribute when present. |  |
| 

`department` \*

 | `string` **|** `null` | The identity's department, read from the tenant's `department` identity attribute when present. |  |
| 

`identityStatus` \*

 | `string` **|** `null` | The identity's registration status in ISC: UNREGISTERED, REGISTERED, PENDING, WARNING, DISABLED, ACTIVE, DEACTIVATED, TERMINATED, ERROR, or LOCKED. |  |
| 

`isLifecycleStateManuallySet` \*

 | `boolean` **|** `null` | Whether the identity's lifecycle state was set manually rather than derived automatically. |  |
| 

`isManager` \*

 | `boolean` **|** `null` | Whether this identity is the manager of another identity. |  |
| 

`jobTitle` \*

 | `string` **|** `null` | The identity's job title, read from the tenant's `jobTitle` identity attribute when present. |  |
| 

`lastRefreshedOn` \*

 | `number` **|** `null` | When ISC last refreshed this identity from its authoritative source. |  |
| 

`lifecycleStateName` \*

 | `string` **|** `null` | The name of the identity's current lifecycle state (e.g. 'active', 'terminated'). Lifecycle states are tenant-defined. |  |
| 

`location` \*

 | `string` **|** `null` | The identity's location, read from the tenant's `location` identity attribute when present. |  |
| 

`managerId` \*

 | `string` **|** `null` | The ISC identity ID of this identity's manager. Retained alongside the MANAGES relationship because the relationship is built on a second pass over persisted entities. |  |
| 

`managerName` \*

 | `string` **|** `null` | The display name of this identity's manager. |  |
| 

`processingState` \*

 | `string` **|** `null` | The identity's processing state as reported by ISC: ERROR or OK. |  |

---

### Sailpoint Isc Identity Profile

`sailpoint_isc_identity_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`authoritativeSourceName` \*

 | `string` **|** `null` | The display name of the authoritative source this profile derives identities from. |  |
| 

`hasTimeBasedAttribute` \*

 | `boolean` **|** `null` | Whether the profile has a time-based attribute, which forces periodic refreshes. |  |
| 

`identityCount` \*

 | `number` **|** `null` | The number of identities belonging to this profile. |  |
| 

`isIdentityRefreshRequired` \*

 | `boolean` **|** `null` | Whether a source change has left this profile needing an identity refresh. |  |
| 

`ownerId` \*

 | `string` **|** `null` | The ISC identity ID of the identity profile owner. |  |
| 

`ownerName` \*

 | `string` **|** `null` | The display name of the identity profile owner. |  |
| 

`priority` \*

 | `number` **|** `null` | The evaluation priority of the profile. Lower values win when an account matches more than one profile. |  |

---

### Sailpoint Isc Role

`sailpoint_isc_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessProfileCount` \*

 | `number` **|** `null` | The number of access profiles bundled by the role. A count rather than a reference: the access profiles themselves are modelled as relationships. |  |
| 

`entitlementCount` \*

 | `number` **|** `null` | The number of entitlements granted directly by the role. A count rather than a reference: the entitlements themselves are modelled as relationships. |  |
| 

`isDimensional` \*

 | `boolean` **|** `null` | Whether the role is dimensional, meaning its grants vary by dimension rather than being fixed. |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` | Whether the role is enabled. A disabled role grants nothing even where it is assigned. |  |
| 

`isRequestable` \*

 | `boolean` **|** `null` | Whether the role can be requested through access request. |  |
| 

`membershipType` \*

 | `string` **|** `null` | How role membership is determined: 'STANDARD' (criteria-based) or 'IDENTITY\_LIST' (explicit list). |  |
| 

`ownerName` \*

 | `string` **|** `null` | The display name of the role owner. The owning identity is expressed by the OWNS relationship. |  |
| 

`privilegeLevel` \*

 | `string` **|** `null` | The privilege level assigned to the role, when the tenant classifies roles by privilege. |  |
| 

`segmentIds` \*

 | `array` **|** `null` | The IDs of the access segments this role is assigned to. |  |

---

### Sailpoint Isc Sod Policy

`sailpoint_isc_sod_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`compensatingControls` \*

 | `string` **|** `null` | Mitigating controls documented for identities that violate the policy. |  |
| 

`correctionAdvice` \*

 | `string` **|** `null` | Guidance shown to reviewers on how to remediate a violation of this policy. |  |
| 

`externalPolicyReference` \*

 | `string` **|** `null` | A reference to the corresponding policy in an external governance system. |  |
| 

`isEnforced` \*

 | `boolean` **|** `null` | Whether the policy is enforced. A policy in NOT\_ENFORCED state is evaluated but does not block access. |  |
| 

`isScheduled` \*

 | `boolean` **|** `null` | Whether the policy has a scheduled violation report configured. |  |
| 

`ownerId` \*

 | `string` **|** `null` | The ISC identity or governance group ID of the policy owner. |  |
| 

`ownerName` \*

 | `string` **|** `null` | The display name of the policy owner. |  |
| 

`ownerType` \*

 | `string` **|** `null` | The type of the policy owner: 'IDENTITY' or 'GOVERNANCE\_GROUP'. |  |
| 

`policyQuery` \*

 | `string` **|** `null` | The search query defining the policy, for query-based policies. |  |
| 

`policyTags` \*

 | `array` **|** `null` | Tags applied to the policy in ISC. Named `policyTags` because `tags` on the base entity carries JupiterOne tags. |  |
| 

`policyType` \*

 | `string` **|** `null` | How the policy expresses conflict: 'GENERAL' (search-query based) or 'CONFLICTING\_ACCESS\_BASED' (two access sets). |  |

---

### Sailpoint Isc Source

`sailpoint_isc_source` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`clusterId` \*

 | `string` **|** `null` | The identifier of the virtual appliance cluster that services the source. |  |
| 

`clusterName` \*

 | `string` **|** `null` | The name of the virtual appliance cluster that services the source. |  |
| 

`connectionType` \*

 | `string` **|** `null` | The connection type: 'direct' or 'file'. |  |
| 

`connector` \*

 | `string` **|** `null` | The connector script name used to reach the source. |  |
| 

`connectorId` \*

 | `string` **|** `null` | The identifier of the connector used by the source. |  |
| 

`connectorName` \*

 | `string` **|** `null` | The display name of the connector chosen at source creation. |  |
| 

`deleteThreshold` \*

 | `number` **|** `null` | The percentage of deleted accounts (0-100) above which ISC skips the delete phase of aggregation. |  |
| 

`features` \*

 | `array` **|** `null` | Optional capabilities supported by the source (e.g. 'AUTHENTICATE', 'PROVISIONING', 'PASSWORD', 'SEARCH'). |  |
| 

`healthCheckedOn` \*

 | `number` **|** `null` | When the source health check was last performed. |  |
| 

`healthStatus` \*

 | `string` **|** `null` | The detailed source health status (e.g. 'SOURCE\_STATE\_HEALTHY', 'SOURCE\_STATE\_ERROR\_VA'). |  |
| 

`isAuthoritative` \*

 | `boolean` **|** `null` | Whether the source is authoritative, meaning an identity profile derives identities from it. |  |
| 

`isCredentialProviderEnabled` \*

 | `boolean` **|** `null` | Whether a credential provider is enabled for the source. |  |
| 

`isHealthy` \*

 | `boolean` **|** `null` | Whether the source passed its most recent ISC health check. |  |
| 

`managementWorkgroupId` \*

 | `string` **|** `null` | The identifier of the governance group that manages the source. |  |
| 

`managementWorkgroupName` \*

 | `string` **|** `null` | The name of the governance group that manages the source. |  |
| 

`ownerName` \*

 | `string` **|** `null` | The display name of the source owner. The owning identity is expressed by the OWNS relationship. |  |
| 

`sourceCategory` \*

 | `string` **|** `null` | The source category as reported by ISC (e.g. 'CredentialProvider'). Named `sourceCategory` because `category` is not part of the Application class. |  |
| 

`sourceType` \*

 | `string` **|** `null` | The managed system type (e.g. 'Active Directory', 'Workday'). |  |

---

### Sailpoint Isc Source Account

`sailpoint_isc_source_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountUuid` \*

 | `string` **|** `null` | The account UUID as determined by the source account schema. |  |
| 

`cloudLifecycleState` \*

 | `string` **|** `null` | The lifecycle state of the correlated identity. |  |
| 

`connectionType` \*

 | `string` **|** `null` | The connection type of the source this account came from. |  |
| 

`hasEntitlements` \*

 | `boolean` **|** `null` | Whether the account holds any entitlements. |  |
| 

`identityId` \*

 | `string` **|** `null` | The ISC identity ID this account is correlated to, or null when uncorrelated. Retained alongside the IDENTITY\_HAS\_ACCOUNT relationship for the same reason as sourceId. |  |
| 

`identityName` \*

 | `string` **|** `null` | The display name of the correlated identity, or null when the account is uncorrelated. |  |
| 

`identityState` \*

 | `string` **|** `null` | The identity state of the correlated identity. |  |
| 

`isAuthoritative` \*

 | `boolean` **|** `null` | Whether the account comes from an authoritative source. |  |
| 

`isDisabled` \*

 | `boolean` **|** `null` | Whether the account is currently disabled on the source. |  |
| 

`isLocked` \*

 | `boolean` **|** `null` | Whether the account is currently locked on the source. |  |
| 

`isMachine` \*

 | `boolean` **|** `null` | Whether ISC classifies the account as a machine account rather than a human one. |  |
| 

`isManuallyCorrelated` \*

 | `boolean` **|** `null` | Whether the account was correlated to its identity by hand rather than by a correlation rule. |  |
| 

`isSystemAccount` \*

 | `boolean` **|** `null` | Whether this is an IdentityNow user account rather than an account on an external source system. |  |
| 

`isUncorrelated` \*

 | `boolean` **|** `null` | Whether the account could not be correlated to any identity. Uncorrelated accounts are a common orphan-account finding. |  |
| 

`nativeIdentity` \*

 | `string` | The unique account identifier assigned by the source system. |  |
| 

`origin` \*

 | `string` **|** `null` | How the account came to exist in ISC: 'AGGREGATED' (read from the source) or 'PROVISIONED' (created by ISC). |  |
| 

`sourceId` \*

 | `string` **|** `null` | The ID of the source this account belongs to. Retained alongside the SOURCE\_HAS\_ACCOUNT relationship because that relationship is built on a later pass over persisted entities. |  |
| 

`sourceName` \*

 | `string` **|** `null` | The display name of the source this account belongs to. |  |

---

---

Source: /integrations/directory/salesforce

# Salesforce

Visualize Salesforce users, roles, groups, policies, and permissions, map Salesforce users to employees, and monitor changes through queries and alerts.

## Installation

### Configuration in JupiterOne

To install the Salesforce integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Salesforce. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Salesforce account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to initialize the OAuth flow with Salesforce.

You are then redirected to Salesforce to log in and authorize J1 to access your Salesforce organization data based on the user identity you log in with.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Group | `salesforce_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| PermissionSet | `salesforce_permission_set` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Profile | `salesforce_profile` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| User | `salesforce_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| UserRole | `salesforce_user_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `salesforce_group` | **ASSIGNED** | `salesforce_user_role` |
| `salesforce_group` | **HAS** | `salesforce_user` |
| `salesforce_group` | **HAS** | `salesforce_group` |
| `salesforce_profile` | **HAS** | `salesforce_permission_set` |
| `salesforce_user` | **ASSIGNED** | `salesforce_user_role` |
| `salesforce_user` | **HAS** | `salesforce_profile` |
| `salesforce_user` | **ASSIGNED** | `salesforce_permission_set` |
| `salesforce_user_role` | **CONTAINS** | `salesforce_user_role` |

### Salesforce User

`salesforce_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` | Please use `isActive` instead | **deprecated**: true |
| `createdBy` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `lastLoginDate` | `number` |  |  |
| `lastPasswordChangeDate` | `number` |  |  |
| `profileId` | `string` |  |  |
| `roleId` | `string` |  |  |
| `updatedBy` | `string` |  |  |
| `updatedOn` | `number` |  |  |
| `userEmail` | `string` |  |  |
| `userPermissionsAvantgoUser` | `boolean` |  |  |
| `userPermissionsCallCenterAutoLogin` | `boolean` |  |  |
| `userPermissionsInteractionUser` | `boolean` |  |  |
| `userPermissionsKnowledgeUser` | `boolean` |  |  |
| `userPermissionsMarketingUser` | `boolean` |  |  |
| `userPermissionsOfflineUser` | `boolean` |  |  |
| `userPermissionsSFContentUser` | `boolean` |  |  |
| `userPermissionsSupportUser` | `boolean` |  |  |
| `userType` | `string` |  |  |

---

---

Source: /integrations/directory/sbom

# SBOM

Gain visibility into your container images and the software packages they include. The SBOM integration scans images for software components and known vulnerabilities, enabling you to query, monitor, and alert on changes in your software supply chain.

## Installation

For this integration, you will need access to your container registry and a list of container images that you want to scan for SBOM (Software Bill of Materials) ingestion. If your registry is private, you will also need to provide authentication credentials.

### Configuration in JupiterOne

To install the SBOM integration in JupiterOne, navigate to the Integrations tab and select SBOM. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

-   The **Registry URL**, such as `ghcr.io` or `ghcr.io/jupiterone`, which specifies the location of your container images.
-   A list of **Images** to scan. Each image should be provided in the format `<image>:<tag>`. If no tag is provided, the integration will default to using the latest tag.

If your container registry is private, you must also provide the following credentials:

-   **Registry Username** – The username for accessing the container registry.
-   **Registry Password** – The corresponding password. This field is encrypted and stored securely.

Click **Create** once all required values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Container Image | `sbom_container_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Software Package | `sbom_software_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Vulnerability | `sbom_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Vulnerability | `sbom_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sbom_container_image` | **CONTAINS** | `sbom_software_package` |
| `sbom_software_package` | **USES** | `sbom_software_package` |
| `sbom_software_package` | **HAS** | `sbom_vulnerability` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `sbom_container_image` | **IS** | `image` | FORWARD |

### Sbom Container Image

`sbom_container_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`digest` \*

 | `string` |  |  |
| `imagePlatform` | `string` |  |  |
| 

`imageTag` \*

 | `string` |  |  |
| 

`imageType` \*

 | `string` |  |  |
| `repository` | `string` |  |  |
| `size` | `number` |  |  |
| `version` | `string` |  |  |

---

### Sbom Software Package

`sbom_software_package` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cpe` \*

 | `array` **|** `null` |  |  |
| 

`license` \*

 | `array` **|** `null` |  |  |
| 

`modulePackageManager` \*

 | `string` |  |  |
| `purl` | `string` |  |  |
| `repositoryType` | `string` |  |  |
| `size` | `number` |  |  |
| `type` | `string` |  |  |
| `version` | `string` |  |  |

---

### Sbom Vulnerability

`sbom_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `fixAvailable` | `boolean` |  |  |
| `fixedInVersion` | `string` |  |  |
| `publishedOn` | `number` |  |  |

---

### Sbom Vulnerability

`sbom_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `fixAvailable` | `boolean` |  |  |
| `fixedInVersion` | `string` |  |  |
| `publishedOn` | `number` |  |  |

---

## Release Notes

-   **2026-02-03** — Added Amazon ECR image scanning to the SBOM integration, ingesting ECR repositories and container images via AWS IAM role authentication.
-   **2025-07-25** — Added vulnerability scanning to the SBOM integration using Grype, ingesting software package vulnerabilities as finding and vulnerability entities.
-   **2025-07-23** — Added software package dependency relationships in the SBOM integration, linking packages that depend on other packages.
-   **2025-07-22** — Added Software Bill of Materials (SBOM) integration, ingesting container images and their software packages as queryable entities.

---

Source: /integrations/directory/sbom-ecr

# SBOM for AWS ECR

Gain visibility into the container images stored in your Amazon Elastic Container Registry (ECR) and the software packages they include. The SBOM for AWS ECR integration assumes an IAM role in your AWS account, discovers repositories by tag, and scans your most recent images for software components and known vulnerabilities, enabling you to query, monitor, and alert on changes in your software supply chain.

## Installation

For this integration, you will need an AWS account with one or more images stored in Amazon Elastic Container Registry (ECR), and an IAM role that your JupiterOne Collector can assume to read from your registry. The integration authenticates by assuming this role with an auto-generated **External ID**, discovers repositories by tag, and scans the most recent images in each matching repository for SBOM (Software Bill of Materials) ingestion.

> **NOTE**
> 
> SBOM for AWS ECR runs on a [JupiterOne Collector](/integrations/development/collector.md) — it does **not** run on JupiterOne-managed infrastructure. The Collector pulls and unpacks your image layers and scans them locally for packages and vulnerabilities, so it needs the compute, disk, and network reach to your registry. You must have a Collector enrolled before configuring this integration, and the Collector is the identity that assumes the IAM role described below.

### Set permissions in AWS

Create an IAM role in the AWS account that hosts your ECR registry, and configure its trust policy to allow **your Collector's AWS identity** to assume it, using the **External ID** that is auto-generated when you create the integration instance (see below).

Because this integration runs on a Collector, the role is assumed by the AWS identity the Collector process runs as — **not** by any JupiterOne-managed AWS account. Set the trust policy `Principal` to your Collector's identity:

-   If your Collector runs on **EC2**, use its instance-profile role ARN. When the Collector runs in the **same** AWS account as the ECR registry, you may trust the account root (`arn:aws:iam::<account-id>:root`) instead.
-   If your Collector runs elsewhere with configured AWS credentials, use the ARN of that principal.

Do **not** add the JupiterOne AWS account IDs from the managed AWS integration's CloudFormation template — those apply to the managed AWS integration, not to this Collector-run integration. Always keep the `sts:ExternalId` condition.

For example, when the Collector runs in the same account as the registry:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::<account-id>:root" },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": { "sts:ExternalId": "<auto-generated-external-id>" }
      }
    }
  ]
}
```

Attach a policy granting the following read-only Amazon ECR permissions:

-   `ecr:GetAuthorizationToken`
-   `ecr:DescribeRepositories`
-   `ecr:ListTagsForResource`
-   `ecr:DescribeImages`
-   `ecr:BatchCheckLayerAvailability`
-   `ecr:GetDownloadUrlForLayer`
-   `ecr:BatchGetImage`

`ecr:GetAuthorizationToken`, `ecr:BatchCheckLayerAvailability`, `ecr:GetDownloadUrlForLayer`, and `ecr:BatchGetImage` allow the integration to authenticate to the registry and pull image layers for scanning. `ecr:DescribeRepositories` and `ecr:ListTagsForResource` are used to discover repositories by tag, and `ecr:DescribeImages` to select the most recent images per repository.

### Configuration in JupiterOne

To install the SBOM for AWS ECR integration in JupiterOne, navigate to the **Integrations** tab and select **SBOM for AWS ECR**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **Registry** – The URL of your ECR registry, such as `<account-id>.dkr.ecr.<region>.amazonaws.com` for a private registry or `public.ecr.aws/<namespace>` for a public registry.
-   **Role ARN** – The ARN of the IAM role the Collector assumes to authenticate with AWS.
-   **External ID** – Auto-generated by JupiterOne. Use this value when configuring the trust policy of the IAM role. You may change it, but doing so is against Amazon's security recommendations.
-   **Region** – (Optional) The AWS region where the registry is located. Defaults to `us-east-1`.

#### Data filters

-   **Tag** – Filter which repositories to ingest SBOMs from using AWS resource tags. Use the format `tag-key:tag-value` (for example, `environment:production`), or specify only the tag key to match any value (for example, `environment`). Only repositories carrying a matching tag are processed.
-   **Images to Scan** – The number of most recent images to scan per repository (`1`, `2`, or `3`). Defaults to `1`.

If your registry is served behind an internal or self-signed certificate, you can optionally provide a **Certificate Authority Certificate** (PEM format, full CA chain) under **TLS / Certificate Settings** to verify the TLS connection to the registry.

Click **Create** once all required values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Container Image | `sbom_container_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Software Package | `sbom_software_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Vulnerability | `sbom_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Vulnerability | `sbom_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sbom_container_image` | **CONTAINS** | `sbom_software_package` |
| `sbom_software_package` | **USES** | `sbom_software_package` |
| `sbom_software_package` | **HAS** | `sbom_vulnerability` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `sbom_container_image` | **IS** | `image` | FORWARD |

### Sbom Container Image

`sbom_container_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`digest` \*

 | `string` |  |  |
| `imagePlatform` | `string` |  |  |
| 

`imageTag` \*

 | `string` |  |  |
| 

`imageType` \*

 | `string` |  |  |
| `repository` | `string` |  |  |
| `size` | `number` |  |  |
| `version` | `string` |  |  |

---

### Sbom Software Package

`sbom_software_package` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cpe` \*

 | `array` **|** `null` |  |  |
| 

`license` \*

 | `array` **|** `null` |  |  |
| 

`modulePackageManager` \*

 | `string` |  |  |
| `purl` | `string` |  |  |
| `repositoryType` | `string` |  |  |
| `size` | `number` |  |  |
| `type` | `string` |  |  |
| `version` | `string` |  |  |

---

### Sbom Vulnerability

`sbom_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `fixAvailable` | `boolean` |  |  |
| `fixedInVersion` | `string` |  |  |
| `publishedOn` | `number` |  |  |

---

### Sbom Vulnerability

`sbom_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `fixAvailable` | `boolean` |  |  |
| `fixedInVersion` | `string` |  |  |
| `publishedOn` | `number` |  |  |

---

---

Source: /integrations/directory/security-scorecard

# SecurityScorecard

Visualize SecurityScorecard portfolios, monitored vendor companies, and active security findings, and monitor changes through queries and alerts.

## Installation

To use this integration, you must have a SecurityScorecard account and an API token. SecurityScorecard recommends issuing the token to a **Bot (service account) user** so the credential is decoupled from any individual and does not expire when a person leaves the organization.

### Configuration in SecurityScorecard

Creating a Bot user and generating an API token requires administrator permissions in SecurityScorecard. If you do not have administrator access, ask an administrator to complete these steps for you.

1.  Log in to the [SecurityScorecard platform](https://platform.securityscorecard.io) and open **My Settings** from your profile avatar.
    
2.  In **Admin Settings**, open the **People Management** tab and click **Invite People**.
    
3.  Provide a name for the new user and mark the account as a **Bot**. Bot accounts do not expire, which prevents integration outages caused by token rotation on a personal user.
    
4.  Choose an access level for the bot. **Read Only** is sufficient for this integration. Click **Add User**.
    
5.  From the new bot user's actions, select **Create API token** and click **Confirm**.
    
6.  Copy the generated API token and store it securely. The token is only displayed once.
    

> **NOTE**
> 
> If you prefer not to create a bot user, an administrator can also retrieve a personal API key from **My Settings > API**. API tokens do not expire and are nearly as powerful as passwords — store them only in secret managers and never in source code or shared channels.

### Configuration in JupiterOne

To install the SecurityScorecard integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **SecurityScorecard**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the SecurityScorecard account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your SecurityScorecard **API Key** — the token generated in the previous section.
    
-   **Issue Types** — a comma-separated list of issue type slugs (for example, `cookie_missing_http_only,patching_cadence_high`) used to scope the findings the integration ingests. A maximum of 12 slugs is supported per instance. This value is required: the SecurityScorecard API returns an error when the `issue_types` filter is omitted. You can list available slugs via the SecurityScorecard [Issue Types metadata endpoint](https://securityscorecard.readme.io/reference/get_metadata-issue-types-1).
    
-   **Portfolio IDs** _(optional)_ — a comma-separated list of SecurityScorecard portfolio IDs to limit ingestion to specific portfolios. Leave empty to ingest all portfolios the API token can access.
    
-   **Issue Severity Threshold** _(optional)_ — minimum severity of findings to ingest (for example, `medium`). Findings below the threshold are skipped.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (5)

-   `https://api.securityscorecard.io/companies/{domain}/active-issues`
-   `https://api.securityscorecard.io/me`
-   `https://api.securityscorecard.io/metadata/issue-types`
-   `https://api.securityscorecard.io/portfolios`
-   `https://api.securityscorecard.io/portfolios/{id}/companies`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (5)

-   [https://securityscorecard.readme.io/reference/get\_companies-scorecard-identifier-active-issues](https://securityscorecard.readme.io/reference/get_companies-scorecard-identifier-active-issues)
-   [https://securityscorecard.readme.io/reference/get\_metadata-issue-types-1](https://securityscorecard.readme.io/reference/get_metadata-issue-types-1)
-   [https://securityscorecard.readme.io/reference/get\_portfolios](https://securityscorecard.readme.io/reference/get_portfolios)
-   [https://securityscorecard.readme.io/reference/get\_portfolios-portfolio-id-companies](https://securityscorecard.readme.io/reference/get_portfolios-portfolio-id-companies)
-   [https://support.securityscorecard.com/hc/en-us/articles/9738347291931-Create-API-tokens-for-the-SecurityScorecard-platform](https://support.securityscorecard.com/hc/en-us/articles/9738347291931-Create-API-tokens-for-the-SecurityScorecard-platform)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (3)

| Step | Endpoints |
| --- | --- |
| Fetch Companies | `https://api.securityscorecard.io/portfolios/{id}/companies` |
| Fetch Findings | `https://api.securityscorecard.io/companies/{domain}/active-issues`, `https://api.securityscorecard.io/metadata/issue-types` |
| Fetch Portfolios | `https://api.securityscorecard.io/portfolios` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `securityscorecard_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Company | `securityscorecard_company` | [Vendor](https://docs.jupiterone.io/data-model/schemas/Vendor) |
| Finding | `securityscorecard_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Portfolio | `securityscorecard_portfolio` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Service | `securityscorecard_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `securityscorecard_account` | **PROVIDES** | `securityscorecard_service` |
| `securityscorecard_account` | **HAS** | `securityscorecard_portfolio` |
| `securityscorecard_company` | **HAS** | `securityscorecard_finding` |
| `securityscorecard_portfolio` | **HAS** | `securityscorecard_company` |
| `securityscorecard_service` | **MONITORS** | `securityscorecard_company` |
| `securityscorecard_service` | **IDENTIFIED** | `securityscorecard_finding` |

### Securityscorecard Account

`securityscorecard_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`email` \*

 | `string` | Email address of the authenticated account |  |
| 

`username` \*

 | `string` | Username of the authenticated account |  |

---

### Securityscorecard Company

`securityscorecard_company` inherits from [Vendor](/data-model/schemas/Vendor.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainName` \*

 | `string` | Primary domain of the company (unique identifier) |  |
| 

`grade` \*

 | `string` **|** `null` | SSC security grade: A/B/C/D/F |  |
| 

`industry` \*

 | `string` **|** `null` | Industry identifier from SSC |  |
| 

`last30DaysScoreChange` \*

 | `number` **|** `null` | Score change delta over the last 30 days |  |
| 

`score` \*

 | `number` **|** `null` | Security score 0–100 |  |
| 

`size` \*

 | `string` **|** `null` | Estimated company size |  |

---

### Securityscorecard Finding

`securityscorecard_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`firstSeenOn` \*

 | `number` **|** `null` | Timestamp (ms) when this issue was first seen |  |
| 

`issueType` \*

 | `string` | Issue type slug (e.g. cookie\_missing\_http\_only) |  |
| 

`lastSeenOn` \*

 | `number` **|** `null` | Timestamp (ms) when this issue was last seen |  |
| 

`port` \*

 | `number` **|** `null` | Network port associated with this finding, if applicable |  |

---

### Securityscorecard Portfolio

`securityscorecard_portfolio` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`portfolioId` \*

 | `string` | Unique portfolio ID from SSC |  |
| 

`privacy` \*

 | `string` **|** `null` | Portfolio privacy setting (public, private, shared) |  |

---

### Securityscorecard Service

`securityscorecard_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`vendor` \*

 | `string` | Vendor name, always SecurityScorecard |  |

---

---

Source: /integrations/directory/semaphore

# Semaphore

Visualize Semaphore CI accounts, jobs, pipelines, and workflows, map Semaphore CI users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to copy your **Semaphore CI API Token** from within your **Organization's settings** in Semaphore CI.

### Configuration in JupiterOne

To install the Semaphore CI integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Semaphore CI. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Semaphore CI account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Semaphore CI **API Token** and **Organization name**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `semaphore_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Job | `semaphore_job` | [Entity](https://docs.jupiterone.io/data-model/schemas/Entity) |
| Pipeline | `semaphore_pipeline` | [Entity](https://docs.jupiterone.io/data-model/schemas/Entity) |
| Project | `semaphore_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Workflow | `semaphore_workflow` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `semaphore_account` | **HAS** | `semaphore_project` |
| `semaphore_pipeline` | **HAS** | `semaphore_job` |
| `semaphore_project` | **HAS** | `semaphore_workflow` |
| `semaphore_project` | **HAS** | `semaphore_pipeline` |

---

Source: /integrations/directory/semgrep

# Semgrep

Visualize Semgrep deployments, projects, code findings, secrets, and supply chain vulnerabilities. Map code security findings to projects and repositories, and monitor application security issues through queries and alerts.

## Installation

Semgrep is a static application security testing (SAST) tool that helps you find bugs and enforce code standards. The JupiterOne integration ingests findings, repositories, and rule data from your Semgrep account.

> **INFO**
> 
> You will need a Semgrep API Token with the **Web API** scope to set up this integration. This requires a Team or Enterprise tier account.

### Configuration in Semgrep

To create an API token for JupiterOne:

1.  Log in to your Semgrep web application at [https://semgrep.dev](https://semgrep.dev).
2.  Navigate to **Settings > Tokens** (Admin access required).
3.  Create a new API token or edit an existing one.
4.  Under **Token scopes**, ensure **Web API** is enabled.
    -   Tokens with only the **Agent (CI)** scope cannot access the Web API endpoints required by this integration.
5.  Copy the API token for use in JupiterOne configuration.

**Required API Access:**

The integration uses the following Semgrep API endpoints and requires read access to:

-   Deployments (`/api/v1/deployments`)
-   Projects (`/api/v1/deployments/{slug}/projects`)
-   Findings (`/api/v1/deployments/{slug}/findings`)
-   Secrets (`/api/v1/deployments/{id}/secrets`)
-   Supply Chain Vulnerabilities (`/api/v1/deployments/{id}/ssc-vulns`)

See [Semgrep's API documentation](https://semgrep.dev/docs/semgrep-appsec-platform/semgrep-api) for more information about token scopes.

### Configuration in JupiterOne

To install the Semgrep integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Semgrep. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Semgrep account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **Semgrep API Token** that was generated in the Semgrep web app.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (5)

-   `/api/v1/deployments`
-   `/api/v1/deployments/{deploymentId}/secrets`
-   `/api/v1/deployments/{deploymentId}/ssc-vulns`
-   `/api/v1/deployments/{deploymentSlug}/findings`
-   `/api/v1/deployments/{deploymentSlug}/projects`

### Licenses

Product licenses or SKUs required in the target environment.

Show Licenses (1)

-   `Team or Enterprise`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (4)

-   [https://semgrep.dev/api/v1/docs/#operation/DeploymentsService\_ListDeployments](https://semgrep.dev/api/v1/docs/#operation/DeploymentsService_ListDeployments)
-   [https://semgrep.dev/api/v1/docs/#operation/FindingsService\_ListFindings](https://semgrep.dev/api/v1/docs/#operation/FindingsService_ListFindings)
-   [https://semgrep.dev/api/v1/docs/#operation/ProjectsService\_ListProjects](https://semgrep.dev/api/v1/docs/#operation/ProjectsService_ListProjects)
-   [https://semgrep.dev/api/v1/docs/#operation/SecretsService\_ListSecretsPath](https://semgrep.dev/api/v1/docs/#operation/SecretsService_ListSecretsPath)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Deployment | `semgrep_deployment` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Finding | `semgrep_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Project | `semgrep_project` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Secret | `semgrep_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Supply Chain Vulnerability | `semgrep_supply_chain_vulnerability` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `semgrep_deployment` | **HAS** | `semgrep_project` |
| `semgrep_deployment` | **HAS** | `semgrep_finding` |
| `semgrep_deployment` | **HAS** | `semgrep_secret` |
| `semgrep_deployment` | **HAS** | `semgrep_supply_chain_vulnerability` |
| `semgrep_project` | **HAS** | `semgrep_secret` |
| `semgrep_project` | **HAS** | `semgrep_supply_chain_vulnerability` |

### Semgrep Deployment

`semgrep_deployment` inherits from [Organization](/data-model/schemas/Organization.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`slug` \*

 | `string` |  |  |

---

### Semgrep Finding

`semgrep_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `categories` | `array` of `string`s |  |  |
| `confidence` | `string` |  |  |
| `createdAt` | `number` |  |  |
| `firstSeenScanId` | `number` |  |  |
| 
`id` \*

 | `string` |  |  |
| `lineOfCodeUrl` | `string` |  |  |
| 

`locationColumn` \*

 | `number` |  |  |
| 

`locationEndColumn` \*

 | `number` |  |  |
| 

`locationEndLine` \*

 | `number` |  |  |
| 

`locationFilePath` \*

 | `string` |  |  |
| 

`locationLine` \*

 | `number` |  |  |
| 

`matchBasedId` \*

 | `string` |  |  |
| `ref` | `string` |  |  |
| `relevantSince` | `number` |  |  |
| `repositoryName` | `string` |  |  |
| `repositoryUrl` | `string` |  |  |
| 

`ruleMessage` \*

 | `string` |  |  |
| 

`ruleName` \*

 | `string` |  |  |
| 

`severity` \*

 | `string` |  |  |
| `sourcingPolicyId` | `string` |  |  |
| `sourcingPolicyName` | `string` |  |  |
| `sourcingPolicySlug` | `string` |  |  |
| 

`state` \*

 | `string` |  |  |
| `stateUpdatedAt` | `number` |  |  |
| 

`syntacticId` \*

 | `string` |  |  |
| `triageComment` | `string` |  |  |
| `triagedAt` | `number` |  |  |
| `triageReason` | `string` |  |  |
| 

`triageState` \*

 | `string` |  |  |

---

### Semgrep Project

`semgrep_project` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Semgrep Secret

`semgrep_secret` inherits from [Secret](/data-model/schemas/Secret.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `confidence` | `string` |  |  |
| `createdAt` | `number` |  |  |
| `externalTicketExternalSlug` | `string` |  |  |
| `externalTicketUrl` | `string` |  |  |
| `findingPath` | `string` |  |  |
| `findingPathUrl` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| `mode` | `string` |  |  |
| `ref` | `string` |  |  |
| `refUrl` | `string` |  |  |
| `repositoryName` | `string` |  |  |
| `repositoryScmType` | `string` |  |  |
| `repositoryUrl` | `string` |  |  |
| `repositoryVisibility` | `string` |  |  |
| `ruleHashId` | `string` |  |  |
| `severity` | `string` |  |  |
| `status` | `string` |  |  |
| `type` | `string` |  |  |
| `updatedAt` | `number` |  |  |
| `validationState` | `string` |  |  |

---

### Semgrep Supply Chain Vulnerability

`semgrep_supply_chain_vulnerability` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `advisoryCreatedOn` | `number` |  |  |
| `closestSafeDependencyName` | `string` |  |  |
| `closestSafeDependencyVersion` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `cveIds` | `array` of `string`s |  |  |
| `cweIds` | `array` of `string`s |  |  |
| `dependencyFileLocationPath` | `string` |  |  |
| `dependencyFileLocationUrl` | `string` |  |  |
| `description` | `string` |  |  |
| 
`displayName` \*

 | `string` |  |  |
| `ecosystem` | `string` |  |  |
| `exposureType` | `string` |  |  |
| `firstTriagedAt` | `number` |  |  |
| 

`groupKey` \*

 | `string` |  |  |
| `matchedDependencyName` | `string` |  |  |
| `matchedDependencyVersion` | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| `owaspIds` | `array` of `string`s |  |  |
| `packageManager` | `string` |  |  |
| `repositoryId` | `string` |  |  |
| `repositoryName` | `string` |  |  |
| `ruleId` | `string` |  |  |
| 

`severity` \*

 | `string` |  |  |
| `subdirectory` | `string` |  |  |
| `transitivity` | `string` |  |  |
| `triageDismissReason` | `string` |  |  |
| `triageIssueUrl` | `string` |  |  |
| `triagePrUrl` | `string` |  |  |
| `triageStatus` | `string` |  |  |
| `urls` | `array` of `string`s |  |  |

---

## Release Notes

-   **2025-06-05** — Promoted Semgrep supply chain vulnerability findings to carry both the Vulnerability and Finding entity classes, enabling cross-integration vulnerability queries.

---

Source: /integrations/directory/sentinelone

# SentinelOne

Visualize SentinelOne endpoint agents and devices, map SentinelOne agents to devices and owners, and monitor changes through queries and alerts.

## Installation

For this integration, you will first need to acquire an API Token in SentinelOne.

### Configuration in SentinelOne

**To create an API Token**:

1.  In your SentinelOne Management Console, click **Settings** > **USERS**
2.  Select your username and navigate to **Edit User** > **API Token** > **Generate**
3.  Generate a token for use within JupiterOne.

> **NOTE**
> 
> If you see _Revoke_ and _Regenerate_ actions, you already have an existing token. Revoking or regenerating the existing token will break any scripts currently utilizing the revoked/regenerated token:
> 
> -   **Revoke** removes the token authorization, and there is no confirmation on this action.
> -   **Regenerate** revokes the token and generates a new token. If you click Generate or Regenerate, a message shows the token string and the date that the token expires.

5.  Click **DOWNLOAD** for use in JupiterOne.

### Configuration in JupiterOne

To install the SentinelOne integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select SentinelOne. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the SentinelOne account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your SentinelOne **Management Server Hostname/URL** and **API Token**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `sentinelone_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Agent | `sentinelone_agent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Application | `sentinelone_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Group | `sentinelone_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Host | `sentinelone_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| User | `sentinelone_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vulnerability | `sentinelone_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sentinelone_account` | **HAS** | `sentinelone_group` |
| `sentinelone_account` | **HAS** | `sentinelone_user` |
| `sentinelone_agent` | **INSTALLED** | `sentinelone_application` |
| `sentinelone_agent` | **IDENTIFIED** | `sentinelone_vulnerability` |
| `sentinelone_application` | **HAS** | `sentinelone_vulnerability` |
| `sentinelone_group` | **HAS** | `sentinelone_agent` |
| `sentinelone_host` | **PROTECTS** | `sentinelone_agent` |
| `sentinelone_host` | **HAS** | `sentinelone_vulnerability` |
| `sentinelone_user` | **ASSIGNED** | `sentinelone_group` |

### Sentinelone Account

`sentinelone_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Sentinelone Agent

`sentinelone_agent` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activeThreats` | `number` |  |  |
| `activeThreatsCount` | `number` |  |  |
| `adComputerDistinguishedName` | `string` |  |  |
| `agentVersion` | `string` |  |  |
| `allowRemoteShell` | `boolean` |  |  |
| `appsVulnerabilityStatus` | `string` |  |  |
| `computerName` | `string` |  |  |
| `consoleMigrationStatus` | `string` |  |  |
| `coreCount` | `number` |  |  |
| `cpuCount` | `number` |  |  |
| `cpuId` | `string` |  |  |
| `createdAt` | `number` | Please use createdOn instead | **deprecated**: true |
| `domain` | `string` |  |  |
| `encryptedApplications` | `boolean` |  |  |
| `externalIp` | `string` |  |  |
| 
`groupId` \*

 | `string` |  |  |
| `groupIp` | `string` |  |  |
| `groupName` | `string` |  |  |
| `groupUpdatedAt` | `number` | Please use groupUpdatedOn instead | **deprecated**: true |
| `groupUpdatedOn` | `number` |  |  |
| `infected` | `boolean` | Please use isInfected instead | **deprecated**: true |
| `inRemoteShellSession` | `boolean` | Please use isInRemoteShellSession instead | **deprecated**: true |
| `isActive` | `boolean` |  |  |
| `isDecommissioned` | `boolean` |  |  |
| `isInfected` | `boolean` |  |  |
| `isInRemoteShellSession` | `boolean` |  |  |
| `isPendingUninstall` | `boolean` |  |  |
| `isUninstalled` | `boolean` |  |  |
| `isUpToDate` | `boolean` |  |  |
| `lastActiveDate` | `number` |  |  |
| `lastLoggedInUserName` | `string` |  |  |
| `macAddress` | `array` of `string`s |  |  |
| `macAddresses` | `array` of `string`s |  |  |
| `machineType` | `string` |  |  |
| `missingPermissions` | `array` of `string`s |  |  |
| `mitigationMode` | `string` |  |  |
| `mitigationModeSuspicious` | `string` |  |  |
| `modelName` | `string` |  |  |
| `networkStatus` | `string` |  |  |
| `osArch` | `string` |  |  |
| `osName` | `string` |  |  |
| `osRevision` | `string` |  |  |
| `osStartTime` | `number` |  |  |
| `osType` | `string` |  |  |
| `osUsername` | `string` |  |  |
| `policyUpdatedAt` | `number` | Please use policyUpdatedOn instead | **deprecated**: true |
| `policyUpdatedOn` | `number` |  |  |
| `registeredAt` | `number` | Please use registeredOn instead | **deprecated**: true |
| `registeredOn` | `number` |  |  |
| `scanAbortedAt` | `number` | Please use scanAbortedOn instead | **deprecated**: true |
| `scanAbortedOn` | `number` |  |  |
| `scanFinishedAt` | `number` | Please use scanFinishedOn instead | **deprecated**: true |
| `scanFinishedOn` | `number` |  |  |
| `scanStartedAt` | `number` | Please use scanStartedOn instead | **deprecated**: true |
| `scanStartedOn` | `number` |  |  |
| `scanStatus` | `string` |  |  |
| `serial` | `string` |  |  |
| `siteId` | `string` |  |  |
| `siteName` | `string` |  |  |
| `totalMemory` | `number` |  |  |
| `updatedAt` | `number` | Please use updatedOn instead | **deprecated**: true |
| `uuid` | `string` |  |  |

---

### Sentinelone Application

`sentinelone_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `osType` | `string` |  |  |
| `riskLevel` | `string` |  |  |
| `signed` | `boolean` |  |  |
| `size` | `number` |  |  |
| `type` | `string` |  |  |
| `vendor` | `string` |  |  |
| `version` | `string` |  |  |

---

### Sentinelone Group

`sentinelone_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdAt` | `number` | Please use createdOn instead | **deprecated**: true |
| `creator` | `string` |  |  |
| `creatorId` | `string` |  |  |
| `filterId` | `string` |  |  |
| `filterName` | `string` |  |  |
| `inherits` | `boolean` |  |  |
| `isDefault` | `boolean` |  |  |
| `rank` | `number` |  |  |
| 
`siteId` \*

 | `string` |  |  |
| `totalAgents` | `number` |  |  |
| `type` | `string` |  |  |
| `updatedAt` | `number` | Please use updatedOn instead | **deprecated**: true |

---

### Sentinelone Host

`sentinelone_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activeCoverage` | `array` of `string`s | Active SentinelOne coverage modules (e.g. EPP, EDR). |  |
| `adMachineDistinguishedName` | `string` | The Active Directory machine distinguished name. |  |
| `adsEnabled` | `boolean` | Whether Application Detection & Security is enabled. |  |
| `adUserDistinguishedName` | `string` | The Active Directory user distinguished name. |  |
| `agentId` | `string` | Id of the SentinelOne agent installed on this host. |  |
| `agentUuid` | `string` | UUID of the SentinelOne agent installed on this host. |  |
| `architecture` | `string` | The CPU architecture of the device. |  |
| `assetContactEmail` | `string` | The asset contact email. |  |
| `assetCriticality` | `string` | The criticality assigned to the asset. |  |
| `assetEnvironment` | `string` | The environment the asset exists in (AWS, Azure, GCP, AD). |  |
| `assetStatus` | `string` | The status of the asset. |  |
| `coreCount` | `number` | The number of CPU cores. |  |
| `cpu` | `string` | The CPU model of the device. |  |
| `detectedFromSite` | `string` | The site from which the device was detected. |  |
| `domain` | `string` | The network domain of the device. |  |
| `firstSeenOn` | `number` | When the asset was first seen (epoch ms). |  |
| `groupId` | `string` | The SentinelOne group id. |  |
| `groupName` | `string` | The SentinelOne group name. |  |
| `infectionStatus` | `string` | The infection/alert status of the asset. |  |
| `instanceId` | `string` | The cloud instance id of the device, when applicable. |  |
| `isAdConnector` | `boolean` | Whether the device is an Active Directory connector. |  |
| `isDcServer` | `boolean` | Whether the device is a domain controller. |  |
| `isVm` | `boolean` | Whether the device is a virtual machine. |  |
| `lastActiveOn` | `number` | When the asset was last active (epoch ms). |  |
| `lastApplicationScanOn` | `number` | When applications were last scanned (epoch ms). |  |
| `lastRebootOn` | `number` | When the device last rebooted (epoch ms). |  |
| `lastUpdateOn` | `number` | When the asset record was last updated (epoch ms). |  |
| `memoryReadable` | `string` | Human-readable total memory (e.g. "16 GB"). |  |
| `missingCoverage` | `array` of `string`s | SentinelOne coverage modules that are missing. |  |
| `modelName` | `string` | The hardware model name. |  |
| `osFamily` | `string` | The operating system family. |  |
| `osUsername` | `string` | The last logged-in OS username on the device. |  |
| `resourceType` | `string` | The canonical resource type of the asset. |  |
| `riskFactors` | `array` of `string`s | Risk factors associated with the asset. |  |
| `s1AccountId` | `string` | The SentinelOne account id. |  |
| `s1AccountName` | `string` | The SentinelOne account name. |  |
| `s1ActiveProtection` | `array` of `string`s | Active SentinelOne protection modes. |  |
| `s1ManagementId` | `number` | The SentinelOne management id. |  |
| `s1ScopeId` | `string` | The SentinelOne scope id. |  |
| `s1ScopeLevel` | `string` | The SentinelOne scope level. |  |
| `s1ScopePath` | `string` | The SentinelOne scope path. |  |
| `s1ScopeType` | `number` | The SentinelOne scope type. |  |
| `s1UpdatedOn` | `number` | When SentinelOne last updated the asset (epoch ms). |  |
| `siteId` | `string` | The SentinelOne site id. |  |
| `siteName` | `string` | The SentinelOne site name. |  |
| `subCategory` | `string` | The asset sub-category (e.g. Laptop, Server). |  |
| `surfaces` | `array` of `string`s | The surfaces the asset belongs to. |  |
| `totalMemory` | `number` | Total physical memory in megabytes. |  |

---

### Sentinelone User

`sentinelone_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agreedEula` | `boolean` |  |  |
| `agreedEulaVersion` | `string` |  |  |
| `canGenerateApiToken` | `boolean` |  |  |
| `dateJoinedOn` | `number` |  |  |
| `firstLoginOn` | `number` |  |  |
| `fullName` | `string` |  |  |
| `lastLoginOn` | `number` |  |  |
| `lowestRole` | `string` |  |  |
| `primaryTwoFaMethod` | `string` |  |  |
| `scope` | `string` |  |  |
| `source` | `string` |  |  |
| `twoFaConfigured` | `boolean` |  |  |
| `twoFaEnabled` | `boolean` |  |  |
| `twoFaStatus` | `string` |  |  |

---

### Sentinelone Vulnerability

`sentinelone_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `applicationName` | `string` |  |  |
| `applicationVendor` | `string` |  |  |
| `applicationVersion` | `string` |  |  |
| `cvssVersion` | `string` |  |  |
| `publishedOn` | `number` |  |  |
| `riskLevel` | `string` |  |  |

---

## Release Notes

-   **2026-07-10** — SentinelOne endpoints now include cloud instance IDs in their device identifier, enabling unified device correlation with cloud provider integrations.
-   **2026-03-19** — Improved hostname and FQDN accuracy on SentinelOne host entities by parsing fully qualified domain names from computer names.
-   **2026-02-10** — Added two-factor authentication configuration status and admin role indicator to SentinelOne user entities.
-   **2026-01-29** — Added SentinelOne user ingestion as new entities, including role, two-factor authentication status, and login timestamps.
-   **2026-01-20** — Added SentinelOne installed application and vulnerability ingestion with host relationships.
-   **2026-01-12** — Added normalized host properties to SentinelOne agent entities including OS, hardware, and network details.

---

Source: /integrations/directory/sentry

# Sentry

Visualize Sentry services, teams, and users, map Sentry users to employees, and monitor changes through queries and alerts.

## Installation

To configure this integration, you will need to create an Auth Token in Sentry and provide it in your JupiterOne integration instance.

### Configuration in Sentry

**To create an API Token**:

1.  Navigate to the [Auth Tokens page](https://sentry.io/settings/account/api/auth-tokens/) in your Sentry Settings.
    
2.  Select **Create New Token** in the top right corner.
    
3.  Allow the following scopes for the token:
    
    -   `project:read`
    -   `team:read`
    -   `org:read`
    -   `event:read`
    -   `member:read`
4.  Click **Create Token**
    

### Configuration in JupiterOne

To install the Sentry integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Sentry. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Sentry account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Sentry **API Token** generated for use in JupiterOne.
    
-   For **Organization**, enter your Sentry Organization's slug. This is the URL safe version of your organization and can be found in your Sentry URL at `_sentry.io/organizations/{organization-slug}/...`.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Finding | `sentry_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Member | `sentry_member` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Organization | `sentry_organization` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Project | `sentry_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Role | `sentry_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Service | `sentry_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Team | `sentry_team` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sentry_member` | **ASSIGNED** | `sentry_role` |
| `sentry_organization` | **HAS** | `sentry_service` |
| `sentry_organization` | **HAS** | `sentry_project` |
| `sentry_organization` | **HAS** | `sentry_team` |
| `sentry_organization` | **HAS** | `sentry_member` |
| `sentry_organization` | **HAS** | `sentry_role` |
| `sentry_project` | **HAS** | `sentry_finding` |
| `sentry_team` | **ASSIGNED** | `sentry_project` |
| `sentry_team` | **HAS** | `sentry_member` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `sentry_organization` | **HAS** | `repository` | FORWARD |

### Sentry Member

`sentry_member` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `dateJoined` | `integer` |  |  |
| `isManaged` | `boolean` |  |  |
| `isStaff` | `boolean` |  |  |
| `isSuperuser` | `boolean` |  |  |
| `lastActive` | `integer` |  |  |
| `lastLogin` | `integer` |  |  |
| `role` | `string` |  |  |

---

---

Source: /integrations/directory/servicenow

# ServiceNow

Visualize ServiceNow resources and monitor them through queries and alerts.

## Installation

> **INFO**
> 
> Before configuring this integration in JupiterOne, you need to create a dedicated service account with appropriate permissions in ServiceNow:
> 
> **Required in ServiceNow:**
> 
> -   A dedicated user account (e.g., `JupiterOne`)
> -   A custom role with read-only access (e.g., `jupiterone_reader`)
> -   Access Control Lists (ACLs) configured for the required tables
> -   Your ServiceNow instance hostname (e.g., `yourcompany.service-now.com`)
> 
> **Authentication:** This integration uses HTTP Basic authentication with username and password.
> 
> **Required Table Access:** The service account must have read access to these tables:
> 
> -   `sys_user` - for user data
> -   `sys_user_group` - for group data
> -   `sys_user_grmember` - for group membership data
> -   `incident` - for incident data
> -   `sys_db_object` - for database object information
> -   CMDB tables (if ingesting CMDB data) - requires the `cmdb_reader` role
> 
> **Optional Permissions:** If you want JupiterOne to create ServiceNow incidents from alert rules, create an additional `jupiterone_incident_creator` role with write access to the `incident` table.
> 
> Detailed setup instructions are provided in the Configuration in ServiceNow section below.

In order to allow JupiterOne to fetch data from your ServiceNow account, we recommend creating a new ServiceNow role with read-only access to your account and assigning that read-only role to a dedicated ServiceNow user.

### Configuration in ServiceNow

1.  Follow the ServiceNow documentation to [create a new ServiceNow role](https://docs.servicenow.com/bundle/utah-platform-administration/page/administer/roles/task/t_CreateARole.html) called `jupiterone_reader`.
    
2.  Create a [new access control rule (ACL)](https://docs.servicenow.com/bundle/utah-it-service-management/page/product/change-management/task/t_CreateNewACL.html) to allow access to the `jupiterone_reader` role with `Type: Record`, `Operation: Read`, and `Role: jupiterone_reader`. This should be enabled for the following tables (`Name` field):
    
    -   `sys_user`
    -   `sys_user_group`
    -   `sys_user_grmember`
    -   `incident`
    -   `sys_db_object`
3.  Create a [new ServiceNow User](https://docs.servicenow.com/bundle/utah-platform-administration/page/administer/users-and-groups/task/t_CreateAUser.html) called `JupiterOne`. Make a note of the new username/password; you'll need it when configuring your integration in JupiterOne.
    
4.  Open the `JupiterOne` user and [assign the `jupiterone_reader` role](https://docs.servicenow.com/bundle/utah-platform-administration/page/administer/users-and-groups/task/t_AssignARoleToAUser.html) to your newly created user. **Note**: if ingesting any part of the cmdb, also add the `cmdb_reader` role. See [this link](https://docs.servicenow.com/bundle/utah-platform-administration/page/administer/roles/reference/r_BaseSystemRoles.html) for more information.
    
5.  (**OPTIONAL**) For JupiterOne users who wish to create ServiceNow incidents based on JupiterOne alert rules, we suggest creating a `jupiterone_incident_creator` role. Repeat steps 1, 2, and 4 above with the following parameters:
    
    **1\. ServiceNow Role**: `name: jupiterone_incident_creator`
    
    **2\. Access Control Rule (ACL)** : `Type: Record` , `Operation: Create` , `Name(table): incident`, `Name(fields): *` , `Role: jupiterone_incident_creator`
    
    **4\. Role Assignment**: Assign `jupiterone_incident_creator` role to `JupiterOne` user
    

### Configuration in JupiterOne

To install the ServiceNow integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select ServiceNow. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the ServiceNow account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your ServiceNow **Hostname** (e.g., `j1.service-now.com`), **Username**, and **Password**.
    
-   Your ServiceNow **CMDB Classes** to ingest, a comma separated value of classes.
    

Click **Create** once all values are provided to finalize the integration.

### Advanced Options

Additional configuration can be set to customize the ingested data:

-   **User Configuration: Custom Fields** allows for custom fields to be added to the user entity.
-   **User Configuration: Excluded User Classes** allows for some users to be excluded based on their sysClassName.
-   **Host Configuration: Host Classes** allows for specific sysClassNames to be mapped to the JupiterOne Device data model.

> **NOTE**
> 
> Excluded User Classes configuration option:
> 
> This J1QL Query can be executed to determine which system class names (sysClassName) of users exist within ServiceNow, after a successful job run without any User Class Exclusions:
> 
> `FIND service_now_user RETURN count(service_now_user), service_now_user.sysClassName`

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `service_now_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| CMDB Host Object | `service_now_cmdb_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| CMDB Object | `service_now_cmdb_object` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Company | `service_now_company` | [Vendor](https://docs.jupiterone.io/data-model/schemas/Vendor) |
| Configuration Compliance Test Result | `service_now_config_test_result` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Incident | `service_now_incident` | [Incident](https://docs.jupiterone.io/data-model/schemas/Incident) |
| User | `service_now_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Group | `service_now_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Vulnerable Item | `service_now_vulnerable_item` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `service_now_account` | **HAS** | `service_now_user` |
| `service_now_account` | **HAS** | `service_now_group` |
| `service_now_cmdb_object` | **ASSIGNED** | `service_now_user` |
| `service_now_cmdb_object` | **ASSIGNED** | `service_now_group` |
| `service_now_cmdb_object` | **CONNECTS** | `service_now_cmdb_object` |
| `service_now_company` | **HAS** | `service_now_company` |
| `service_now_group` | **HAS** | `service_now_group` |
| `service_now_group` | **HAS** | `service_now_user` |
| `service_now_group` | **MANAGES** | `service_now_cmdb_object` |
| `service_now_group` | **ASSIGNED** | `service_now_vulnerable_item` |
| `service_now_group` | **ASSIGNED** | `service_now_config_test_result` |
| `service_now_incident` | **ASSIGNED** | `service_now_user` |
| `service_now_user` | **MANAGES** | `service_now_group` |
| `service_now_user` | **MANAGES** | `service_now_user` |
| `service_now_user` | **MANAGES** | `service_now_cmdb_object` |
| `service_now_user` | **OWNS** | `service_now_cmdb_object` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `service_now_cmdb_object` | **CONNECTS** | `service_now_cmdb_object` | FORWARD |
| `service_now_cmdb_object` | **HAS** | `service_now_vulnerable_item` | FORWARD |
| `service_now_cmdb_object` | **HAS** | `service_now_config_test_result` | FORWARD |
| `service_now_config_test_result` | **IS** | `qualys_compliance_finding` | FORWARD |

### Service Now Cmdb Host

`service_now_cmdb_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetFunction` | `string` | Derived from the property named: "asset\_function" |  |
| `assetTag` | `string` | Derived from the property named: "asset\_tag" |  |
| `assignedTo` | `string` | Derived from the property named: "assigned\_to.value" |  |
| `attributes` | `string` | Derived from the property named: "attributes" |  |
| `businessUnit` | `string` | Derived from the property named: "business\_unit.value" |  |
| `comments` | `string` | Derived from the property named: "comments" |  |
| `correlationId` | `string` | Derived from the property named: "correlation\_id" |  |
| `department` | `string` | Derived from the property named: "department.value" |  |
| `discoverySource` | `string` | Derived from the property named: "discovery\_source" |  |
| `dnsDomain` | `string` | Derived from the property named: "dns\_domain" |  |
| `environment` | `string` | Derived from the property named: "environment" |  |
| `hardwareStatus` | `string` | Derived from the property named: "hardware\_status" |  |
| `hardwareSubStatus` | `string` | Derived from the property named: "hardware\_substatus" |  |
| `installDate` | `number` | Derived from the property named: "install\_date" |  |
| `installStatus` | `string` | Derived from the property named: "install\_status". This property shows the recovered label. |  |
| `location` | `string` | Derived from the property named: "location.value" |  |
| `managedBy` | `string` | Derived from the property named: "managed\_by.value" |  |
| `managedByGroup` | `string` | Derived from the property named: "managed\_by\_group.value" |  |
| `mode` | `string` | Derived from the property named: "mode" |  |
| `numericInstallStatus` | `string` | Derived from the property named: "install\_status". This property shows the raw value. |  |
| `numericOperationalStatus` | `string` | Derived from the property named: "operational\_status". This property shows the raw value. |  |
| `operationalStatus` | `string` | Derived from the property named: "operational\_status". This property shows the recovered label. |  |
| `orderDate` | `number` | Derived from the property named: "order\_date" |  |
| `ownedBy` | `string` | Derived from the property named: "owned\_by.value" |  |
| `subcategory` | `string` | Derived from the property named: "subcategory" |  |
| `substatus` | `string` | Derived from the property named: "substatus" |  |
| 
`sysClassNames` \*

 | `array` of `string`s |  |  |
| `warrantyExpiration` | `number` | Derived from the property named: "warranty\_expiration" |  |

---

### Service Now Company

`service_now_company` inherits from [Vendor](/data-model/schemas/Vendor.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `city` | `string` **|** `null` | Mailing address city. Derived from the property named: "city". |  |
| `contactId` | `string` | sys\_id of the primary contact (sys\_user). Derived from the property named: "contact.value". |  |
| `country` | `string` **|** `null` | Mailing address country. Derived from the property named: "country". |  |
| `discount` | `number` | Negotiated discount. Derived from the property named: "discount". |  |
| `isCustomer` | `boolean` | Whether this company is a customer. Derived from the property named: "customer". |  |
| `isManufacturer` | `boolean` | Whether this company is a manufacturer. Derived from the property named: "manufacturer". |  |
| `isPrimary` | `boolean` | Whether this is the instance's own/primary company. Derived from the property named: "primary". |  |
| `isVendor` | `boolean` | Whether this company is a vendor. Derived from the property named: "vendor". |  |
| `marketCap` | `number` | Market capitalization. Derived from the property named: "market\_cap". |  |
| `numEmployees` | `number` | Number of employees. Derived from the property named: "num\_employees". |  |
| `state` | `string` **|** `null` | Mailing address state. Derived from the property named: "state". |  |
| `stockSymbol` | `string` **|** `null` | Ticker symbol. Derived from the property named: "stock\_symbol". |  |
| `vendorType` | `string` **|** `null` | Vendor classification. Derived from the property named: "vendor\_type". |  |
| `zip` | `string` **|** `null` | Mailing address postal code. Derived from the property named: "zip". |  |

---

### Service Now Config Test Result

`service_now_config_test_result` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `actualValues` | `string` **|** `null` | The values the scanner actually observed on the configuration item. Derived from the property named: "actual\_values". |  |
| `assignedToId` | `string` **|** `null` | sys\_id of the individual working on this test result. Derived from the property named: "assigned\_to.value". |  |
| `closedOn` | `number` | Timestamp at which the test result transitioned to closed. Derived from the property named: "closed". |  |
| `controlId` | `string` **|** `null` | The identifier assigned to the configuration test by the SCA scanner. For Qualys Policy Compliance this is the Qualys Control ID. Derived from the property named: "test.source\_id". |  |
| `expectedValues` | `string` **|** `null` | The values the scanner expected the configuration item to report for a passing result. Derived from the property named: "expected\_values". |  |
| `firstSeenOn` | `number` | Timestamp of the first import of this test result into Configuration Compliance. Derived from the property named: "first\_seen". |  |
| `isActive` | `boolean` | Whether the test result is still active, i.e. has not been closed. Derived from the property named: "active". |  |
| `lastPassedOn` | `number` | Timestamp of the most recent date on which this test result passed. Derived from the property named: "last\_pass". |  |
| `lastSeenOn` | `number` | Timestamp of the most recent import of this test result. Derived from the property named: "last\_seen". |  |
| `number` | `string` **|** `null` | The number assigned to the test result during the import process (e.g. "CTR19994689"). Derived from the property named: "number". |  |
| `resolution` | `string` **|** `null` | Resolution calculated from the associated remediation task groups (e.g. "Stale"). Derived from the property named: "resolution". |  |
| `result` | `string` **|** `null` | Outcome of the configuration test as reported by the scanner: Passed, Failed, Error or Unknown. Derived from the property named: "result". |  |
| `riskRating` | `string` **|** `null` | Raw numeric risk rating (1-5) reported by ServiceNow, where 1 is the most severe. Derived from the property named: "risk\_rating". |  |
| `riskScore` | `number` | Score derived from the criticality of the configuration test. Derived from the property named: "risk\_score". |  |
| `source` | `string` **|** `null` | System name of the third-party SCA integration that produced the result (e.g. "Qualys"). Derived from the property named: "source". |  |
| `sourceId` | `string` **|** `null` | The identifier assigned to this test result by the third-party SCA scanner. For Qualys Policy Compliance this is the Qualys Posture ID, which is what joins the result to a qualys\_compliance\_finding. |  |
| `state` | `string` **|** `null` | Raw state value, calculated by ServiceNow from the remediation tasks the test result belongs to. Derived from the property named: "state". |  |
| `stateLabel` | `string` **|** `null` | Human-readable label for the numeric state value, when ServiceNow reports state numerically (e.g. "1" resolves to "Open"). |  |
| `technology` | `string` **|** `null` | The technology the test was evaluated against (e.g. "Windows 2019 Server"). Derived from the property named: "technology". |  |
| `testId` | `string` **|** `null` | sys\_id of the configuration test (sn\_vulc\_test) this result evaluates. Derived from the property named: "test.value". |  |
| `testName` | `string` **|** `null` | Name of the configuration test, i.e. the control statement. Derived from the property named: "test.name". |  |

---

### Service Now User

`service_now_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `employeeNumber` | `string` |  |  |
| `sysClassName` | `string` |  |  |
| `title` | `string` |  |  |

---

## Release Notes

-   **2026-08-03** — ServiceNow incident entities now include a direct web link for quick navigation to the incident in ServiceNow.
-   **2026-07-30** — Added ingestion of ServiceNow company records as vendor entities, including parent-company hierarchy relationships.
-   **2026-07-13** — Added support for ingesting custom CMDB fields via a new configuration option, and linked Wiz integration assets to CMDB records via mapped relationships.
-   **2026-03-31** — Added additional vulnerability states to ServiceNow vulnerable item ingestion, supporting Awaiting Implementation, Resolved, and Deferred states.
-   **2026-03-24** — Added configurable default filtering for ServiceNow vulnerability ingestion, defaulting to open and under-investigation states and critical, high, and medium severities.
-   **2026-03-23** — Added Vulnerable Items ingestion step, bringing in ServiceNow vulnerable item entities from the vulnerable items table with host and vulnerability relationships.
-   **2026-02-24** — Added configuration field to specify custom fields for special handling during CMDB object ingestion.
-   **2026-02-18** — Added user to group manager relationships for ServiceNow, linking the manager of each user group to the groups they manage.
-   **2025-11-14** — Added ServiceNow user manages user relationship for assignment group managers.
-   **2025-10-22** — Added strict filtering on sys class names configuration, improving CMDB object ingestion accuracy.
-   **2025-10-02** — Added ServiceNow user manages user relationship derived from manager field.
-   **2025-10-01** — Added integration filters for ServiceNow CMDB object entities, enabling subset ingestion by sys class name.
-   **2025-08-27** — Added host custom fields configuration option for promoting custom CMDB host fields (mirrors existing user custom fields behavior).
-   **2025-06-09** — Added ingestion of CMDB configuration item relationships as graph relationships between CMDB objects.

---

Source: /integrations/directory/shodan

# Shodan

Visualize Shodan Organization, Alert, Host, Scan, and User changes through queries and alerts.

# Installation Guide

## Prerequisites

To use this integration, you will need an enterprise license.

## Configuring Shodan

#### Authentication

Collect **API key** to authorize API requests.

#### Collect API Key

1.  Log in to your [Shodan](https://www.shodan.io) account.
2.  Click on **Account** in the top-right corner.
3.  Click **Show API Key**.
4.  Copy the API key and store it in a safe location.

## Configuring in JupiterOne

1.  In the **J1 Search** homepage, navigate to the **Integrations** section from the top navigation bar.
    
2.  Search for **Shodan** and select it.
    
3.  Click the **Add Instance** button and configure the following:
    
    -   **Shodan API Key:** Enter the API Token generated in Shodan.
    -   **Account Name:** Assign a name to identify this Shodan instance in JupiterOne. If the **Tag with Account Name** option is enabled, ingested entities will include this value in `tag.AccountName`.
    -   **Description:** Add a description to assist your team in identifying this integration instance.
    -   **Polling Interval (optional):** Select a polling interval appropriate for your monitoring needs. Leave this as `DISABLED` for manual execution if unsure.
4.  Click **Create Configuration** to save the settings.
    

## Next Steps

Your integration instance will now run based on the configured polling interval, populating data within JupiterOne. Refer to our [Instance Management Guide](/integrations/instance-management.md) to learn more about managing and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Alert | `shodan_alert` | [Alert](https://docs.jupiterone.io/data-model/schemas/Alert) |
| Host | `shodan_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Organization | `shodan_organization` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Scan | `shodan_scan` | [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| User | `shodan_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `shodan_organization` | **HAS** | `shodan_user` |
| `shodan_organization` | **HAS** | `shodan_scan` |
| `shodan_scan` | **SCANS** | `shodan_host` |

### Shodan Alert

`shodan_alert` inherits from [Alert](/data-model/schemas/Alert.md)

---

### Shodan Host

`shodan_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `asn` | `string` |  |  |
| `bannerId` | `string` |  |  |
| `hash` | `number` |  |  |
| `hostnames` | `array` of `string`s |  |  |
| `internetServiceProvider` | `string` |  |  |
| `location` | `string` |  |  |
| `organization` | `string` |  |  |
| `product` | `string` |  |  |
| `shodanCrawler` | `string` |  |  |
| `shodanScanId` | `string` |  |  |
| `transportLayerProtocol` | `string` |  |  |

---

### Shodan Organization

`shodan_organization` inherits from [Account](/data-model/schemas/Account.md)

---

### Shodan Scan

`shodan_scan` inherits from [Scanner](/data-model/schemas/Scanner.md)

---

### Shodan User

`shodan_user` inherits from [User](/data-model/schemas/User.md)

---

---

Source: /integrations/directory/signal-sciences

# Signal Sciences (Fastly)

Visualize Signal Sciences corps and users, and monitor changes through queries and alerts.

## Installation

For this integration, JupiterOne requires a Signal Sciences API Access Token. This can be created by navigating to your user profile within Signal Sciences. See [their documentation](https://docs.fastly.com/signalsciences/developer/using-our-api/#managing-api-access-tokens) for additional information on managing API Access Tokens. Once created, save the key to a secure location for use in JupiterOne.

> **NOTE**
> 
> The API Access Token generated on Signal Sciences will inherit the same role as the user that generated it. For this integration, the role of _Observer_ is sufficient for the ingestion of corps and users.

### Configuration in JupiterOne

To install the Signal Sciences integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Signal Sciences. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Signal Sciences account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Signal Sciences **user**(the email associated to the Signal Sciences account that created the API access token).
    
-   The **API access token** generated in Signal Sciences for use with JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Agent | `sigsci_agent` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Cloud WAF | `sigsci_cloudwaf` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Corp | `sigsci_corp` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Site | `sigsci_site` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| User | `sigsci_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sigsci_agent` | **PROTECTS** | `sigsci_site` |
| `sigsci_corp` | **HAS** | `sigsci_user` |
| `sigsci_corp` | **HAS** | `sigsci_cloudwaf` |
| `sigsci_corp` | **HAS** | `sigsci_site` |

### Sigsci Agent

`sigsci_agent` inherits from [Firewall](/data-model/schemas/Firewall.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`active` \*

 | `boolean` | Whether agent was seen in past 5 minutes |  |
| 

`address` \*

 | `string` | RPC Address |  |
| 

`arguments` \*

 | `string` | Command line arguments |  |
| 

`buildId` \*

 | `string` | Commit SHA of current build |  |
| 

`enabled` \*

 | `boolean` | Configuration flag for on/off |  |
| `lastRuleUpdatedOn` | `number` | Timestamp of last rules update |  |
| `lastSeenOn` | `number` | Timestamp of last heartbeat |  |
| 

`maxProcs` \*

 | `number` | GOMAXPROCS setting |  |
| 

`name` \*

 | `string` |  |  |
| 

`ruleUpdates` \*

 | `number` | Counter of rule updates |  |
| 

`status` \*

 | `string` |  | **Any of**:

-   `online`

-   `offline`

 |
| 

`uptime` \*

 | `number` | Counter of uptime in seconds |  |
| 

`version` \*

 | `string` |  |  |

---

### Sigsci Cloudwaf

`sigsci_cloudwaf` inherits from [Firewall](/data-model/schemas/Firewall.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`createdBy` \*

 | `string` |  |  |
| 

`deployment.DnsEntry` \*

 | `string` | Please use deploymentDnsEntry | **deprecated**: true |
| 

`deployment.EgressIps` \*

 | `array` of `string`s |  |  |
| `deployment.Message` | `string` | Please use deploymentMessage | **deprecated**: true |
| 

`deployment.Status` \*

 | `string` | Please use deploymentStatus | **deprecated**: true |
| 

`deploymentDnsEntry` \*

 | `string` |  |  |
| 

`deploymentEgressIps` \*

 | `array` of `string`s |  |  |
| `deploymentMessage` | `string` |  |  |
| 

`deploymentStatus` \*

 | `string` |  |  |
| 

`description` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`siteNames` \*

 | `array` of `string`s |  |  |
| 

`tlsMinVersion` \*

 | `string` |  |  |
| 

`updatedBy` \*

 | `string` |  |  |
| 

`useUploadedCertificates` \*

 | `boolean` |  |  |

---

### Sigsci Corp

`sigsci_corp` inherits from [Organization](/data-model/schemas/Organization.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`apiTokenMaxAge` \*

 | `number` |  |  |
| 

`authType` \*

 | `string` |  |  |
| 

`logoutURI` \*

 | `string` |  |  |
| 

`restrictedAccessTokens` \*

 | `boolean` |  |  |
| 

`samlCert` \*

 | `string` |  |  |
| 

`samlRequestCert` \*

 | `string` |  |  |
| 

`sessionMaxAgeDashboard` \*

 | `number` |  |  |
| 

`signRequestsUsingStoredCert` \*

 | `boolean` |  |  |
| 

`siteLimit` \*

 | `number` |  |  |
| `sitesUri` | `string` |  |  |
| 

`smallIconURI` \*

 | `string` |  |  |
| 

`ssoProvisioningConfigured` \*

 | `boolean` |  |  |

---

### Sigsci Site

`sigsci_site` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentLevel` \*

 | `string` |  |  |
| 

`blockDurationSeconds` \*

 | `number` |  |  |
| 

`blockHttpCode` \*

 | `number` |  |  |

---

### Sigsci User

`sigsci_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`role` \*

 | `string` |  |  |

---

---

Source: /integrations/directory/simplemdm

# SimpleMDM

Visualize SimpleMDM accounts, apps, devices, and users, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to add an API key within your SimpleMDM account to communicate with JupiterOne.

### Configuration in SimpleMDM

**To create your SimpleMDM API Key:**

1.  Navigate to **Account > API** from the SimpleMDM dashboard.
2.  Click **Add API Key** and provide a name for the key.
3.  When configuring the API key, provide the following roles with `read` permissions:
    -   Account
    -   Apps
    -   Devices
4.  Leave all other role permissions as `none` and press **Save**.
5.  Under **Secret Access Key**, click **Reveal** and copy the key for use in JupiterOne.

> **INFO**
> 
> For additional information on API key retrieval and authentication, see [SimpleMDM's documentation](https://api.simplemdm.com/#authentication).

### Configuration in JupiterOne

To install the SimpleMDM integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select SimpleMDM. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the SimpleMDM account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Lastly, your SimpleMDM **API Key** generated for use with JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `simplemdm_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `simplemdm_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Device | `simplemdm_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| User | `simplemdm_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `simplemdm_account` | **HAS** | `simplemdm_application` |
| `simplemdm_account` | **HAS** | `simplemdm_device` |
| `simplemdm_device` | **INSTALLED** | `simplemdm_application` |
| `simplemdm_user` | **OWNS** | `simplemdm_device` |

### Simplemdm User

`simplemdm_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `dataQuota` | `number` |  |  |
| `dataToSync` | `boolean` |  |  |
| `dataUsed` | `number` |  |  |
| `loggedIn` | `boolean` |  |  |
| `mobileAccount` | `boolean` |  |  |
| `secureToken` | `boolean` |  |  |
| `uid` | `integer` |  |  |

---

---

Source: /integrations/directory/slack

# Slack

Visualize Slack teams, channels, and users, map Slack users to employees, monitor changes through alerts and queries, and create issues within Slack channels.

## Installation

To install this integration, you will need to add the [JupiterOne Slack App](https://rhythmchat.slack.com/apps/A0146KZJJUQ-jupiterone) to the Slack workspace you wish to use with JupiterOne.

### Configuration in JupiterOne

You can add the JupiterOne Slack application through the JupiterOne dashboard. Navigate to the **Integrations** tab in JupiterOne and select Addigy. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Addigy account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Slack OAuth Scopes** are pre-populated. You can adjust as desired by selecting/de-selecting from the drop-down.
    
    > **NOTE**
    > 
    > All read scopes are used to ingest data into the JupiterOne graph and the write scopes are used for enabling the ability to send notifications to channels in the configured Slack team. [`chat:write`](https://api.slack.com/scopes/chat:write) is required to post messages in channels & conversations that the `@JupiterOne` bot is a member of and [`chat:write.public`](https://api.slack.com/scopes/chat:write.public) is required to post messages to channels that the `@JupiterOne` bot isn't a member of. Without one or both of `chat:write` and `chat:write.public` scopes, users _will not_ be able to configure JupiterOne alert rules with a Slack notification.
    

Once the integration instance settings have been defined, press **Save**. This will initiate an OAuth flow with Slack. Press **Begin Authorization** to initiate the process. During the flow, you will be need to specify the Slack workspace for which you wish to use the JupiterOne integration. **Allow** access to the workspace to conclude the OAuth flow and finalize the integration.

### JupiterOne Alert Rule Slack Notifications

JupiterOne can deliver Slack messages directly to any channel or specific users in a Slack Workspace once the JupiterOne Slack integration has been configured.

Be sure to specify the channel in the format `#channel`. You can have alerts sent to private channels as well if you have invited the JupiterOne Slack app to the private channel.

> **INFO**
> 
> For more detailed instructions on how to configure JupiterOne Alert Rules, please see the [JupiterOne Alert Rule configuration documentation](/features/insights-and-alerts/insights.md). Additionally, see the [JupiterOne Alert Rule Schema documentation](/api/alert-rules.md#rule-definition-reference) for technical details on alert rule/action properties.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Channel | `slack_channel` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| NHI User | `slack_user` | [User](https://docs.jupiterone.io/data-model/schemas/User), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Team | `slack_team` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| User | `slack_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `slack_channel` | **HAS** | `slack_user` |
| `slack_team` | **HAS** | `slack_user` |

### Slack User

`slack_user` inherits from [User](/data-model/schemas/User.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `admin` | `boolean` |  |  |
| `apiAppId` | `string` | Slack App ID that owns this bot user (`profile.api_app_id`). Join key against the Slack app catalog. |  |
| `appUser` | `boolean` |  |  |
| `bot` | `boolean` |  |  |
| `botId` | `string` | Slack Bot ID for the bot user (`profile.bot_id`); identifies the bot installation distinct from the underlying app. |  |
| `mfaEnabled` | `boolean` |  |  |
| 
`nhiType` \*

 | `string` |  | **const**: bot |
| `primaryTeamOwner` | `boolean` |  |  |
| `realName` | `string` |  |  |
| `restricted` | `boolean` |  |  |
| `teamAdmin` | `boolean` |  |  |
| `teamOwner` | `boolean` |  |  |
| `ultraRestricted` | `boolean` |  |  |
| `updatedOn` | `number` |  |  |
| `userId` | `string` |  |  |
| `userType` | `string` |  |  |

---

### Slack User

`slack_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `admin` | `boolean` |  |  |
| `appUser` | `boolean` |  |  |
| `bot` | `boolean` |  |  |
| `mfaEnabled` | `boolean` |  |  |
| `primaryTeamOwner` | `boolean` |  |  |
| `realName` | `string` |  |  |
| `restricted` | `boolean` |  |  |
| `teamAdmin` | `boolean` |  |  |
| `teamOwner` | `boolean` |  |  |
| `ultraRestricted` | `boolean` |  |  |
| `updatedOn` | `number` |  |  |
| `userId` | `string` |  |  |
| `userType` | `string` |  |  |

---

---

Source: /integrations/directory/snipe-it

# Snipe-IT

Visualizes Snipe-IT information, map Snipe-IT users to hardware, and monitors changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create a read-access Snipe-IT API key for this integration. See [their documentation](https://snipe-it.readme.io/reference) for more information on obtaining your key for use with JupiterOne.

### Configuration in JupiterOne

To install the Snipe-IT integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Snipe-IT. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Snipe-IT account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Snipe-IT **Hostname** and **API Token** (configured for read access).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `snipeit_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Consumable | `snipeit_consumable_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Hardware | `snipeit_hardware` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| License | `snipeit_licensed_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Location | `snipeit_location` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| Service | `snipeit_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `snipeit_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `snipeit_account` | **PROVIDES** | `snipeit_service` |
| `snipeit_account` | **MANAGES** | `snipeit_location` |
| `snipeit_account` | **MANAGES** | `snipeit_hardware` |
| `snipeit_account` | **HAS** | `snipeit_consumable_resource` |
| `snipeit_account` | **HAS** | `snipeit_licensed_application` |
| `snipeit_account` | **HAS** | `snipeit_user` |
| `snipeit_hardware` | **INSTALLED** | `snipeit_licensed_application` |
| `snipeit_user` | **HAS** | `snipeit_hardware` |
| `snipeit_user` | **USES** | `snipeit_consumable_resource` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `snipeit_location` | **HAS** | `snipeit_hardware` | FORWARD |
| `snipeit_user` | **IS** | `snipeit_person` | FORWARD |

### Snipeit Account

`snipeit_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `description` | `string` |  |  |
| 
`displayName` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`vendor` \*

 | `string` |  |  |

---

### Snipeit Consumable Resource

`snipeit_consumable_resource` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `availableActions.checkin` | `boolean` | Please use isCheckinActionAvailable instead. | **deprecated**: true |
| `availableActions.checkout` | `boolean` | Please use isCheckoutActionAvailable instead. | **deprecated**: true |
| `availableActions.delete` | `boolean` | Please use isDeleteActionAvailable instead. | **deprecated**: true |
| `availableActions.update` | `boolean` | Please use isUpdateActionAvailable instead. | **deprecated**: true |
| `category.id` | `number` | Please use categoryId instead. | **deprecated**: true |
| `category.name` | `string` | Please use categoryName instead. | **deprecated**: true |
| `categoryId` | `number` |  |  |
| `categoryName` | `string` |  |  |
| `company.id` | `number` | Please use companyId instead. | **deprecated**: true |
| `company.name` | `string` | Please use companyName instead. | **deprecated**: true |
| `companyId` | `number` |  |  |
| `companyName` | `string` |  |  |
| 
`consumableId` \*

 | `number` |  |  |
| `image` | `string` **|** `null` |  |  |
| `isCheckinActionAvailable` | `boolean` |  |  |
| `isCheckoutActionAvailable` | `boolean` |  |  |
| `isDeleteActionAvailable` | `boolean` |  |  |
| `isUpdateActionAvailable` | `boolean` |  |  |
| `isUserAbleToCheckout` | `boolean` |  |  |
| `itemNo` | `string` |  |  |
| `location.id` | `number` | Please use locationId instead. | **deprecated**: true |
| `location.name` | `string` | Please use locationName instead. | **deprecated**: true |
| `locationId` | `number` |  |  |
| `locationName` | `string` |  |  |
| `manufacturer.id` | `number` | Please use manufacturerId instead. | **deprecated**: true |
| `manufacturer.name` | `string` | Please use manufacturerName instead. | **deprecated**: true |
| `manufacturerId` | `number` |  |  |
| `manufacturerName` | `string` |  |  |
| `minAmt` | `number` |  |  |
| `modelNumber` | `string` **|** `null` |  |  |
| `notes` | `array` of `string`s |  |  |
| `orderNumber` | `string` |  |  |
| `purchaseCost` | `string` **|** `null` |  |  |
| `purchaseDate` | `number` | Please use purchasedOn instead. | **deprecated**: true |
| `purchasedOn` | `number` |  |  |
| `qty` | `number` |  |  |
| `remaining` | `number` |  |  |
| `userCanCheckout` | `boolean` | Please use isUserAbleToCheckout instead. | **deprecated**: true |

---

### Snipeit Hardware

`snipeit_hardware` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assignedName` | `string` |  |  |
| `assignedType` | `string` |  | **Any of**:
-   `user`

-   `asset`

-   `location`

 |
| 

`byod` \*

 | `boolean` | Please use BYOD instead. | **deprecated**: true |
| `company` | `string` **|** `null` |  |  |
| 

`EOL` \*

 | `boolean` |  |  |
| `locationId` | `number` |  |  |
| `purchaseCost` | `string` **|** `null` |  |  |
| 

`statusMeta` \*

 | `string` |  |  |
| 

`statusName` \*

 | `string` |  |  |
| `supplier` | `string` |  |  |

---

### Snipeit Licensed Application

`snipeit_licensed_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `availableActions.checkin` | `boolean` | Please use availableActionsCheckin instead. | **deprecated**: true |
| `availableActions.checkout` | `boolean` | Please use availableActionsCheckout instead. | **deprecated**: true |
| `availableActions.delete` | `boolean` | Please use availableActionsDelete instead. | **deprecated**: true |
| `availableActions.update` | `boolean` | Please use availableActionsUpdate instead. | **deprecated**: true |
| `availableActionsCheckin` | `boolean` |  |  |
| `availableActionsCheckout` | `boolean` |  |  |
| `availableActionsDelete` | `boolean` |  |  |
| `availableActionsUpdate` | `boolean` |  |  |
| `category.id` | `number` | Please use categoryId instead. | **deprecated**: true |
| `category.name` | `string` | Please use categoryName instead. | **deprecated**: true |
| `categoryId` | `number` |  |  |
| `categoryName` | `string` |  |  |
| `company` | `string` |  |  |
| `depreciation` | `string` |  |  |
| `expirationDate` | `number` | Please use expirationOn instead. | **deprecated**: true |
| `expirationOn` | `number` |  |  |
| `freeSeatsCount` | `number` |  |  |
| `licenseEmail` | `string` |  |  |
| `licenseId` | `number` |  |  |
| `licenseName` | `string` |  |  |
| `maintained` | `boolean` |  |  |
| `manufacturer.id` | `number` | Please use manufacturerId instead. | **deprecated**: true |
| `manufacturer.name` | `string` | Please use manufacturerName instead. | **deprecated**: true |
| `manufacturerId` | `number` |  |  |
| `manufacturerName` | `string` |  |  |
| `notes` | `array` of `string`s |  |  |
| `orderNumber` | `string` |  |  |
| `productKey` | `string` |  |  |
| `purchaseCost` | `string` **|** `null` |  |  |
| `purchaseDate` | `number` | Please use purchasedOn instead. | **deprecated**: true |
| `purchasedOn` | `number` |  |  |
| `purchaseOrder` | `string` |  |  |
| `reassignable` | `boolean` |  |  |
| `seats` | `number` |  |  |
| `supplier.id` | `number` | Please use supplierId instead. | **deprecated**: true |
| `supplier.name` | `string` | Please use supplierName instead. | **deprecated**: true |
| `supplierId` | `number` |  |  |
| `supplierName` | `string` |  |  |
| `terminationDate` | `number` | Please use terminationOn instead. | **deprecated**: true |
| `terminationOn` | `number` |  |  |
| `userCanCheckout` | `boolean` |  |  |

---

### Snipeit Location

`snipeit_location` inherits from [Site](/data-model/schemas/Site.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `address` | `string` **|** `null` |  |  |
| `address2` | `string` **|** `null` |  |  |
| 
`assetsCount` \*

 | `number` |  |  |
| 

`assignedAssetsCount` \*

 | `number` |  |  |
| 

`city` \*

 | `string` |  |  |
| 

`country` \*

 | `string` |  |  |
| `currency` | `string` **|** `null` |  |  |
| `image` | `string` **|** `null` |  |  |
| `isCloneActionAvailable` | `boolean` |  |  |
| `isDeleteActionAvailable` | `boolean` |  |  |
| `isUpdateActionAvailable` | `boolean` |  |  |
| 

`locationId` \*

 | `number` |  |  |
| 

`rtdAssetsCount` \*

 | `number` |  |  |
| `state` | `string` **|** `null` |  |  |
| 

`usersCount` \*

 | `number` |  |  |
| `zip` | `string` **|** `null` |  |  |

---

### Snipeit Service

`snipeit_service` inherits from [Service](/data-model/schemas/Service.md)

---

### Snipeit User

`snipeit_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessoriesCount` | `number` |  |  |
| `address` | `string` **|** `null` |  |  |
| `assetsCount` | `number` |  |  |
| `avatar` | `string` |  |  |
| `city` | `string` **|** `null` |  |  |
| `company.id` | `number` | Please use companyId instead. | **deprecated**: true |
| `company.name` | `string` | Please use companyName instead. | **deprecated**: true |
| `companyId` | `number` |  |  |
| `companyName` | `string` |  |  |
| `consumablesCount` | `number` |  |  |
| `country` | `string` **|** `null` |  |  |
| `createdBy.id` | `number` | Please use createdById instead. | **deprecated**: true |
| `createdBy.name` | `string` | Please use createdByName instead. | **deprecated**: true |
| `createdById` | `number` |  |  |
| `createdByName` | `string` |  |  |
| `deletedAt` | `number` |  |  |
| `department.id` | `number` | Please use departmentId instead. | **deprecated**: true |
| `department.name` | `string` | Please use departmentName instead. | **deprecated**: true |
| `departmentId` | `number` |  |  |
| `departmentName` | `string` |  |  |
| `employeeNum` | `string` **|** `null` |  |  |
| `isLdapImport` | `boolean` |  |  |
| `jobtitle` | `string` **|** `null` |  |  |
| `lastLogin` | `number` |  |  |
| `ldapImport` | `boolean` | Please use isLdapImport instead. | **deprecated**: true |
| `licensesCount` | `number` |  |  |
| `locale` | `string` |  |  |
| `location.id` | `number` | Please use locationId instead. | **deprecated**: true |
| `location.name` | `string` | Please use locationName instead. | **deprecated**: true |
| `locationId` | `number` |  |  |
| `locationName` | `string` |  |  |
| `manager.id` | `number` | Please use managerId instead. | **deprecated**: true |
| `manager.name` | `string` | Please use managerName instead. | **deprecated**: true |
| `managerId` | `number` |  |  |
| `managerName` | `string` |  |  |
| `permissions.accessories.checkin` | `string` |  |  |
| `permissions.accessories.checkout` | `string` |  |  |
| `permissions.accessories.create` | `string` |  |  |
| `permissions.accessories.delete` | `string` |  |  |
| `permissions.accessories.edit` | `string` |  |  |
| `permissions.accessories.view` | `string` |  |  |
| `permissions.admin` | `string` |  |  |
| `permissions.assets.audit` | `string` |  |  |
| `permissions.assets.checkin` | `string` |  |  |
| `permissions.assets.checkout` | `string` |  |  |
| `permissions.assets.create` | `string` |  |  |
| `permissions.assets.delete` | `string` |  |  |
| `permissions.assets.edit` | `string` |  |  |
| `permissions.assets.view` | `string` |  |  |
| `permissions.assets.view.requestable` | `string` |  |  |
| `permissions.categories.create` | `string` |  |  |
| `permissions.categories.delete` | `string` |  |  |
| `permissions.categories.edit` | `string` |  |  |
| `permissions.categories.view` | `string` |  |  |
| `permissions.companies.create` | `string` |  |  |
| `permissions.companies.delete` | `string` |  |  |
| `permissions.companies.edit` | `string` |  |  |
| `permissions.companies.view` | `string` |  |  |
| `permissions.components.checkin` | `string` |  |  |
| `permissions.components.checkout` | `string` |  |  |
| `permissions.components.create` | `string` |  |  |
| `permissions.components.delete` | `string` |  |  |
| `permissions.components.edit` | `string` |  |  |
| `permissions.components.view` | `string` |  |  |
| `permissions.consumables.checkout` | `string` |  |  |
| `permissions.consumables.create` | `string` |  |  |
| `permissions.consumables.delete` | `string` |  |  |
| `permissions.consumables.edit` | `string` |  |  |
| `permissions.consumables.view` | `string` |  |  |
| `permissions.customfields.create` | `string` |  |  |
| `permissions.customfields.delete` | `string` |  |  |
| `permissions.customfields.edit` | `string` |  |  |
| `permissions.customfields.view` | `string` |  |  |
| `permissions.departments.create` | `string` |  |  |
| `permissions.departments.delete` | `string` |  |  |
| `permissions.departments.edit` | `string` |  |  |
| `permissions.departments.view` | `string` |  |  |
| `permissions.depreciations.create` | `string` |  |  |
| `permissions.depreciations.delete` | `string` |  |  |
| `permissions.depreciations.edit` | `string` |  |  |
| `permissions.depreciations.view` | `string` |  |  |
| `permissions.import` | `string` |  |  |
| `permissions.kits.create` | `string` |  |  |
| `permissions.kits.delete` | `string` |  |  |
| `permissions.kits.edit` | `string` |  |  |
| `permissions.kits.view` | `string` |  |  |
| `permissions.licenses.checkout` | `string` |  |  |
| `permissions.licenses.create` | `string` |  |  |
| `permissions.licenses.delete` | `string` |  |  |
| `permissions.licenses.edit` | `string` |  |  |
| `permissions.licenses.files` | `string` |  |  |
| `permissions.licenses.keys` | `string` |  |  |
| `permissions.licenses.view` | `string` |  |  |
| `permissions.locations.create` | `string` |  |  |
| `permissions.locations.delete` | `string` |  |  |
| `permissions.locations.edit` | `string` |  |  |
| `permissions.locations.view` | `string` |  |  |
| `permissions.manufacturers.create` | `string` |  |  |
| `permissions.manufacturers.delete` | `string` |  |  |
| `permissions.manufacturers.edit` | `string` |  |  |
| `permissions.manufacturers.view` | `string` |  |  |
| `permissions.models.create` | `string` |  |  |
| `permissions.models.delete` | `string` |  |  |
| `permissions.models.edit` | `string` |  |  |
| `permissions.models.view` | `string` |  |  |
| `permissions.reports.view` | `string` |  |  |
| `permissions.self.api` | `string` |  |  |
| `permissions.self.checkoutAssets` | `string` |  |  |
| `permissions.self.editLocation` | `string` |  |  |
| `permissions.self.twoFactor` | `string` |  |  |
| `permissions.statuslabels.create` | `string` |  |  |
| `permissions.statuslabels.delete` | `string` |  |  |
| `permissions.statuslabels.edit` | `string` |  |  |
| `permissions.statuslabels.view` | `string` |  |  |
| `permissions.superuser` | `string` **|** `integer` |  |  |
| `permissions.suppliers.create` | `string` |  |  |
| `permissions.suppliers.delete` | `string` |  |  |
| `permissions.suppliers.edit` | `string` |  |  |
| `permissions.suppliers.view` | `string` |  |  |
| `permissions.users.create` | `string` |  |  |
| `permissions.users.delete` | `string` |  |  |
| `permissions.users.edit` | `string` |  |  |
| `permissions.users.view` | `string` |  |  |
| `phone` | `string` **|** `null` |  |  |
| 
`remote` \*

 | `boolean` |  |  |
| `state` | `string` **|** `null` |  |  |
| 

`twoFactorEnrolled` \*

 | `boolean` |  |  |
| `userId` | `number` |  |  |
| `website` | `string` **|** `null` |  |  |
| `zip` | `string` **|** `null` |  |  |

---

## Release Notes

-   **2026-01-14** — Added hardware category filtering to the Snipe-IT integration, allowing ingestion to be limited to assets matching specific configured category IDs.
-   **2025-07-24** — Added configuration option to include Snipe-IT custom fields as properties on hardware asset entities.

---

Source: /integrations/directory/snowflake

# Snowflake

Visualize Snowflake cloud resources, map Snowflake users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> This integration ingests resources from tables in the Snowflake system using `SHOW` commands. Ensure that the credentials provided to JupiterOne are configured with the [necessary read permissions](https://docs.snowflake.com/en/user-guide/security-access-control-privileges.html#schema-privileges) to perform these commands.

### Configuration in Snowflake

This integration supports two authentication methods:

1.  **Basic Authentication**
2.  **Key-Pair Authentication** (Recommended)

For **Key-Pair Authentication**:

-   The user must generate a private and public key pair.
-   Upload the public key to your Snowflake account and use the private key in the integration configuration.
-   Follow the [Snowflake documentation on key-pair authentication](https://docs.snowflake.com/en/user-guide/key-pair-auth#configuring-key-pair-authentication) to generate the keys.
-   Store the private key securely, as you will need it to complete the integration setup.

### Configuration in JupiterOne

To configure the Snowflake integration in JupiterOne:

1.  Navigate to the **Integrations** tab and select **Snowflake**.
2.  Click **New Instance** to begin the setup.

## Authentication Methods

### Key-Pair Authentication (Recommended)

Requires the following parameters:

-   **Snowflake Account Name**: The full name of your Snowflake account.
-   **Username**: The Snowflake username for authentication.
-   **Private Key File**: The private key file (either encrypted or unencrypted; encryption is strongly recommended). Refer to the [Snowflake documentation](https://docs.snowflake.com/en/user-guide/key-pair-auth#configuring-key-pair-authentication) for instructions on generating the key pair.

### Basic Authentication

Requires the following parameters:

-   **Snowflake Account Name**: The full name of your Snowflake account.
    
-   **Username** and **Password**: Credentials of the Snowflake user for authentication.
    
-   **Role**: The default security role for the session after authentication.
    
    _Note:_ If ingesting the `ADMIN` database:
    
    1.  You must grant **ACCOUNTADMIN** privileges to access the `ADMIN` database.
    2.  Alternatively, use the **SECURITYADMIN** role. [Learn more about roles](https://docs.snowflake.com/en/user-guide/security-access-control-considerations).

## General Settings

-   **Account Name**: Used to identify the Snowflake account in JupiterOne. Ingested entities will be tagged with this value as `tag.AccountName`.
-   **Description**: An optional field to help identify the integration instance.
-   **Polling Interval**: Set the desired frequency for data updates. You can leave this as `DISABLED` and manually trigger the integration.

Once all the values are provided, click **Create** to complete the integration setup.

### Next Steps

With your integration instance configured, it will start running based on the polling interval you selected, ingesting data into JupiterOne. For further details on managing your integration instance, refer to our [Instance Management Guide](/integrations/instance-management.md).

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `snowflake_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Database | `snowflake_database` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Organization | `snowflake_organization` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Role | `snowflake_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Schema | `snowflake_schema` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Table | `snowflake_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| User | `snowflake_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Warehouse | `snowflake_warehouse` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `snowflake_account` | **HAS** | `snowflake_user` |
| `snowflake_database` | **ALLOWS** | `snowflake_role` |
| `snowflake_database` | **HAS** | `snowflake_schema` |
| `snowflake_organization` | **HAS** | `snowflake_account` |
| `snowflake_schema` | **HAS** | `snowflake_table` |
| `snowflake_user` | **ASSIGNED** | `snowflake_role` |
| `snowflake_warehouse` | **HAS** | `snowflake_database` |

### Snowflake User

`snowflake_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `comment` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `defaultNamespace` | `string` |  |  |
| `defaultRole` | `string` |  |  |
| `defaultWarehouse` | `string` |  |  |
| `disabled` | `boolean` |  |  |
| `expiresAtTime` | `number` |  |  |
| `externalAuthDuoEnabled` | `boolean` |  |  |
| `externalAuthUid` | `string` |  |  |
| `fullName` | `string` |  |  |
| `hasPassword` | `boolean` |  |  |
| `hasRsaPublicKey` | `boolean` |  |  |
| `lastLogin` | `number` |  |  |
| `lockedUntilTime` | `number` |  |  |
| `loginName` | `string` |  |  |
| `minsToUnlock` | `string` |  |  |
| `mustChangePassword` | `boolean` |  |  |
| `owner` | `string` |  |  |
| `snowflakeLock` | `boolean` |  |  |

---

## Release Notes

-   **2025-02-28** — Added normalized email, email domain, and short login ID properties to Snowflake user entities.
-   **2024-10-11** — Added key-pair authentication support as an alternative to password-based authentication for Snowflake connections.
-   **2024-09-12** — Added Snowflake organization and account entities, enabling visibility into Snowflake organizational structure and account membership.

---

Source: /integrations/directory/snyk

# Snyk

Visualize Snyk code repositories and findings, and monitor changes through queries and alerts.

## Installation

To use this integration, JupiterOne requires a Snyk API token with at minimum **Org Viewer** access to the Snyk organization you want to ingest. If you are integrating at the group level (to ingest multiple organizations), the token must have **Group Viewer** access to the Snyk group.

> **INFO**
> 
> For more information on Snyk API authentication, refer to the [Snyk authentication documentation](https://docs.snyk.io/snyk-api/authentication-for-api).

### Prerequisites

1.  **Snyk API token** — Obtain your API token from Snyk:
    
    1.  Click your profile avatar in the upper-right corner of the Snyk dashboard.
    2.  Select **Account Settings**.
    3.  Under **General**, click **click to show** next to **Auth Token** and copy the value.
2.  **Organization ID or Group ID** — Provide one of the following:
    
    -   **Organization ID** — Found in Snyk under **Settings > General** for the organization. Required if ingesting a single organization.
    -   **Group ID** — Found in Snyk under **Group Settings > General**. Required if ingesting all organizations within a group.

### Configuration in JupiterOne

To install the Snyk integration in JupiterOne, navigate to the **Integrations** tab and select **Snyk**. Click **New Instance** to begin configuring your integration, providing the following:

-   **Account Name** — A label used to identify this integration instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **AccountName** toggle is enabled.
    
-   **Description** — An optional description to help distinguish this instance from others.
    
-   **Polling Interval** — How often JupiterOne should collect data from Snyk. You may leave this as `DISABLED` and trigger the integration manually.
    
-   **API Key** — Your Snyk API token.
    
-   **Organization ID or Group ID** — Enter either your **Organization ID** (to ingest a single Snyk organization) or your **Group ID** (to ingest all organizations within a Snyk group). Exactly one of these is required.
    

Click **Create** after all values are provided.

## Data Volume Configuration

### Data Filtering Options

These optional settings control which findings are ingested. Reducing the scope can significantly lower the number of entities stored in JupiterOne.

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Issue Types** | The types of issues to fetch. When nothing is selected, all issue types are fetched. | All | Package Vulnerabilities, License Issues, Cloud Configuration Issues, Code Quality Issues, Custom Issues, Configuration Issues |
| **Severity Levels** | The severity levels of issues to fetch. When nothing is selected, all severity levels are fetched. | All | Critical, High, Medium, Low |
| **Include Resolved Findings** | When enabled, resolved findings are included alongside open findings. | Disabled | — |
| **Include Ignored Findings** | When enabled, ignored findings are included alongside non-ignored findings. | Disabled | — |

### Next steps

Once your integration instance is configured, it will begin running on the polling interval you selected. Continue on to our [instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (2)

-   `Group Viewer`
-   `Org Viewer`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (7)

-   `https://api.snyk.io/rest/orgs/{orgId}/issues`
-   `https://api.snyk.io/rest/orgs/{orgId}/projects`
-   `https://snyk.io/api/v1/group/{groupId}/orgs`
-   `https://snyk.io/api/v1/group/{groupId}/roles`
-   `https://snyk.io/api/v1/org/{orgId}/members`
-   `https://snyk.io/api/v1/org/{orgId}/project/{projectId}/history`
-   `https://snyk.io/api/v1/orgs`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (9)

-   [https://apidocs.snyk.io/?version=2023-05-29#get-/orgs/-org\_id-/projects](https://apidocs.snyk.io/?version=2023-05-29#get-/orgs/-org_id-/projects)
-   [https://apidocs.snyk.io/?version=2024-06-21#get-/orgs/-org\_id-/issues](https://apidocs.snyk.io/?version=2024-06-21#get-/orgs/-org_id-/issues)
-   [https://docs.snyk.io/snyk-admin/user-roles-and-permissions](https://docs.snyk.io/snyk-admin/user-roles-and-permissions)
-   [https://docs.snyk.io/snyk-api/authentication-for-api](https://docs.snyk.io/snyk-api/authentication-for-api)
-   [https://snyk.docs.apiary.io/#reference/groups/list-all-organisations-in-a-group/list-all-organisations-in-a-group](https://snyk.docs.apiary.io/#reference/groups/list-all-organisations-in-a-group/list-all-organisations-in-a-group)
-   [https://snyk.docs.apiary.io/#reference/groups/list-all-roles-in-a-group/list-all-roles-in-a-group](https://snyk.docs.apiary.io/#reference/groups/list-all-roles-in-a-group/list-all-roles-in-a-group)
-   [https://snyk.docs.apiary.io/#reference/organisations/members-in-organisation/list-members](https://snyk.docs.apiary.io/#reference/organisations/members-in-organisation/list-members)
-   [https://snyk.docs.apiary.io/#reference/orgs/the-snyk-organisation-for-a-request/list-all-the-organisations-a-user-belongs-to](https://snyk.docs.apiary.io/#reference/orgs/the-snyk-organisation-for-a-request/list-all-the-organisations-a-user-belongs-to)
-   [https://snyk.docs.apiary.io/#reference/projects/all-projects/list-all-projects](https://snyk.docs.apiary.io/#reference/projects/all-projects/list-all-projects)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (10)

| Step | Roles | Endpoints |
| --- | --- | --- |
| Build Account and Organizations Relationship | \- | \- |
| Build Finding Coordinates | \- | \- |
| Build Group and Organizations Relationship | \- | \- |
| Build Project SCM Repo Relationships | \- | \- |
| Build User and Group Role Relationship | \- | \- |
| Build User and Role Relationship | \- | \- |
| Fetch findings | `Org Viewer` | `https://api.snyk.io/rest/orgs/{orgId}/issues` |
| Fetch Issues | \- | \- |
| Fetch Organization Members | `Org Viewer` | `https://snyk.io/api/v1/org/{orgId}/members` |
| Fetch Projects | `Org Viewer` | `https://api.snyk.io/rest/orgs/{orgId}/projects`, `https://snyk.io/api/v1/org/{orgId}/project/{projectId}/history` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Snyk Account | `snyk_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Snyk Coordinate | `snyk_finding_coordinate` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Snyk Coordinate Location | `snyk_finding_coordinate_location` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Snyk Finding | `snyk_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Snyk Finding | `snyk_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Snyk Finding | `snyk_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Weakness](https://docs.jupiterone.io/data-model/schemas/Weakness) |
| Snyk Group | `snyk_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Snyk Issue | `snyk_issue` | [Issue](https://docs.jupiterone.io/data-model/schemas/Issue) |
| Snyk Organization | `snyk_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Snyk Project | `snyk_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Snyk Role | `snyk_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Snyk Service | `snyk_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Snyk User | `snyk_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `snyk_account` | **HAS** | `snyk_service` |
| `snyk_account` | **HAS** | `snyk_group` |
| `snyk_account` | **HAS** | `snyk_organization` |
| `snyk_finding` | **IDENTIFIED** | `snyk_finding_coordinate` |
| `snyk_finding_coordinate` | **HAS** | `snyk_finding_coordinate_location` |
| `snyk_group` | **HAS** | `snyk_organization` |
| `snyk_group` | **HAS** | `snyk_role` |
| `snyk_issue` | **REPORTED** | `snyk_finding` |
| `snyk_organization` | **HAS** | `snyk_project` |
| `snyk_organization` | **HAS** | `snyk_user` |
| `snyk_organization` | **HAS** | `snyk_role` |
| `snyk_project` | **HAS** | `snyk_finding` |
| `snyk_project` | **HAS** | `snyk_issue` |
| `snyk_service` | **SCANS** | `snyk_project` |
| `snyk_user` | **ASSIGNED** | `snyk_role` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `snyk_finding` | **IS** | `cve` | FORWARD |
| `snyk_finding` | **EXPLOITS** | `cwe` | FORWARD |
| `snyk_project` | **SCANS** | `github_repo` | FORWARD |
| `snyk_project` | **SCANS** | `bitbucket_repo` | FORWARD |
| `snyk_project` | **SCANS** | `azure_devops_repo` | FORWARD |
| `snyk_project` | **SCANS** | `gitlab_project` | FORWARD |

### Snyk Finding

`snyk_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cve` \*

 | `array` **|** `null` |  |  |
| 

`cvssScore` \*

 | `number` **|** `null` |  |  |
| 

`cwe` \*

 | `array` **|** `null` |  |  |
| `ignored` | `boolean` |  |  |

---

### Snyk Finding

`snyk_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cve` \*

 | `array` **|** `null` |  |  |
| 

`cvssScore` \*

 | `number` **|** `null` |  |  |
| 

`cwe` \*

 | `array` **|** `null` |  |  |
| `ignored` | `boolean` |  |  |

---

### Snyk Finding

`snyk_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Weakness](/data-model/schemas/Weakness.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cve` \*

 | `array` **|** `null` |  |  |
| 

`cvssScore` \*

 | `number` **|** `null` |  |  |
| 

`cwe` \*

 | `array` **|** `null` |  |  |
| `ignored` | `boolean` |  |  |

---

### Snyk Finding Coordinate Location

`snyk_finding_coordinate_location` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`commitId` \*

 | `string` |  |  |
| 

`endColumn` \*

 | `number` |  |  |
| 

`endLine` \*

 | `number` |  |  |
| 

`file` \*

 | `string` |  |  |
| 

`rawPath` \*

 | `string` |  |  |
| 

`startColumn` \*

 | `number` |  |  |
| 

`startLine` \*

 | `number` |  |  |

---

### Snyk Issue

`snyk_issue` inherits from [Issue](/data-model/schemas/Issue.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`active` \*

 | `boolean` |  |  |
| `category` | `string` |  |  |
| `ignored` | `boolean` |  |  |
| 

`issueId` \*

 | `string` |  |  |
| `issueKey` | `string` |  |  |
| `issueType` | `string` |  |  |
| `numericSeverity` | `number` |  |  |
| `references` | `array` of `string`s |  |  |
| `resolutionDetails` | `string` | Free-form remediation context for the resolution. From attributes.resolution.details. May describe fix method (e.g., upgrade or patch) when available; often empty. |  |
| `resolutionType` | `string` | How Snyk resolved the issue. From attributes.resolution.type. Known values: "fixed" (remediated and no longer present), "disappeared" (no longer detected in latest scan), "ignored" (intentionally suppressed), "patched" (remediated via Snyk patch). |  |
| `resolvedOn` | `number` | Timestamp when Snyk marked the issue resolved. Populated from attributes.resolution.resolved\_at; present only when status=resolved. |  |
| `severity` | `string` |  |  |
| `status` | `string` |  |  |

---

### Snyk User

`snyk_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `admin` | `boolean` |  |  |
| `role` | `string` |  |  |

---

## Release Notes

-   **2026-07-09** — Snyk projects now link to their source code repositories in GitHub, Bitbucket, Azure DevOps, and GitLab via mapped relationships.
-   **2026-02-04** — Added ignored property to Snyk finding entities, indicating whether the finding has been suppressed.
-   **2026-01-14** — Added configuration options to include resolved and ignored Snyk findings in ingestion, in addition to the default open-only behavior.
-   **2025-11-18** — Added CVE ID to Snyk finding entities for unified vulnerability querying.
-   **2025-11-06** — Added repository full name property to Snyk finding entities.
-   **2025-09-09** — Added configuration options to filter Snyk finding ingestion by issue type and severity level.
-   **2025-08-11** — Added Snyk finding coordinate location entities, exposing source code file path, commit, and line and column positions for each finding.
-   **2025-06-13** — Added branch name and branch file path to Snyk finding entities for dependency context.

---

Source: /integrations/directory/socket

# Socket

Monitor your open source supply chain security with Socket. This integration ingests organizations, repositories, software packages and their dependency trees, security alerts, and vulnerability findings to provide visibility into supply chain risks, malware, typosquatting, and known CVEs across your dependencies.

## Installation

> **INFO**
> 
> You will need a Socket.dev API key to configure this integration. API keys can be created in the Socket dashboard under **Settings > API Keys**. See the [Socket API documentation](https://docs.socket.dev/reference/introduction-to-socket-api) for more information.

To install the Socket integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Socket. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **API Key** - Your Socket.dev API key (Bearer token) used to authenticate requests.
    
-   **Polling Interval** - Select a frequency that meets your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

### Configuration options

#### Alerts

| Field | Type | Description | Default |
| --- | --- | --- | --- |
| **Alert Severities** | Multi-select | Select which alert severities to ingest | Critical, High |
| **Alert Statuses** | Multi-select | Select which alert statuses to ingest | Open |
| **Alerts Since Days** | Select | Only ingest alerts created in the last N days | 90 |

#### Packages

| Field | Type | Description | Default |
| --- | --- | --- | --- |
| **Include Transitive Dependencies** | Boolean | Whether to ingest transitive (indirect) dependencies from full scans. Enabling this can produce very large graphs. | Enabled |
| **Repositories** | String | Comma-separated list of repository names to ingest. Leave empty to ingest all repositories. | All |

### What data is ingested?

| Data | Description |
| --- | --- |
| **Organizations** | Your Socket.dev organization account |
| **Repositories** | Code repositories monitored by Socket, with mapped relationships to GitHub repos when the GitHub App is installed |
| **Packages** | Software packages and dependencies discovered via full scans, including health scores (overall, license, maintenance, quality, supply chain, vulnerability) |
| **Dependency Trees** | Package-to-package USES relationships representing the dependency graph within each repository |
| **Alerts** | Security alerts for non-CVE issues (malware, typosquatting, install scripts, etc.) |
| **Vulnerability Findings** | CVE-linked vulnerability findings with CVSS scores, CWE IDs, EPSS scores, and KEV status |

### Required API scopes

The following Socket.dev API scopes are required for full ingestion:

| Scope | Used by |
| --- | --- |
| _(no extra scope)_ | Listing organizations |
| `repo:list` | Listing repositories |
| `full-scans:list` | Streaming package data from full scans |
| `alerts:list` | Listing security alerts |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (3)

-   `alerts:list`
-   `full-scans:list`
-   `repo:list`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (4)

-   `https://api.socket.dev/v0/organizations`
-   `https://api.socket.dev/v0/orgs/{org_slug}/alerts`
-   `https://api.socket.dev/v0/orgs/{org_slug}/full-scans/{full_scan_id}`
-   `https://api.socket.dev/v0/orgs/{org_slug}/repos`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (4)

-   [https://docs.socket.dev/reference/get-full-scan](https://docs.socket.dev/reference/get-full-scan)
-   [https://docs.socket.dev/reference/get-org-alerts](https://docs.socket.dev/reference/get-org-alerts)
-   [https://docs.socket.dev/reference/get-organizations](https://docs.socket.dev/reference/get-organizations)
-   [https://docs.socket.dev/reference/get-repositories](https://docs.socket.dev/reference/get-repositories)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (3)

| Step | OAuth Scopes | Endpoints |
| --- | --- | --- |
| Fetch Alerts | `alerts:list` | `https://api.socket.dev/v0/orgs/{org_slug}/alerts` |
| Fetch Packages | `full-scans:list` | `https://api.socket.dev/v0/orgs/{org_slug}/full-scans/{full_scan_id}` |
| Fetch Repositories | `repo:list` | `https://api.socket.dev/v0/orgs/{org_slug}/repos` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Alert | `socket_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Organization | `socket_organization` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Package | `socket_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Repository | `socket_repository` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Service | `socket_supply_chain_scanner` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Vulnerability Finding | `socket_vulnerability_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `socket_organization` | **HAS** | `socket_supply_chain_scanner` |
| `socket_organization` | **HAS** | `socket_repository` |
| `socket_package` | **USES** | `socket_package` |
| `socket_package` | **HAS** | `socket_alert` |
| `socket_package` | **HAS** | `socket_vulnerability_finding` |
| `socket_repository` | **HAS** | `socket_package` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `socket_repository` | **IS** | `github_repo` | FORWARD |

### Socket Alert

`socket_alert` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alertKey` \*

 | `string` | Unique alert instance key |  |
| 

`alertType` \*

 | `string` | Type of alert (e.g. typosquat, malware, install, phantom, obfuscatedCode) |  |
| 

`clearedOn` \*

 | `number` **|** `null` | Timestamp when the alert was cleared |  |
| 

`fixDescription` \*

 | `string` **|** `null` | Recommended fix description |  |
| 

`fixType` \*

 | `string` **|** `null` | Recommended fix type (e.g. upgrade, remove) |  |
| 

`webLink` \*

 | `string` | URL to the alert dashboard |  |

---

### Socket Organization

`socket_organization` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`logoUrl` \*

 | `string` **|** `null` | URL of the organization logo |  |
| 

`plan` \*

 | `string` | Subscription plan name |  |
| 

`slug` \*

 | `string` | Organization slug identifier |  |
| 

`vendor` \*

 | `string` | Vendor name |  |

---

### Socket Package

`socket_package` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`author` \*

 | `array` **|** `null` | Package authors or maintainers |  |
| 

`isDead` \*

 | `boolean` | Whether this package is deprecated or abandoned |  |
| 

`isDev` \*

 | `boolean` | Whether this is a development-only dependency |  |
| 

`isDirect` \*

 | `boolean` | Whether this is a direct dependency |  |
| 

`license` \*

 | `string` **|** `null` | SPDX license identifier |  |
| 

`namespace` \*

 | `string` | Package namespace or scope |  |
| 

`packageType` \*

 | `string` | Package ecosystem type (e.g. npm, pypi, maven) |  |
| 

`size` \*

 | `number` **|** `null` | Total size of the package in bytes |  |
| 

`socketScoreLicense` \*

 | `number` **|** `null` | Socket license score (0.0–1.0) |  |
| 

`socketScoreMaintenance` \*

 | `number` **|** `null` | Socket maintenance score (0.0–1.0) |  |
| 

`socketScoreOverall` \*

 | `number` **|** `null` | Socket overall score (0.0–1.0) |  |
| 

`socketScoreQuality` \*

 | `number` **|** `null` | Socket quality score (0.0–1.0) |  |
| 

`socketScoreSupplyChain` \*

 | `number` **|** `null` | Socket supply chain score (0.0–1.0) |  |
| 

`socketScoreVulnerability` \*

 | `number` **|** `null` | Socket vulnerability score (0.0–1.0) |  |
| 

`version` \*

 | `string` | Package version string |  |

---

### Socket Repository

`socket_repository` inherits from [CodeRepo](/data-model/schemas/CodeRepo.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`defaultBranch` \*

 | `string` **|** `null` | Default branch name |  |
| 

`githubRepoName` \*

 | `string` **|** `null` | Associated GitHub repository name (owner/repo) when GitHub App is installed |  |
| 

`headFullScanId` \*

 | `string` **|** `null` | ID of the most recent full scan for this repository |  |
| 

`isArchived` \*

 | `boolean` | Whether the repository is archived |  |
| 

`isPublic` \*

 | `boolean` | Whether the repository is publicly visible |  |
| 

`slug` \*

 | `string` | Repository slug identifier |  |
| 

`workspace` \*

 | `string` | Workspace this repository belongs to |  |

---

### Socket Supply Chain Scanner

`socket_supply_chain_scanner` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` of `string`s | Service categories |  |
| 

`vendor` \*

 | `string` | Vendor name |  |

---

### Socket Vulnerability Finding

`socket_vulnerability_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alertKey` \*

 | `string` | Unique alert instance key |  |
| 

`alertType` \*

 | `string` | Type of alert |  |
| 

`clearedOn` \*

 | `number` **|** `null` | Timestamp when the finding was cleared |  |
| 

`cveId` \*

 | `string` **|** `null` | CVE identifier |  |
| 

`cvssScore` \*

 | `number` **|** `null` | CVSS base score |  |
| 

`cvssVector` \*

 | `string` **|** `null` | CVSS vector string |  |
| 

`cweIds` \*

 | `array` **|** `null` | CWE identifiers |  |
| 

`epssPercentile` \*

 | `number` **|** `null` | EPSS percentile ranking |  |
| 

`epssScore` \*

 | `number` **|** `null` | EPSS probability score |  |
| 

`fixedVersion` \*

 | `string` **|** `null` | First patched version identifier |  |
| 

`ghsaIds` \*

 | `array` **|** `null` | GitHub Security Advisory identifiers |  |
| 

`isKev` \*

 | `boolean` **|** `null` | Whether this is a CISA Known Exploited Vulnerability |  |
| 

`webLink` \*

 | `string` | URL to the alert dashboard |  |

---

---

Source: /integrations/directory/sonarcloud

# SonarCloud

Visualize SonarCloud data, map SonarCloud users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create an API key on SonarCloud for this integration. See [their documentation](https://docs.sonarcloud.io/advanced-setup/user-accounts/) for more information.

### Configuration in JupiterOne

To install the SonarCloud integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select SonarCloud. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the SonarCloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your SonarCloud **API Token** and **Organization Keys** to be ingested. For instances that wish to ingest multiple SonarCloud organizations, be sure to separate each organization key with a comma.
    

The organization key can be found at: [https://sonarcloud.io/organizations/YOUR-ORGANIZATION/edit](https://sonarcloud.io/organizations/YOUR-ORGANIZATION/edit). At the bottom of the page, you will find the "Edit organization key" section, which displays the exact organization key. You can also find it by clicking your user icon in the top right corner and selecting your organization. Once selected, a label such as "Key: YOUR-ORG-KEY" will appear in the same corner.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Issue | `sonarcloud_issue` | [Issue](https://docs.jupiterone.io/data-model/schemas/Issue) |
| Organization | `sonarcloud_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Project | `sonarcloud_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| User | `sonarcloud_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| UserGroup | `sonarcloud_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sonarcloud_group` | **HAS** | `sonarcloud_user` |
| `sonarcloud_organization` | **HAS** | `sonarcloud_group` |
| `sonarcloud_organization` | **HAS** | `sonarcloud_project` |
| `sonarcloud_project` | **HAS** | `sonarcloud_issue` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `sonarcloud_project` | **SCANS** | `CodeRepo` | FORWARD |

### Sonarcloud User

`sonarcloud_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `organizationAdmin` | `boolean` |  |  |

---

---

Source: /integrations/directory/sonarqube

# SonarQube

Visualize Sonarqube projects and users, map Sonarqube users to employees, and monitor user changes through queries and alerts.

## Installation

The SonarQube integration ingests projects, users, user groups, and code findings using the SonarQube REST API. Before configuring the integration in JupiterOne, create a SonarQube API token for a user with the required permissions.

### Prerequisites

The API token must belong to a user with the **Administer System** global permission. This permission allows the integration to enumerate all projects, users, and user groups across your SonarQube instance. See [Managing permissions](https://docs.sonarsource.com/sonarqube-server/instance-administration/user-management/user-permissions/) in the SonarQube documentation for details on setting global permissions.

### Creating an API token in SonarQube

1.  Log in to SonarQube as a user with the **Administer System** permission.
2.  Click your avatar in the top-right corner and select **My Account**.
3.  Go to the **Security** tab.
4.  Under **Tokens**, enter a descriptive name (for example, `JupiterOne`) and click **Generate**.
5.  Copy the generated token — it is shown only once.

See [Managing your tokens](https://docs.sonarsource.com/sonarqube-server/user-guide/managing-tokens/) for further guidance.

> **NOTE**
> 
> If connecting to SonarQube from JupiterOne-hosted infrastructure, the SonarQube instance must be reachable at a public URL (for example, `https://sonarqube.example.com`).

### Configuration in JupiterOne

To install the SonarQube integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select SonarQube. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the SonarQube account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Base Url**: The URL of your SonarQube instance (for example, `https://sonarqube.example.com`).
    
-   **API Token**: The token generated in the previous step.
    

Click **Create** once all values are provided to finalize the integration.

### Data Volume Configuration

The following optional settings control the scope and volume of findings data ingested. Narrowing these filters reduces the number of entities created in JupiterOne.

#### Ingestion Windows

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| Findings Ingestion Window | Limits findings ingestion to those created within the specified number of days. | 90 | 90, 180, 275, 365 |

#### Data Filtering Options

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| Findings Severities | Limits findings ingestion to the selected severity levels. Values in parentheses apply to SonarQube 10.4 and later. | MAJOR (MEDIUM), CRITICAL (HIGH), BLOCKER (HIGH) | INFO (LOW), MINOR (LOW), MAJOR (MEDIUM), CRITICAL (HIGH), BLOCKER (HIGH) |
| Findings Statuses | Limits findings ingestion to the selected issue statuses. Values in parentheses apply to SonarQube 10.4 and later. | All statuses enabled | OPEN, CONFIRMED, REOPENED (FALSE\_POSITIVE), RESOLVED (ACCEPTED), CLOSED (FIXED) |
| Findings Types | Limits findings ingestion to the selected finding types. Values in parentheses apply to SonarQube 10.4 and later. | VULNERABILITY (SECURITY) | CODE\_SMELL (MAINTAINABILITY), BUG (RELIABILITY), VULNERABILITY (SECURITY) |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `sonarqube_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Finding | `sonarqube_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Project | `sonarqube_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| User | `sonarqube_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| UserGroup | `sonarqube_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sonarqube_account` | **HAS** | `sonarqube_project` |
| `sonarqube_account` | **HAS** | `sonarqube_user_group` |
| `sonarqube_account` | **HAS** | `sonarqube_user` |
| `sonarqube_project` | **HAS** | `sonarqube_finding` |
| `sonarqube_user_group` | **HAS** | `sonarqube_user` |

---

Source: /integrations/directory/sophos

# Sophos

Visualize Sophos endpoint agents and protected devices, map agents to devices and their respective owners, and monitor changes through queries and alerts.

## Installation

To use this integration, JupiterOne requires Client Credentials to a Sophos Tenant account. Obtaining those credentials is described in Sophos' [official docs](https://developer.sophos.com/getting-started) under the 'Create Service Principal' section. At the very end, you'll have a Client ID and a Client Secret that you can use to integrate with JupiterOne.

### Configuration in JupiterOne

To install the Sophos integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Sophos. Click **New Instance** to begin configuring your integration, providing the following:

-   **Account Name** used to identify the Sophos tenant account in JupiterOne.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Alert | `sophos_alert` | [Alert](https://docs.jupiterone.io/data-model/schemas/Alert) |
| Device | `sophos_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Endpoint | `sophos_endpoint` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Endpoint Group | `sophos_endpoint_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Policy | `sophos_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Role | `sophos_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Sophos Account | `sophos_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Sophos Common | `sophos_common` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Sophos Endpoint Protection | `sophos_endpoint_protection` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Sophos User | `sophos_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Group | `sophos_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sophos_account` | **HAS** | `sophos_common` |
| `sophos_account` | **HAS** | `sophos_endpoint_protection` |
| `sophos_alert` | **ASSIGNED** | `sophos_user` |
| `sophos_alert` | **ASSIGNED** | `sophos_user_group` |
| `sophos_alert` | **ASSIGNED** | `sophos_endpoint` |
| `sophos_alert` | **ASSIGNED** | `sophos_endpoint_group` |
| `sophos_common` | **HAS** | `sophos_role` |
| `sophos_common` | **HAS** | `sophos_user_group` |
| `sophos_endpoint` | **PROTECTS** | `sophos_device` |
| `sophos_endpoint` | **IDENTIFIED** | `sophos_alert` |
| `sophos_endpoint_group` | **HAS** | `sophos_endpoint` |
| `sophos_endpoint_protection` | **HAS** | `sophos_endpoint` |
| `sophos_user` | **HAS** | `sophos_endpoint` |
| `sophos_user_group` | **HAS** | `sophos_user` |

### Sophos Account

`sophos_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`id` \*

 | `string` |  |  |
| 

`idType` \*

 | `string` |  | **const**: tenant |

---

### Sophos Alert

`sophos_alert` inherits from [Alert](/data-model/schemas/Alert.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`allowedActions` \*

 | `array` of `string`s |  |  |
| 

`category` \*

 | `string` |  | **Any of**:

-   `azure`

-   `adSync`

-   `applicationControl`

-   `appReputation`

-   `blockListed`

-   `connectivity`

-   `cwg`

-   `denc`

-   `downloadReputation`

-   `endpointFirewall`

-   `fenc`

-   `forensicSnapshot`

-   `general`

-   `isolation`

-   `malware`

-   `mtr`

-   `mobiles`

-   `policy`

-   `protection`

-   `pua`

-   `runtimeDetections`

-   `security`

-   `smc`

-   `systemHealth`

-   `uav`

-   `uncategorized`

-   `updating`

-   `utm`

-   `virt`

-   `wireless`

-   `xgEmail`

-   `ztnaAuthentication`

-   `ztnaGateway`

-   `ztnaResource`

 |
| `createdAt` | `number` |  |  |
| 

`description` \*

 | `string` |  |  |
| 

`groupKey` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| `product` | `string` |  | **Any of**:

-   `other`

-   `endpoint`

-   `server`

-   `mobile`

-   `encryption`

-   `emailGateway`

-   `webGateway`

-   `phishThreat`

-   `wireless`

-   `firewall`

-   `ztna`

 |
| `raisedAt` | `string` |  | 

**Format**: `date-time`

  
 |
| `severity` | `string` |  | **Any of**:

-   `high`

-   `medium`

-   `low`

 |
| `type` | `string` |  |  |

---

### Sophos Common

`sophos_common` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`principal` \*

 | `string` |  |  |

---

### Sophos Device

`sophos_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `online` | `boolean` |  |  |
| `platform` | `string` |  |  |
| `tamperProtectionEnabled` | `boolean` |  |  |
| `type` | `string` |  |  |

---

### Sophos Endpoint

`sophos_endpoint` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` | Uses the endpoint's hostname if available. Uses associated person's name or "viaLogin" property as a fall back |  |
| 

`hostname` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| `ipv4Addresses` | `array` of `string`s |  | 

**Format**: `ipv4`

  
 |
| `ipv6Addresses` | `array` of `string`s |  | 

**Format**: `ipv6`

  
 |
| 

`lastSeenOn` \*

 | `number` |  |  |
| `macAddresses` | `array` of `string`s |  |  |
| 

`name` \*

 | `string` | Uses the endpoint's hostname if available. Uses associated person's name or "viaLogin" property as a fall back |  |
| `online` | `boolean` |  |  |
| `tamperProtectionEnabled` | `boolean` |  |  |
| 

`type` \*

 | `string` |  | **Any of**:

-   `computer`

-   `server`

-   `securityVm`

 |

---

### Sophos Endpoint Group

`sophos_endpoint_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdAt` | `number` |  |  |
| `description` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`type` \*

 | `string` |  | **Any of**:

-   `computer`

-   `server`

 |
| `updatedAt` | `number` |  |  |

---

### Sophos Endpoint Protection

`sophos_endpoint_protection` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`principal` \*

 | `string` |  |  |

---

### Sophos Policy

`sophos_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdAt` | `number` |  |  |
| `disableAt` | `number` | When the policy should be turned off. |  |
| 
`enabled` \*

 | `boolean` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lockedByManagingAccount` \*

 | `boolean` | Whether the policy is managed by a partner or organization, 'true' mean yes. |  |
| 

`name` \*

 | `string` |  |  |
| 

`priority` \*

 | `number` |  |  |
| 

`type` \*

 | `string` |  | **Any of**:

-   `threat-protection`

-   `peripheral-control`

-   `application-control`

-   `data-loss-prevention`

-   `web-control`

-   `agent-updating`

-   `windows-firewall`

-   `device-encryption`

-   `server-threat-protection`

-   `server-peripheral-control`

-   `server-application-control`

-   `server-web-control`

-   `server-lockdown`

-   `server-data-loss-prevention`

-   `server-agent-updating`

-   `server-windows-firewall`

-   `server-file-integrity-monitoring`

-   `server-linux-runtime-detection`

 |
| `updatedAt` | `number` |  |  |

---

### Sophos Role

`sophos_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdAt` | `number` |  |  |
| `description` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`permissionSets` \*

 | `array` of `string`s |  |  |
| 

`principalType` \*

 | `string` |  | **Any of**:

-   `user`

-   `service`

 |
| 

`systemRole` \*

 | `boolean` | Indicates that this role is a system role, not a custom user-defined role. True if `type == 'predefined'` |  |
| 

`type` \*

 | `string` |  | **Any of**:

-   `predefined`

-   `custom`

 |
| `updatedAt` | `number` |  |  |

---

### Sophos User

`sophos_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdAt` | `number` |  |  |
| `domain` | `string` |  |  |
| `exchangeLogin` | `string` |  |  |
| `updatedAt` | `number` |  |  |

---

### Sophos User Group

`sophos_user_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdAt` | `number` |  |  |
| `description` | `string` |  |  |
| `domain` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| `source` | `string` |  | **Any of**:

-   `custom`

-   `activeDirectory`

-   `azureActiveDirectory`

 |
| `updatedAt` | `number` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS details display for Sophos endpoint entities to include OS name and build number.

---

Source: /integrations/directory/splunk

# Splunk

Import JupiterOne alert data to Splunk to view, query with J1QL, and link JupiterOne alerts from within Splunk.

## Installation

To configure JupiterOne with Splunk, you will first need to obtain your JupiterOne `accountId` and generate an API Key in JupiterOne:

-   Generate your API Key: Create your API Key by following instructions on our [API Key Access guide](https://support.jupiterone.io/hc/en-us/articles/360025847594-Enable-API-Key-Access).
-   Obtaining your JupiterOne `accountId`: Excute this query within the JupiterOne search on the app's home view: `find jupiterone_account`. The results column will display the value within the `accountId` column.

### Add JupiterOne to Splunk

With both the API Key and `accountId` from JupiterOne, proceed to Splunk to add JupiterOne to your Splunk workspace. This can be done either by:

1.  **Installing the JupiterOne app directly from the Splunk dashboard:**
    
    1.  On the Splunk home dashboard, use the **Find More Apps** link to find and install the **JupiterOne Add-on** and the **JupiterOne app**.
2.  **Downloading the JupiterOne [add-on](https://splunkbase.splunk.com/app/6138) and [app package](https://splunkbase.splunk.com/app/6139) from the Splunkbase marketplace:**
    
    1.  In Splunk navigate to **Apps > Manage Apps** by clicking the gear icon in the upper-left corner.
    2.  Select **Install app from file** in the top-right.
    3.  **Choose File** and select the JupiterOne add-on package or app package.
    4.  Click **Upload** and follow the prompts to complete the process.

#### Configure the JupiterOne Add-on in Splunk

Now that JupiterOne has been added to Splunk, the last step is to finalize the configuration and input your JupiterOne credentials.

1.  In Splunk, navigate to the **JupiterOne Add-on for Splunk**, and click **Configuration**.
2.  Click **Add** to create a new JupiterOne account configuration on the add-on.
3.  Enter your JupiterOne **Account Name**, `accountId`, and **API Key**. Click **Add** when finished.
    -   _Optional_: You can add a proxy under the **Proxy** tab, or change the log level on the **Logging** tab. By default the log level is `INFO`.
4.  Next, go to the **Inputs** tab, and choose **Create New Input**.
5.  Enter the desired values for the input, and press **Add** once done.

This concludes the setup for the Add-on. With the Add-on configured, the JupiterOne app within Splunk will start working without additional setup.

> **INFO**
> 
> More details are available on the Splunkbase marketplace for the [add-on](https://splunkbase.splunk.com/app/6138) and the [App](https://splunkbase.splunk.com/app/6139).

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

## Data Model

### Entities

| Field Name | Field Description |
| --- | --- |
| `Name`**\*** | Unique name for the data input. |
| `Interval`**\*** | Time interval of input in seconds. How often JupiterOne collects the data. |
| `Index`**\*** | Index where data is stored. |
| `JupiterOne Account`**\*** | Account that was configured in the **Configuration** tab. |
| `Pull Alert Related Objects` | If enabled, pulls data for entities in Alert. |
| `Start DateTime` | Date in UTC when you want to start collecting data. Default is 30 days in the past. |

**\*** Denotes required fields

---

Source: /integrations/directory/stackhawk

# StackHawk

Visualize StackHawk Organization, User, Application, Code Repository, and Application Findings, and monitor changes through queries and alerts.

## Installation

### Requirements

-   User must have the Admin access to StackHawk account.
-   User must have permission in JupiterOne to install new integrations.

### Configuration in StackHawk

#### Generate API Key and collect Organization ID from StackHawk

1.  Sign in to your StackHawk account at [https://app.stackhawk.com](https://app.stackhawk.com).
2.  Navigate to **Settings > API Keys** under **Profile Settings**.
3.  Create a new API key and store it securely.
4.  Find your **Organization ID** under **Settings > Organization Details** in **ORG Settings**.

### Configuration in JupiterOne

1.  From the top navigation of the J1 Search homepage, select **Integrations**
2.  Search for the **StackHawk** and select it.
3.  Click on the **Add Instance** button and configure the following settings:

-   Enter the **StackHawk API Key** generated for use by JupiterOne.
-   Enter the **StackHawk Organization ID** generated for use by JupiterOne.
-   Enter the **Account Name** by which you'd like to identify this StackHawk Cloud instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
-   Enter a **Description** that will further assist your team when identifying the integration instance.
-   Select a **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.

4.  Click **Create Instance** once all values are provided.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Application | `stackhawk_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| CodeRepo | `stackhawk_code_repo` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Finding | `stackhawk_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Organization | `stackhawk_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| User | `stackhawk_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `stackhawk_account` | **HAS** | `stackhawk_user` |
| `stackhawk_account` | **HAS** | `stackhawk_application` |
| `stackhawk_application` | **HAS** | `stackhawk_code_repo` |
| `stackhawk_application` | **HAS** | `stackhawk_finding` |

### Stackhawk Account

`stackhawk_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`orgId` \*

 | `string` |  |  |

---

### Stackhawk Application

`stackhawk_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`environment` \*

 | `string` |  |  |
| 

`environmentId` \*

 | `string` |  |  |
| 

`organizationId` \*

 | `string` |  |  |
| `riskLevel` | `string` |  |  |

---

### Stackhawk Code Repo

`stackhawk_code_repo` inherits from [CodeRepo](/data-model/schemas/CodeRepo.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiDiscoveryScore` | `number` | The StackHawk API Discovery Score. |  |
| `apiDiscoveryStatus` | `string` | The StackHawk API Discovery Status. |  |
| `archived` | `boolean` |  |  |
| `commitCount` | `number` |  |  |
| `frameworkNames` | `array` of `string`s |  |  |
| `hasGeneratedOpenApiSpec` | `boolean` |  |  |
| `hidden` | `boolean` | Whether or not this repository is hidden. |  |
| `integrationId` | `string` | The Integration Id this repository is associated to. |  |
| `isFork` | `boolean` | Whether or not this repository is a fork. |  |
| `isInAttackSurface` | `boolean` |  |  |
| `isNewRepository` | `boolean` |  |  |
| `isNewToAttackSurface` | `boolean` |  |  |
| `lastCommitBranch` | `string` |  |  |
| `lastCommitTimestamp` | `number` |  |  |
| `namespace` | `string` | Provider dependent, namespace/group/subgroup/folder the repository belongs to. |  |
| `namespaceId` | `string` |  |  |
| `providerOrgId` | `string` |  |  |
| `providerOrgName` | `string` | The repository providers top level entity this repository is associated with. |  |
| `repoSource` | `string` | The source of the repository. e.i. UNKNOWN, GITHUB, AZURE\_DEVOPS, BITBUCKET, GITLAB. |  |

---

### Stackhawk Finding

`stackhawk_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `applicationId` | `string` |  |  |
| `applicationName` | `string` |  |  |
| `cweId` | `string` |  |  |
| `environmentId` | `string` |  |  |
| `environmentName` | `string` |  |  |
| `findingEvidence` | `string` |  |  |
| `findingMethod` | `string` |  |  |
| `findingOtherInfo` | `string` |  |  |
| `findingUrl` | `string` |  |  |
| `firstSeenOn` | `number` |  |  |
| `lastSeenOn` | `number` |  |  |
| `pluginId` | `string` |  |  |
| `pluginName` | `string` |  |  |
| `remediationAdvice` | `string` |  |  |
| `risk` | `string` |  |  |
| `scanDuration` | `number` |  |  |
| `scanId` | `string` |  |  |
| `scanUserName` | `string` |  |  |
| `team` | `string` |  |  |

---

### Stackhawk User

`stackhawk_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessProvider` | `string` | User access provider. For example: GITHUB, GOOGLE, STACKHAWK, SAMLIDP |  |
| `applicationIds` | `array` of `string`s |  |  |
| `avatarUrl` | `string` |  |  |
| `providerClientId` | `string` |  |  |

---

## Release Notes

-   **2025-04-10** — Added StackHawk integration, ingesting applications, scans, and vulnerability findings with organization and user relationships.

---

Source: /integrations/directory/sysdig

# Sysdig

Visualize Sysdig account, teams, and users, and monitor changes through queries and alerts.

## Installation

To use the Sysdig integration, you need a Sysdig API token and your account region. The token must belong to a user with **Administrator** privileges so the integration can enumerate all users, teams, agents, and cluster data across the organization.

### Prerequisites

1.  Obtain your **API Token** from Sysdig: log in to Sysdig Monitor or Sysdig Secure, go to **Settings > User Profile**, and copy the token shown. See [Retrieve the Sysdig API Token](https://docs.sysdig.com/en/administration/retrieve-the-sysdig-api-token/) for details.
2.  Confirm your **Region** code. This is the short identifier for your Sysdig SaaS endpoint, such as `us2` or `eu1`. See [SaaS Regions and IP Ranges](https://docs.sysdig.com/en/administration/saas-regions-and-ip-ranges/) for the full list.

### Configuration in JupiterOne

Navigate to **Integrations** in JupiterOne, select **Sysdig**, and click **New Instance**.

Creating an instance requires the following:

-   **API Token** — Your Sysdig account API token.
-   **Region** — Your Sysdig SaaS region code (for example, `us2`).

Click **Create** to finish. The integration will begin running on the polling interval you selected, or you can trigger it manually at any time.

### Next steps

Once configured, your Sysdig data will populate in JupiterOne. See the [Instance management guide](/integrations/instance-management.md) to learn how to edit, disable, or re-run your integration instance.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `sysdig_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Agent | `sysdig_agent` | [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| Cluster | `sysdig_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Finding | `sysdig_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Finding | `sysdig_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Image Scan | `sysdig_image_scan` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Scanner | `sysdig_scanner` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Team | `sysdig_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team) |
| User | `sysdig_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sysdig_account` | **HAS** | `sysdig_user` |
| `sysdig_account` | **HAS** | `sysdig_team` |
| `sysdig_account` | **HAS** | `sysdig_image_scan` |
| `sysdig_account` | **HAS** | `sysdig_scanner` |
| `sysdig_account` | **HAS** | `sysdig_cluster` |
| `sysdig_account` | **HAS** | `sysdig_agent` |
| `sysdig_agent` | **SCANS** | `sysdig_cluster` |
| `sysdig_image_scan` | **IDENTIFIED** | `sysdig_finding` |
| `sysdig_scanner` | **PERFORMED** | `sysdig_image_scan` |
| `sysdig_team` | **HAS** | `sysdig_user` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `sysdig_finding` | **IS** | `cve` | FORWARD |

### Sysdig Finding

`sysdig_finding` inherits from [Finding](/data-model/schemas/Finding.md)

---

### Sysdig Finding

`sysdig_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

---

### Sysdig User

`sysdig_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admin` | `boolean` |  |  |
| `enabled` | `boolean` |  |  |
| `lastSeenOnSecure` | `integer` |  |  |
| `products` | `array` of `string`s |  |  |
| `systemRole` | `string` |  |  |
| `version` | `integer` |  |  |

---

## Release Notes

-   **2025-06-05** — Promoted Sysdig finding entities to carry both the Vulnerability and Finding entity classes, enabling broader vulnerability query compatibility.

---

Source: /integrations/directory/taegis

# Secureworks Taegis

Visualize assets, users, and evaluations in Taegis while monitoring changes through advanced queries and automated alerts.

## Installation

To authenticate with Secureworks Taegis XDR, you'll need to configure certain credentials such as TENANT\_ID, BASE\_URL, CLIENT\_ID, and CLIENT\_SECRET. Here's how you can obtain these values and set them in your environment variables for secure and effective authentication:

TENANT\_ID: A unique identifier for your Taegis XDR tenant, required for API requests. To find it, log in to the XDR Console, go to Tenant Settings → Subscriptions.

CLIENT\_ID & CLIENT\_SECRET: Follow this document to create the necessary credentials for this integration: [Create Client Credentials](https://docs.ctpx.secureworks.com/apis/api_authenticate/#part-1-create-client-credentials).

BASE\_URL: You can find the appropriate BASE\_URL in your Taegis console under Web URL. Select the correct URL based on your deployment region:

US1: [https://api.ctpx.secureworks.com](https://api.ctpx.secureworks.com) US2: [https://api.delta.taegis.secureworks.com](https://api.delta.taegis.secureworks.com) US3: [https://api.foxtrot.taegis.secureworks.com](https://api.foxtrot.taegis.secureworks.com) EU: [https://api.echo.taegis.secureworks.com](https://api.echo.taegis.secureworks.com)

### Configuration in JupiterOne

To install the SecureWorks Taegis integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select SecureWorks Taegis Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the SecureWorks Taegis account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your SecureWorks Taegis **Tenant ID** ,**Client ID**, **Client Secret**, **BaseUrl**.
    
-   Designate the desired **Included Vulnerability Severities** and **Included Vulnerability States**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Host | `secureworks_taegis_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Vulnerability | `secureworks_taegis_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `secureworks_taegis_host` | **HAS** | `secureworks_taegis_vulnerability` |

### Secureworks Taegis Host

`secureworks_taegis_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `architecture` | `string` |  |  |
| `biosSerial` | `string` |  |  |
| `createdAt` | `number` |  |  |
| `endpointPlatform` | `string` |  |  |
| `endpointType` | `string` |  |  |
| `firstDiskSerial` | `string` |  |  |
| 
`hostId` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| `ingestTime` | `number` |  |  |
| `kernelRelease` | `string` |  |  |
| `kernelVersion` | `string` |  |  |
| `osKernel` | `string` |  |  |
| 

`rn` \*

 | `string` |  |  |
| 

`sensorId` \*

 | `string` |  |  |
| 

`sensorTenant` \*

 | `string` |  |  |
| `sensorVersion` | `string` |  |  |
| `status` | `string` |  |  |
| `systemVolumeSerial` | `string` |  |  |
| 

`tenantId` \*

 | `string` |  |  |
| `updatedAt` | `number` |  |  |
| `users` | `array` of `string`s |  |  |

---

### Secureworks Taegis Vulnerability

`secureworks_taegis_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`attackTechniqueIds` \*

 | `array` **|** `null` |  |  |
| 

`blocking` \*

 | `boolean` **|** `null` |  |  |
| 

`confidence` \*

 | `number` **|** `null` |  |  |
| 

`createdAt` \*

 | `number` **|** `null` |  |  |
| 

`detectorId` \*

 | `string` **|** `null` |  |  |
| 

`detectorVersion` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` **|** `null` |  |  |
| 

`engineName` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`investigationIds` \*

 | `array` **|** `null` |  |  |
| 

`resolutionReason` \*

 | `string` **|** `null` |  |  |
| 

`ruleId` \*

 | `string` **|** `null` |  |  |
| 

`ruleVersion` \*

 | `string` **|** `null` |  |  |
| 

`sensorTypes` \*

 | `array` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`suppressed` \*

 | `boolean` **|** `null` |  |  |
| 

`tenantId` \*

 | `string` **|** `null` |  |  |

---

## Release Notes

-   **2026-03-31** — Added OS kernel version property to SecureWorks Taegis host entities.
-   **2025-06-04** — Taegis vulnerability entities now support the Finding entity class alongside the Vulnerability class for improved data model compatibility.

---

Source: /integrations/directory/tanium

# Tanium

Visualize Tanium assets, users, and evaluations in JupiterOne, and monitor changes through queries and alerts.

## Installation

For this integration, you will need access to the Administration module with the `API Gateway User` role in Tanium to create API keys.

### Configuration in Tanium

Before setting up the integration instance in JupiterOne, you will need to generate your Tanium API Key:

1.  In your Tanium console, at the top bar, navigate to **Administration** > **Permissions** > **API Tokens**
2.  Click **New API Token**
3.  Set the desired number of days until your token expires.
4.  If you are running the integration in JupiterOne then add the following IPs to the Trusted IP list based on your region:
    -   Running in US Region:
        -   18.219.33.157/0
        -   18.218.86.86/0
        -   52.14.136.234/0
    -   Running in Cisco US Region:
        -   34.233.148.77/0
        -   44.199.84.191/0
        -   52.21.5.206/0
    -   Running in EU Region:
        -   3.67.240.226/0
        -   52.28.3.30/0
        -   3.121.249.173/0
5.  Copy your API Token for use in JupiterOne.

Once you have generated your API key, retain the value and have it ready when configuring the integration within JupiterOne.

### Configuration in JupiterOne

To install the Tanium integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Tanium. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Tanium account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Tanium **API Key**.
    
-   Lastly, enter the base URL for your Tanium instance's API. The endpoint will look like `https://<customerName>-api.cloud.tanium.com`.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `tanium_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `tanium_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Application Version | `tanium_application_version` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Available Patch | `tanium_available_patch` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Endpoint | `tanium_endpoint` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Installed Application | `tanium_installed_application` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Installed Patch | `tanium_installed_patch` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| User | `tanium_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `tanium_account` | **HAS** | `tanium_endpoint` |
| `tanium_account` | **HAS** | `tanium_user` |
| `tanium_account` | **HAS** | `tanium_application` |
| `tanium_application` | **HAS** | `tanium_application_version` |
| `tanium_endpoint` | **HAS** | `tanium_installed_application` |
| `tanium_endpoint` | **HAS** | `tanium_installed_patch` |
| `tanium_endpoint` | **HAS** | `tanium_available_patch` |
| `tanium_installed_application` | **IS** | `tanium_application_version` |

### Tanium User

`tanium_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `deleted` | `boolean` |  |  |
| `domain` | `string` |  |  |
| `external` | `boolean` |  |  |
| `lastLoginAt` | `integer` |  |  |
| `lockedOut` | `boolean` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name, type, and version parsing for Tanium endpoint entities.

---

Source: /integrations/directory/teleport

# Teleport

Visualize Teleport users, roles, and access lists, map role assignments and access list membership across your infrastructure, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> This integration authenticates to the Teleport auth service over gRPC with **mutual TLS**. No passwords, API keys, or OAuth tokens are used — all traffic is authenticated with a client certificate issued by the cluster's own CA and delivered to JupiterOne as a single **identity file** (a PEM bundle containing the private key, TLS client certificate, and cluster CA certificates).

### Prerequisites

-   A Teleport cluster (Cloud or self-hosted) reachable on port `443`.
-   The [`tctl` and `tsh`](https://goteleport.com/docs/installation/) CLI tools, running as a cluster administrator that has permission to create roles, create local users, and impersonate the service user you are about to create.

### Configuration in Teleport

#### 1\. Log in to the cluster as an administrator

```shell
tsh login --proxy=<cluster>.teleport.sh:443 --user=<admin-user>
```

#### 2\. Create the read-only role for JupiterOne

Save the following to `jupiterone-role.yaml`:

```yaml
kind: role
version: v7
metadata:
  name: jupiterone-reader
spec:
  allow:
    rules:
      - resources:
          [user, role, access_list, access_list_member, access_list_review]
        verbs: [list, read]
```

Then apply it:

```shell
tctl create -f jupiterone-role.yaml
```

#### 3\. Grant your admin user permission to sign an identity for the service user

`tctl auth sign --user=<other-user>` requires explicit **impersonation** rights, which the preset `editor` role does not include. Create this role and attach it to your admin user:

```yaml
kind: role
version: v7
metadata:
  name: jupiterone-impersonator
spec:
  allow:
    impersonate:
      users: ['jupiterone']
      roles: ['jupiterone-reader']
```

```shell
tctl create -f jupiterone-impersonator.yaml
tctl users update <admin-user> --set-roles=<existing-roles>,jupiterone-impersonator
tsh logout && tsh login --proxy=<cluster>.teleport.sh:443 --user=<admin-user>
```

Re-logging in is required so the admin's session certificate picks up the new role.

#### 4\. Create the local service user and finish its invite

```shell
tctl users add jupiterone --roles=jupiterone-reader
```

This prints a one-hour invite URL. Open it in a browser and complete password + MFA setup for the `jupiterone` user. Local authentication with MFA is required — SSO users cannot be used to sign identity files because `tctl auth sign` needs a password-backed user.

#### 5\. Sign the identity file

```shell
tctl auth sign \
  --user=jupiterone \
  --format=file \
  --out=jupiterone-identity.pem \
  --ttl=24h
```

The PEM bundle written to `jupiterone-identity.pem` is what you will upload to JupiterOne in the next step.

### Authentication and certificate lifetime

Teleport enforces a hard **~30 hour** upper bound on user-certificate TTL (`apidefaults.MaxCertDuration` in the Teleport source; `max_session_ttl` on roles cannot push past this ceiling — see [this discussion](https://github.com/gravitational/teleport/discussions/30213)). A `--ttl=24h` identity is fine for a trial, one-off ingestion, or demo, but the integration will stop authenticating once the certificate expires.

For any long-running deployment, follow Teleport's recommendation and provision credentials through **[Machine ID (`tbot`)](https://goteleport.com/docs/machine-workload-identity/introduction/)** rather than a static `tctl auth sign` identity. `tbot` joins the cluster with a delegated token (AWS IAM, GCP, Kubernetes, static token, etc.), continuously renews short-lived certificates, and writes a fresh identity file to disk that can be fed back into the integration on each run. This is the only approach that supports unattended operation beyond the 30h cap.

### Configuration in JupiterOne

1.  Navigate to the **Integrations** tab in JupiterOne and select **Teleport**.
2.  Click **New Instance** to begin configuring your integration and provide the following:
    -   **Account Name** used to identify the Teleport cluster in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    -   **Description** to assist in identifying the integration instance, if desired.
    -   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    -   **Proxy Address** — the public address of the Teleport Proxy Service with the port, e.g. `cluster.teleport.sh:443`.
    -   **Identity File** — upload `jupiterone-identity.pem` from the previous step. JupiterOne stores the full PEM bundle as a masked secret.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (6)

-   `/proto.AuthService/ListRoles`
-   `/proto.AuthService/Ping`
-   `/teleport.accesslist.v1.AccessListService/ListAccessListMembers`
-   `/teleport.accesslist.v1.AccessListService/ListAccessListReviews`
-   `/teleport.accesslist.v1.AccessListService/ListAccessListsV2`
-   `/teleport.users.v1.UsersService/ListUsers`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (3)

-   [https://goteleport.com/docs/admin-guides/access-controls/access-lists/](https://goteleport.com/docs/admin-guides/access-controls/access-lists/)
-   [https://goteleport.com/docs/reference/access-controls/roles/](https://goteleport.com/docs/reference/access-controls/roles/)
-   [https://goteleport.com/docs/reference/architecture/api-architecture/](https://goteleport.com/docs/reference/architecture/api-architecture/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (8)

| Step | Endpoints |
| --- | --- |
| Fetch Access List Members | `/teleport.accesslist.v1.AccessListService/ListAccessListMembers` |
| Fetch Access List Owners | \- |
| Fetch Access List Reviews | `/teleport.accesslist.v1.AccessListService/ListAccessListReviews` |
| Fetch Access List Role Grants | \- |
| Fetch Access Lists | `/teleport.accesslist.v1.AccessListService/ListAccessListsV2` |
| Fetch Roles | `/proto.AuthService/ListRoles` |
| Fetch User Role Assignments | \- |
| Fetch Users | `/teleport.users.v1.UsersService/ListUsers` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| AccessList | `teleport_access_list` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| AccessListReview | `teleport_access_list_review` | [Review](https://docs.jupiterone.io/data-model/schemas/Review) |
| Account | `teleport_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Role | `teleport_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| User | `teleport_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `teleport_access_list` | **ASSIGNED** | `teleport_role` |
| `teleport_access_list` | **HAS** | `teleport_user` |
| `teleport_access_list` | **HAS** | `teleport_access_list_review` |
| `teleport_account` | **HAS** | `teleport_user` |
| `teleport_account` | **HAS** | `teleport_role` |
| `teleport_account` | **HAS** | `teleport_access_list` |
| `teleport_user` | **ASSIGNED** | `teleport_role` |
| `teleport_user` | **MANAGES** | `teleport_access_list` |
| `teleport_user` | **REVIEWED** | `teleport_access_list_review` |

### Teleport Access List

`teleport_access_list` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessListType` | `string` |  |  |
| `auditFrequency` | `string` |  |  |
| `grantedRoles` | `array` **|** `null` |  |  |
| `memberCount` | `number` |  |  |
| `nextAuditOn` | `number` |  |  |
| `ownerGrantedRoles` | `array` **|** `null` |  |  |
| `ownerNames` | `array` **|** `null` |  |  |
| `requiredMembershipRoles` | `array` **|** `null` |  |  |
| `requiredOwnershipRoles` | `array` **|** `null` |  |  |
| `title` | `string` |  |  |

---

### Teleport Access List Review

`teleport_access_list_review` inherits from [Review](/data-model/schemas/Review.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessListName` \*

 | `string` |  |  |
| `notes` | `string` |  |  |
| `removedMembers` | `array` **|** `null` |  |  |
| `reviewedOn` | `number` |  |  |
| 

`reviewers` \*

 | `array` of `string`s |  |  |

---

### Teleport Account

`teleport_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`clusterName` \*

 | `string` |  |  |
| `licenseExpiresOn` | `number` |  |  |
| `proxyPublicAddr` | `string` |  |  |
| `serverVersion` | `string` |  |  |

---

### Teleport Role

`teleport_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowedAWSRoleARNs` | `array` **|** `null` |  |  |
| `allowedDatabaseNames` | `array` **|** `null` |  |  |
| `allowedDatabaseUsers` | `array` **|** `null` |  |  |
| `allowedKubeGroups` | `array` **|** `null` |  |  |
| `allowedKubeUsers` | `array` **|** `null` |  |  |
| `allowedLogins` | `array` **|** `null` |  |  |
| `forwardAgent` | `boolean` |  |  |
| `lockMode` | `string` |  |  |
| `maxSessionTTL` | `string` |  |  |
| `portForwarding` | `boolean` |  |  |
| `requestAccess` | `string` |  |  |

---

### Teleport User

`teleport_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `connectorId` | `string` |  |  |
| `connectorType` | `string` |  |  |
| `createdBy` | `string` |  |  |
| `locked` | `boolean` |  |  |
| `lockedMessage` | `string` |  |  |
| `mfaWeakestDevice` | `string` |  |  |
| `passwordState` | `string` |  |  |
| 
`roles` \*

 | `array` of `string`s |  |  |

---

---

Source: /integrations/directory/teleskope

# Teleskope

Visualize Teleskope S3 buckets and RDS clusters with data classification and sensitivity metadata, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need the following parameters from Teleskope:
> 
> -   **API Key** — used to authenticate requests to the Teleskope Metadata API. Contact your Teleskope administrator or refer to [their documentation](https://docs.teleskope.ai/the-platform/api-service) to obtain an API key for your tenant.
> -   **Metadata API Base URL** — the base URL for your Teleskope tenant, in the format `https://api.metadata.<your-tenant>.teleskope.ai`.

### Configuration in JupiterOne

To install the Teleskope integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Teleskope. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Teleskope account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Teleskope **API Key**.
    
-   Your Teleskope **Metadata API Base URL** (e.g. `https://api.metadata.<your-tenant>.teleskope.ai`).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `teleskope_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| RDS Cluster | `teleskope_rds_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| S3Bucket | `teleskope_s3_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `teleskope_account` | **HAS** | `teleskope_s3_bucket` |
| `teleskope_account` | **HAS** | `teleskope_rds_cluster` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `teleskope_rds_cluster` | **IS** | `aws_rds_cluster` | FORWARD |
| `teleskope_s3_bucket` | **IS** | `aws_s3_bucket` | FORWARD |

### Teleskope Account

`teleskope_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Teleskope Rds Cluster

`teleskope_rds_cluster` inherits from [Database](/data-model/schemas/Database.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`awsAccountId` \*

 | `number` |  |  |
| 

`awsAccountIdentifier` \*

 | `string` |  |  |
| `awsAccountName` | `string` |  |  |
| 

`backupRetentionPeriod` \*

 | `number` |  |  |
| 

`databaseCount` \*

 | `number` |  |  |
| `dataElementCategories` | `array` of `string`s |  |  |
| `dataElements` | `array` of `string`s |  |  |
| 

`deletionProtection` \*

 | `boolean` |  |  |
| 

`engineType` \*

 | `string` |  |  |
| 

`engineVersion` \*

 | `string` |  |  |
| 

`iamAuthenticationEnabled` \*

 | `boolean` |  |  |
| 

`identifier` \*

 | `string` |  |  |
| 

`multiAz` \*

 | `boolean` |  |  |
| 

`openToTheWorld` \*

 | `boolean` |  |  |
| `personas` | `array` of `string`s |  |  |
| 

`publiclyAccessible` \*

 | `boolean` |  |  |
| `readEndpoint` | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`tableCount` \*

 | `number` |  |  |
| `writeEndpoint` | `string` |  |  |

---

### Teleskope S3 Bucket

`teleskope_s3_bucket` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`awsAccountId` \*

 | `number` |  |  |
| 

`awsAccountIdentifier` \*

 | `string` |  |  |
| 

`bucketName` \*

 | `string` |  |  |
| `dataElements` | `array` of `string`s |  |  |
| `personas` | `array` of `string`s |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`versioning` \*

 | `boolean` |  |  |

---

## Release Notes

-   **2026-03-13** — New Teleskope integration: discovers S3 buckets and RDS clusters with data element classifications, security configurations, and mapped relationships to underlying AWS resources.

---

Source: /integrations/directory/tenable-cloud

# Tenable.io

Visualize Tenable.io scans, findings, vulnerabilities, and container findings, map Tenable.io users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need an **Access Key** and **Secret Key** from Tenable Vulnerability Management. The API key owner must have the **Administrator** role to use the bulk export APIs that power this integration.

> **INFO**
> 
> See [Generate API Keys](https://docs.tenable.com/vulnerability-management/Content/Settings/my-account/GenerateAPIKey.htm) in the Tenable documentation for instructions on generating your access and secret keys.

### Configuration in JupiterOne

To install the Tenable integration in JupiterOne, navigate to the **Integrations** tab and select **Tenable**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   Your **Access Key** and **Secret Key** from Tenable Vulnerability Management.

Optionally, to enable container image scanning via the Tenable Cloud Security API, provide a **Cloud Security API Key** (see [Data Volume Configuration](#data-volume-configuration) below).

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

## Data Volume Configuration

The following settings control which data the integration collects and over what time range.

### Data Filtering Options

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Included Vulnerability Severities** | Vulnerability severity levels to include in ingestion. | All severities | Info, Low, Medium, High, Critical |
| **Included Vulnerability Modification Types** | Filters vulnerabilities by whether their state has been modified by a rule (recasted or accepted). Select "None" to include only unmodified findings. | All modification types | None, Recasted, Accepted |
| **Included Vulnerability States** | Lifecycle states of vulnerability findings to include. | All states | Open, Reopened, Fixed |
| **Compliance Findings - Results** | Compliance check result statuses to include in the ingestion. | All results | PASSED, FAILED, WARNING, SKIPPED, UNKNOWN, ERROR |
| **Compliance Findings - States** | Lifecycle states of compliance findings to include. | All states | OPEN, REOPENED, FIXED |
| **Assets - Licensed Filter** | Restricts asset export to licensed or non-licensed assets only. Leave at "No filter" to export all assets. | No filter | No filter, Include only licensed, Include only non-licensed |

### Ingestion Windows

| Field | Description | Default |
| --- | --- | --- |
| **Compliance Findings - Last Seen (days)** | Number of days back to include compliance findings that were last seen. | 15 |

### Advanced Configuration

| Field | Description | Default |
| --- | --- | --- |
| **Base URL** | The base URL for the Tenable Vulnerability Management API. Change this only if you use a regional or on-premises endpoint. | [https://cloud.tenable.com](https://cloud.tenable.com) |
| **Cloud Security API Key** | API key for the Tenable Cloud Security (formerly Ermetic) GraphQL API. Required to ingest container images and reports. If not provided, the integration falls back to the main Access Key. | — |
| **Cloud Security Base URL** | The base URL for the Tenable Cloud Security API. Use a regional value such as `us.app.ermetic.com` or `eu.app.ermetic.com` if applicable. | [https://global.app.ermetic.com](https://global.app.ermetic.com) |

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (2)

-   `Administrator`
-   `Scan Manager`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (7)

-   `https://cloud.tenable.com/assets/export`
-   `https://cloud.tenable.com/compliance/export`
-   `https://cloud.tenable.com/scanners`
-   `https://cloud.tenable.com/scanners/{scannerId}/agents`
-   `https://cloud.tenable.com/users`
-   `https://cloud.tenable.com/vulns/export`
-   `https://global.app.ermetic.com/api/graph`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (2)

-   [https://docs.tenable.com/vulnerability-management/Content/Settings/my-account/GenerateAPIKey.htm](https://docs.tenable.com/vulnerability-management/Content/Settings/my-account/GenerateAPIKey.htm)
-   [https://docs.tenable.com/vulnerability-management/best-practices/RBAC/Content/tenable-role-privileges.htm](https://docs.tenable.com/vulnerability-management/best-practices/RBAC/Content/tenable-role-privileges.htm)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (12)

| Step | Roles | Endpoints |
| --- | --- | --- |
| Build Asset -> Vulnerability Relationships | \- | \- |
| Build Asset Has Compliance Finding Relationship | \- | \- |
| Build Host Agent Protects Agents Relationship | \- | \- |
| Build Repository Images Relationships | \- | \- |
| Build Vulnerability -> CVE Mapped Relationships | \- | \- |
| Fetch Agents | `Administrator`, `Scan Manager` | `https://cloud.tenable.com/scanners/{scannerId}/agents` |
| Fetch Assets | `Administrator` | `https://cloud.tenable.com/assets/export` |
| Fetch Container Images | \- | `https://global.app.ermetic.com/api/graph` |
| Fetch Container Reports | \- | `https://global.app.ermetic.com/api/graph` |
| Fetch Container Repositories | \- | `https://global.app.ermetic.com/api/graph` |
| Fetch Service Details | \- | \- |
| Fetch Users | `Administrator` | `https://cloud.tenable.com/users` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `tenable_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Agent | `tenable_agent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Asset | `tenable_asset` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Compliance Finding | `tenable_compliance_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Container Finding | `tenable_container_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Container Image | `tenable_container_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Container Malware | `tenable_container_malware` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Container Report | `tenable_container_report` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Container Repository | `tenable_container_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| Container Unwanted Program | `tenable_container_unwanted_program` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Service | `tenable_scanner` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `tenable_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vulnerability | `tenable_vulnerability_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `tenable_account` | **PROVIDES** | `tenable_scanner` |
| `tenable_account` | **HAS** | `tenable_container_repository` |
| `tenable_account` | **HAS** | `tenable_container_image` |
| `tenable_account` | **MANAGES** | `tenable_asset` |
| `tenable_account` | **HAS** | `tenable_user` |
| `tenable_account` | **HAS** | `tenable_agent` |
| `tenable_agent` | **PROTECTS** | `tenable_asset` |
| `tenable_asset` | **HAS** | `tenable_vulnerability_finding` |
| `tenable_asset` | **HAS** | `tenable_compliance_finding` |
| `tenable_container_image` | **HAS** | `tenable_container_report` |
| `tenable_container_image` | **HAS** | `tenable_container_finding` |
| `tenable_container_image` | **HAS** | `tenable_container_malware` |
| `tenable_container_image` | **HAS** | `tenable_container_unwanted_program` |
| `tenable_container_report` | **IDENTIFIED** | `tenable_container_finding` |
| `tenable_container_report` | **IDENTIFIED** | `tenable_container_malware` |
| `tenable_container_report` | **IDENTIFIED** | `tenable_container_unwanted_program` |
| `tenable_container_repository` | **HAS** | `tenable_container_image` |
| `tenable_scanner` | **SCANS** | `tenable_container_image` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `tenable_asset` | **IS** | `aws_instance` | FORWARD |
| `tenable_asset` | **IS** | `azure_vm` | FORWARD |
| `tenable_asset` | **IS** | `google_compute_instance` | FORWARD |
| `tenable_vulnerability_finding` | **HAS** | `aws_instance` | REVERSE |
| `tenable_vulnerability_finding` | **HAS** | `azure_vm` | REVERSE |
| `tenable_vulnerability_finding` | **HAS** | `google_compute_instance` | REVERSE |
| `tenable_vulnerability_finding` | **IS** | `cve` | FORWARD |

### Tenable Account

`tenable_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Tenable Agent

`tenable_agent` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentId` \*

 | `number` |  |  |
| 

`coreBuild` \*

 | `string` |  |  |
| 

`coreVersion` \*

 | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`ipAddress` \*

 | `string` |  |  |
| `lastConnectedOn` | `number` |  |  |
| `lastScannedOn` | `number` |  |  |
| `linkedOn` | `number` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`platform` \*

 | `string` |  |  |
| 

`status` \*

 | `string` |  |  |
| 

`supportsRemoteLogs` \*

 | `boolean` |  |  |

---

### Tenable Asset

`tenable_asset` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentNames` | `array` of `string`s |  |  |
| `agentUuid` | `string` |  |  |
| `awsAvailabilityZone` | `string` |  |  |
| `awsEc2InstanceAmiId` | `string` |  |  |
| `awsEc2InstanceGroupName` | `string` |  |  |
| `awsEc2InstanceId` | `string` |  |  |
| `awsEc2InstanceState` | `string` |  |  |
| `awsEc2InstanceType` | `string` |  |  |
| `awsEc2Name` | `string` |  |  |
| `awsEc2ProductCode` | `string` |  |  |
| `awsOwnerId` | `string` |  |  |
| `awsRegion` | `string` |  |  |
| `awsSubnetId` | `string` |  |  |
| `awsVpcId` | `string` |  |  |
| `azureResourceId` | `string` |  |  |
| `azureVmId` | `string` |  |  |
| `bigfixAssetId` | `string` |  |  |
| `biosUuid` | `string` |  |  |
| `coreVersion` | `string` |  |  |
| `deletedBy` | `string` |  |  |
| `deletedOn` | `number` |  |  |
| `firstScanTimeOn` | `number` |  |  |
| `firstSeenOn` | `number` |  |  |
| `fqdns` | `array` of `string`s |  |  |
| 
`function` \*

 | `string` |  | **const**: vulnerability-detection |
| `gcpInstanceId` | `string` |  |  |
| `gcpProjectId` | `string` |  |  |
| `gcpZone` | `string` |  |  |
| `hasAgent` | `boolean` |  |  |
| `hasPluginResults` | `boolean` |  |  |
| `installedSoftware` | `array` of `string`s |  |  |
| `ipv4s` | `array` of `string`s |  |  |
| `ipv6s` | `array` of `string`s |  |  |
| `lastAuthenticatedScanDateOn` | `number` |  |  |
| `lastLicensedScanDateOn` | `number` |  |  |
| `lastScanId` | `string` |  |  |
| `lastScanTimeOn` | `number` |  |  |
| `lastScheduleId` | `string` |  |  |
| `mcafeeEpoAgentId` | `string` |  |  |
| `mcafeeEpoGuid` | `string` |  |  |
| `netbiosNames` | `array` of `string`s |  |  |
| `networkId` | `string` |  |  |
| `networkName` | `string` |  |  |
| `operatingSystems` | `array` of `string`s |  |  |
| `servicenowSysid` | `string` |  |  |
| `systemType` | `string` |  |  |
| `terminatedBy` | `string` |  |  |
| `terminatedOn` | `number` |  |  |

---

### Tenable Compliance Finding

`tenable_compliance_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`actualValue` \*

 | `string` |  |  |
| 

`agentId` \*

 | `string` |  |  |
| 

`asset.agent_name` \*

 | `string` |  |  |
| 

`asset.agent_uuid` \*

 | `string` |  |  |
| `asset.fqdns` | `array` of `string`s |  |  |
| 

`asset.id` \*

 | `string` |  |  |
| `asset.ipv4Addresses` | `array` of `string`s |  |  |
| `asset.ipv6_addresses` | `array` of `string`s |  |  |
| `asset.mac_addresses` | `array` of `string`s |  |  |
| 

`asset.name` \*

 | `string` |  |  |
| 

`asset.netbios_name` \*

 | `string` |  |  |
| 

`asset.network_id` \*

 | `string` |  |  |
| `asset.operating_systems` | `array` of `string`s |  |  |
| 

`asset.system_type` \*

 | `string` |  |  |
| 

`assetUuid` \*

 | `string` |  |  |
| 

`auditFile` \*

 | `string` |  |  |
| 

`checkId` \*

 | `string` |  |  |
| 

`checkInfo` \*

 | `string` |  |  |
| 

`checkName` \*

 | `string` |  |  |
| 

`complianceFunctionalId` \*

 | `string` |  |  |
| 

`complianceInformationalId` \*

 | `string` |  |  |
| 

`createdOn` \*

 | `number` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`expectedValue` \*

 | `string` |  |  |
| `firstSeenOn` | `number` |  |  |
| 

`id` \*

 | `string` |  |  |
| `indexedOn` | `number` |  |  |
| `lastFixed` | `number` |  |  |
| `lastObservedOn` | `number` |  |  |
| `lastSeenOn` | `number` |  |  |
| 

`metadataId` \*

 | `string` |  |  |
| 

`pluginName` \*

 | `string` |  |  |
| 

`status` \*

 | `string` |  |  |
| 

`synopsis` \*

 | `string` |  |  |
| 

`unameOutput` \*

 | `string` |  |  |

---

### Tenable Container Image

`tenable_container_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`createdOn` \*

 | `number` |  |  |
| 

`digest` \*

 | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`finishedOn` \*

 | `number` |  |  |
| 

`hasInventory` \*

 | `boolean` |  |  |
| 

`hasReport` \*

 | `boolean` |  |  |
| 

`imageHash` \*

 | `string` |  |  |
| 

`lastJobStatus` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` |  |  |
| `layers.digest` | `array` of `string`s |  |  |
| `layers.size` | `array` of `number`s |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`numberOfMalware` \*

 | `number` |  |  |
| 

`numberOfVulns` \*

 | `number` |  |  |
| 

`os` \*

 | `string` |  |  |
| 

`osVersion` \*

 | `string` |  |  |
| 

`pullCount` \*

 | `string` |  |  |
| 

`pushCount` \*

 | `string` |  |  |
| 

`repoId` \*

 | `string` |  |  |
| 

`repoName` \*

 | `string` |  |  |
| 

`reportUrl` \*

 | `string` |  |  |
| 

`score` \*

 | `number` |  |  |
| 

`size` \*

 | `string` |  |  |
| 

`source` \*

 | `string` |  |  |
| 

`status` \*

 | `string` |  |  |
| 

`tag` \*

 | `string` |  |  |
| 

`updatedOn` \*

 | `number` |  |  |
| 

`uploadedOn` \*

 | `number` |  |  |

---

### Tenable Container Repository

`tenable_container_repository` inherits from [Repository](/data-model/schemas/Repository.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` |  |  |
| 

`imagesCount` \*

 | `number` |  |  |
| 

`labelsCount` \*

 | `number` |  |  |
| 

`malwareCount` \*

 | `number` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`pullCount` \*

 | `number` |  |  |
| 

`pushCount` \*

 | `number` |  |  |
| 

`totalBytes` \*

 | `number` |  |  |
| 

`vulnerabilitiesCount` \*

 | `number` |  |  |

---

### Tenable Scanner

`tenable_scanner` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Tenable User

`tenable_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`containerUuid` \*

 | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`enabled` \*

 | `boolean` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lastlogin` \*

 | `number` |  |  |
| 

`loginFailCount` \*

 | `number` |  |  |
| 

`loginFailTotal` \*

 | `number` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`permissions` \*

 | `number` |  |  |
| 

`type` \*

 | `string` |  |  |
| 

`userName` \*

 | `string` |  | **deprecated**: true |
| 

`uuid` \*

 | `string` |  |  |
| 

`uuidId` \*

 | `string` |  | **deprecated**: true |

---

### Tenable Vulnerability Finding

`tenable_vulnerability_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentId` | `string` |  |  |
| 
`asset.uuid` \*

 | `string` |  |  |
| 

`assetDeviceType` \*

 | `string` |  |  |
| 

`assetHostname` \*

 | `string` |  |  |
| `assetIpv4` | `string` |  |  |
| `assetMacAddress` | `string` |  |  |
| `cpe` | `array` of `string`s |  |  |
| `cve` | `array` of `string`s |  |  |
| `cvss3BaseScore` | `number` |  |  |
| `cvss3TemporalScore` | `string` |  |  |
| `cvss3Vector` | `string` |  |  |
| `cvssBaseScore` | `number` |  |  |
| `cvssTemporalScore` | `string` |  |  |
| `cvssVector` | `string` |  |  |
| `description` | `string` |  |  |
| `exploitabilityEase` | `string` |  |  |
| `exploitAvailable` | `boolean` |  |  |
| `exploitedByMalware` | `boolean` |  |  |
| `exploitedByNessus` | `boolean` |  |  |
| `exploitFrameworkCanvas` | `boolean` |  |  |
| `exploitFrameworkCore` | `boolean` |  |  |
| `exploitFrameworkD2Elliot` | `boolean` |  |  |
| `exploitFrameworkExploithub` | `boolean` |  |  |
| `exploitFrameworkMetasploit` | `boolean` |  |  |
| `firstFoundOn` | `number` |  |  |
| `firstSeenOn` | `number` |  |  |
| 

`hasPatch` \*

 |  |  |  |
| `impact` | `string` |  |  |
| `lastFixedOn` | `number` |  |  |
| `lastFoundOn` | `number` |  |  |
| `lastSeenOn` | `number` |  |  |
| 

`name` \*

 | `string` |  |  |
| `numericPriority` | `number` |  | **deprecated**: true |
| `numericSeverity` | `number` |  | **deprecated**: true |
| `patchPublishedOn` | `number` |  |  |
| 

`plugin.id` \*

 | `number` |  |  |
| 

`port.port` \*

 | `number` |  |  |
| 

`port.protocol` \*

 | `string` |  |  |
| `port.service` | `string` |  |  |
| `recommendation` | `string` |  |  |
| `references` | `array` of `string`s |  |  |
| `riskFactor` | `string` |  |  |
| `scan.completedOn` | `number` |  |  |
| `scan.startedOn` | `number` |  |  |
| 

`scan.uuid` \*

 | `string` |  |  |
| `severityDefaultId` | `number` |  |  |
| `severityId` | `number` |  |  |
| `severityModificationType` | `string` |  |  |
| 

`state` \*

 | `string` |  |  |
| `stigSeverity` | `string` |  |  |
| 

`targets` \*

 | `array` **|** `null` |  |  |
| `unsupportedByVendor` | `boolean` |  |  |
| `vprScore` | `number` |  |  |
| 

`vulnerabilityAge` \*

 | `number` **|** `null` |  |  |
| `vulnPublishedOn` | `number` |  |  |

---

## Release Notes

-   **2026-02-13** — Migrated Container Security ingestion from the deprecated REST API to GraphQL for improved reliability.
-   **2025-11-05** — Added configuration option to filter Tenable vulnerability findings by severity modification type.
-   **2025-09-08** — Added vulnerability publication date and patch publication date to Tenable vulnerability entities.
-   **2025-07-02** — Added vulnerability age property to Tenable vulnerability findings, calculated from first detection date.

---

Source: /integrations/directory/terraform-cloud

# HCP Terraform

Visualize Terraform Cloud data, map Terraform Cloud users to employees, and monitor changes through queries and alerts.

## Installation

To add this integration within your JupiterOne workspace, you will need to create an API Token on Terraform Cloud.

> **INFO**
> 
> See [Terraform Cloud's documentation](https://www.terraform.io/cloud-docs/api-docs#authentication) for more information.

### Configuration in JupiterOne

To install the Terraform Cloud integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Terraform Cloud. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Terraform Cloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Terraform Cloud **API Key**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `tfe_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Entitlement Set | `tfe_entitlement_set` | [Entity](https://docs.jupiterone.io/data-model/schemas/Entity) |
| NHI User | `tfe_user` | [User](https://docs.jupiterone.io/data-model/schemas/User), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Organization | `tfe_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Resource | `tfe_workspace_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Team | `tfe_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team) |
| User | `tfe_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Workspace | `tfe_workspace` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `tfe_account` | **HAS** | `tfe_organization` |
| `tfe_organization` | **HAS** | `tfe_user` |
| `tfe_organization` | **HAS** | `tfe_workspace` |
| `tfe_organization` | **HAS** | `tfe_entitlement_set` |
| `tfe_organization` | **HAS** | `tfe_team` |
| `tfe_workspace` | **HAS** | `tfe_workspace_resource` |

### Tfe User

`tfe_user` inherits from [User](/data-model/schemas/User.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `avatarUrl` | `string` |  |  |
| `isServiceAccount` | `boolean` |  |  |
| `mfaVerified` | `boolean` |  |  |
| 
`nhiType` \*

 | `string` |  | **const**: service\_account |
| `permissions.canAccessViaTeams` | `boolean` |  |  |
| `permissions.canChangeEmail` | `boolean` |  |  |
| `permissions.canChangeUsername` | `boolean` |  |  |
| `permissions.canCreateModule` | `boolean` |  |  |
| `permissions.canCreateOrganizations` | `boolean` |  |  |
| `permissions.canCreateProvider` | `boolean` |  |  |
| `permissions.canCreateStateVersions` | `boolean` |  |  |
| `permissions.canCreateTeam` | `boolean` |  |  |
| `permissions.canCreateWorkspace` | `boolean` |  |  |
| `permissions.canDestroy` | `boolean` |  |  |
| `permissions.canForceUnlock` | `boolean` |  |  |
| `permissions.canLock` | `boolean` |  |  |
| `permissions.canManageCustomProviders` | `boolean` |  |  |
| `permissions.canManagePublicModules` | `boolean` |  |  |
| `permissions.canManagePublicProviders` | `boolean` |  |  |
| `permissions.canManageSso` | `boolean` |  |  |
| `permissions.canManageSubscription` | `boolean` |  |  |
| `permissions.canManageTags` | `boolean` |  |  |
| `permissions.canManageUsers` | `boolean` |  |  |
| `permissions.canManageUserTokens` | `boolean` |  |  |
| `permissions.canManageVarsets` | `boolean` |  |  |
| `permissions.canQueueApply` | `boolean` |  |  |
| `permissions.canQueueDestroy` | `boolean` |  |  |
| `permissions.canQueueRun` | `boolean` |  |  |
| `permissions.canReadSettings` | `boolean` |  |  |
| `permissions.canReadStateVersions` | `boolean` |  |  |
| `permissions.canReadVariable` | `boolean` |  |  |
| `permissions.canReadVarsets` | `boolean` |  |  |
| `permissions.canStartTrial` | `boolean` |  |  |
| `permissions.canTraverse` | `boolean` |  |  |
| `permissions.canUnlock` | `boolean` |  |  |
| `permissions.canUpdate` | `boolean` |  |  |
| `permissions.canUpdateAgentPools` | `boolean` |  |  |
| `permissions.canUpdateApiToken` | `boolean` |  |  |
| `permissions.canUpdateOauth` | `boolean` |  |  |
| `permissions.canUpdateSentinel` | `boolean` |  |  |
| `permissions.canUpdateSshKeys` | `boolean` |  |  |
| `permissions.canUpdateVariable` | `boolean` |  |  |

---

### Tfe User

`tfe_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `avatarUrl` | `string` |  |  |
| `isServiceAccount` | `boolean` |  |  |
| `mfaVerified` | `boolean` |  |  |
| `permissions.canAccessViaTeams` | `boolean` |  |  |
| `permissions.canChangeEmail` | `boolean` |  |  |
| `permissions.canChangeUsername` | `boolean` |  |  |
| `permissions.canCreateModule` | `boolean` |  |  |
| `permissions.canCreateOrganizations` | `boolean` |  |  |
| `permissions.canCreateProvider` | `boolean` |  |  |
| `permissions.canCreateStateVersions` | `boolean` |  |  |
| `permissions.canCreateTeam` | `boolean` |  |  |
| `permissions.canCreateWorkspace` | `boolean` |  |  |
| `permissions.canDestroy` | `boolean` |  |  |
| `permissions.canForceUnlock` | `boolean` |  |  |
| `permissions.canLock` | `boolean` |  |  |
| `permissions.canManageCustomProviders` | `boolean` |  |  |
| `permissions.canManagePublicModules` | `boolean` |  |  |
| `permissions.canManagePublicProviders` | `boolean` |  |  |
| `permissions.canManageSso` | `boolean` |  |  |
| `permissions.canManageSubscription` | `boolean` |  |  |
| `permissions.canManageTags` | `boolean` |  |  |
| `permissions.canManageUsers` | `boolean` |  |  |
| `permissions.canManageUserTokens` | `boolean` |  |  |
| `permissions.canManageVarsets` | `boolean` |  |  |
| `permissions.canQueueApply` | `boolean` |  |  |
| `permissions.canQueueDestroy` | `boolean` |  |  |
| `permissions.canQueueRun` | `boolean` |  |  |
| `permissions.canReadSettings` | `boolean` |  |  |
| `permissions.canReadStateVersions` | `boolean` |  |  |
| `permissions.canReadVariable` | `boolean` |  |  |
| `permissions.canReadVarsets` | `boolean` |  |  |
| `permissions.canStartTrial` | `boolean` |  |  |
| `permissions.canTraverse` | `boolean` |  |  |
| `permissions.canUnlock` | `boolean` |  |  |
| `permissions.canUpdate` | `boolean` |  |  |
| `permissions.canUpdateAgentPools` | `boolean` |  |  |
| `permissions.canUpdateApiToken` | `boolean` |  |  |
| `permissions.canUpdateOauth` | `boolean` |  |  |
| `permissions.canUpdateSentinel` | `boolean` |  |  |
| `permissions.canUpdateSshKeys` | `boolean` |  |  |
| `permissions.canUpdateVariable` | `boolean` |  |  |

---

## Release Notes

-   **2025-07-02** — Added support for Terraform Enterprise self-hosted deployments by allowing configuration of a custom host URL.

---

Source: /integrations/directory/threat-ng

# ThreatNG

Discover and monitor your external attack surface with ThreatNG. This integration ingests exposure scores, subdomains, DNS permutations, cloud assets, SaaS vendor identification, code secrets, and TLS/SSL certificate findings to provide visibility into your organization's digital risk posture.

## Installation

> **INFO**
> 
> You will need a ThreatNG API key to configure this integration. API keys are provisioned by ThreatNG for your organization. Contact your ThreatNG account representative or reach out to [info@threatngsecurity.com](mailto:info@threatngsecurity.com) to request API access.

To install the ThreatNG integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select ThreatNG. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **API Key** - Your ThreatNG API key used to authenticate requests. This key is sent via the `ApiKey` header to the ThreatNG Public API.
    
-   **Domain** - The domain you want to monitor (e.g., `example.com`). ThreatNG scans this domain for external attack surface findings including subdomains, cloud assets, DNS permutations, code secrets, SaaS identification, and TLS/SSL certificates.
    
-   **Polling Interval** - Select a frequency that meets your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to finalize the integration.

### What data is ingested?

| Data | Description |
| --- | --- |
| **Exposure Score** | Overall ThreatNG exposure grade and per-category scores (Cyber Risk, BEC & Phishing Susceptibility, Brand Damage, etc.) |
| **Subdomains** | Discovered subdomains for the monitored domain |
| **DNS Permutations** | Typosquatting and look-alike domains that are registered (taken), with or without MX records |
| **Code Secrets** | Exposed secrets and credentials found in public code repositories |
| **Cloud Discovery** | Cloud assets discovered across AWS, GCP, and other providers, including S3 buckets and storage containers |
| **SaaS Identification** | Third-party SaaS vendors identified as being used by the organization |
| **TLS/SSL Certificates** | Summary of TLS/SSL certificate status (total, valid, invalid) |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (7)

-   `https://api.threatngsecurity.com/v1/Job/GetAllJobs`
-   `https://api.threatngsecurity.com/v2/exposurePriority/{rating}/{domain}`
-   `https://api.threatngsecurity.com/v2/exposureScore/Grade/{domain}`
-   `https://api.threatngsecurity.com/v2/exposureSummary/module/SaaSIdentification/{domain}`
-   `https://api.threatngsecurity.com/v2/exposureSummary/module/Subdomains/{domain}`
-   `https://api.threatngsecurity.com/v2/exposureSummary/module/{module}/{domain}`
-   `https://api.threatngsecurity.com/v2/summary/DomainIntelligence/TLSSSLCertificates/{domain}`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://www.threatngsecurity.com/](https://www.threatngsecurity.com/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (7)

| Step | Endpoints |
| --- | --- |
| Fetch Certificate Findings | `https://api.threatngsecurity.com/v2/summary/DomainIntelligence/TLSSSLCertificates/{domain}` |
| Fetch Cloud Discovery Findings | `https://api.threatngsecurity.com/v2/exposureSummary/module/{module}/{domain}` |
| Fetch Code Secret Findings | `https://api.threatngsecurity.com/v2/exposurePriority/{rating}/{domain}` |
| Fetch DNS Permutation Findings | `https://api.threatngsecurity.com/v2/exposurePriority/{rating}/{domain}` |
| Fetch SaaS Identified Findings | `https://api.threatngsecurity.com/v2/exposureSummary/module/SaaSIdentification/{domain}` |
| Fetch Service | `https://api.threatngsecurity.com/v2/exposureScore/Grade/{domain}` |
| Fetch Subdomain Findings | `https://api.threatngsecurity.com/v2/exposureSummary/module/Subdomains/{domain}` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `threatng_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Certificate Finding | `threatng_certificate_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Cloud Discovery Asset | `threatng_cloud_discovery_asset` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Cloud Discovery Bucket | `threatng_cloud_discovery_bucket` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Cloud Discovery Finding | `threatng_cloud_discovery_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Code Secret Finding | `threatng_code_secret_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| DNS Permutation Finding | `threatng_dns_permutation_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| SaaS Identified Finding | `threatng_saas_identified_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Service | `threatng_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Subdomain Finding | `threatng_subdomain_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `threatng_account` | **HAS** | `threatng_service` |
| `threatng_cloud_discovery_finding` | **HAS** | `threatng_cloud_discovery_bucket` |
| `threatng_cloud_discovery_finding` | **HAS** | `threatng_cloud_discovery_asset` |
| `threatng_service` | **IDENTIFIED** | `threatng_dns_permutation_finding` |
| `threatng_service` | **IDENTIFIED** | `threatng_code_secret_finding` |
| `threatng_service` | **IDENTIFIED** | `threatng_cloud_discovery_finding` |
| `threatng_service` | **IDENTIFIED** | `threatng_certificate_finding` |
| `threatng_service` | **IDENTIFIED** | `threatng_subdomain_finding` |
| `threatng_service` | **IDENTIFIED** | `threatng_saas_identified_finding` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `threatng_cloud_discovery_bucket` | **IS** | `aws_s3_bucket` | FORWARD |
| `threatng_cloud_discovery_bucket` | **IS** | `azure_storage_container` | FORWARD |
| `threatng_cloud_discovery_bucket` | **IS** | `google_storage_bucket` | FORWARD |
| `threatng_code_secret_finding` | **HAS** | `github_repo` | REVERSE |
| `threatng_dns_permutation_finding` | **CONNECTS** | `Domain` | FORWARD |
| `threatng_saas_identified_finding` | **IDENTIFIED** | `jupiterone_integration` | FORWARD |

### Threatng Account

`threatng_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`vendor` \*

 | `string` | The vendor name for the account |  |

---

### Threatng Certificate Finding

`threatng_certificate_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`commonName` \*

 | `string` | The common name (CN) of the certificate |  |
| 

`isExpired` \*

 | `boolean` **|** `null` | Whether the certificate is expired |  |
| 

`issuer` \*

 | `string` **|** `null` | The issuer of the certificate |  |
| 

`isWildcard` \*

 | `boolean` **|** `null` | Whether the certificate is a wildcard certificate |  |
| 

`serialNumber` \*

 | `string` **|** `null` | The serial number of the certificate |  |
| 

`signatureAlgorithm` \*

 | `string` **|** `null` | The signature algorithm used |  |
| `source` | `string` | The source of this finding |  |
| 

`subjectAltNames` \*

 | `array` **|** `null` | Subject alternative names on the certificate |  |

---

### Threatng Cloud Discovery Asset

`threatng_cloud_discovery_asset` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetName` \*

 | `string` **|** `null` | The name of the cloud asset |  |
| 

`assetType` \*

 | `string` **|** `null` | The type of cloud asset |  |
| 

`cloudProvider` \*

 | `string` **|** `null` | The cloud provider of the asset |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the cloud asset is publicly accessible |  |
| 

`region` \*

 | `string` **|** `null` | The cloud region where the asset is located |  |
| `source` | `string` | The source of this finding |  |
| 

`url` \*

 | `string` **|** `null` | URL of the cloud asset |  |

---

### Threatng Cloud Discovery Bucket

`threatng_cloud_discovery_bucket` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`bucketAccessType` \*

 | `string` **|** `null` | The access type key from ThreatNG (e.g. 'S3 Bucket Open') |  |
| 

`bucketName` \*

 | `string` | The name/identifier of the cloud bucket |  |
| 

`bucketUrl` \*

 | `string` **|** `null` | The URL of the cloud bucket, used for mapped relationship matching |  |
| 

`cloudProvider` \*

 | `string` **|** `null` | The cloud provider of the bucket (e.g. Amazon Web Services, Microsoft Azure) |  |
| `source` | `string` | The source of this finding |  |

---

### Threatng Cloud Discovery Finding

`threatng_cloud_discovery_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cloudProvider` \*

 | `string` | The cloud provider name (e.g. Amazon Web Services, Microsoft Azure, Google Cloud Platform) |  |
| `source` | `string` | The source of this finding |  |
| 

`totalAssets` \*

 | `number` **|** `null` | Total number of cloud assets discovered |  |
| 

`totalBuckets` \*

 | `number` **|** `null` | Total number of cloud buckets discovered |  |

---

### Threatng Code Secret Finding

`threatng_code_secret_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`author` \*

 | `string` **|** `null` | The author of the commit containing the secret |  |
| 

`branch` \*

 | `string` **|** `null` | The branch where the secret was found |  |
| 

`commitHash` \*

 | `string` **|** `null` | The commit hash where the secret was introduced |  |
| 

`filePath` \*

 | `string` **|** `null` | The file path where the secret was found |  |
| 

`repository` \*

 | `string` | The repository name where the secret was found |  |
| 

`secretType` \*

 | `string` **|** `null` | The type of secret found (e.g. API key, credential) |  |
| `source` | `string` | The source of this finding |  |

---

### Threatng Dns Permutation Finding

`threatng_dns_permutation_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainPermutation` \*

 | `string` | The permuted domain name |  |
| 

`ipv4` \*

 | `string` **|** `null` | IPv4 address of the permuted domain |  |
| 

`ipv6` \*

 | `string` **|** `null` | IPv6 address of the permuted domain |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether the permuted domain is actively resolving |  |
| 

`isRegistered` \*

 | `boolean` **|** `null` | Whether the permuted domain is registered |  |
| 

`mxRecords` \*

 | `array` **|** `null` | MX records for the permuted domain |  |
| 

`nameServers` \*

 | `array` **|** `null` | Name servers for the permuted domain |  |
| 

`permutationType` \*

 | `string` **|** `null` | The type of permutation (e.g. homoglyph, insertion) |  |
| `source` | `string` | The source of this finding |  |

---

### Threatng Saas Identified Finding

`threatng_saas_identified_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`saasCategory` \*

 | `string` | The functional category of the SaaS product (e.g. Issue trackers, Live chat, Analytics) |  |
| 

`saasVendor` \*

 | `string` | The name of the identified SaaS vendor (e.g. Atlassian, Slack, Zoom) |  |
| `source` | `string` | The source of this finding |  |

---

### Threatng Service

`threatng_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domain` \*

 | `string` | The domain being monitored |  |
| 

`exposureGrade` \*

 | `string` **|** `null` | The overall ThreatNG exposure grade (e.g. A, B, C, D, F) |  |
| 

`exposureScores` \*

 | `array` **|** `null` | Individual exposure score grades (e.g. "Cyber Risk: C") |  |

---

### Threatng Subdomain Finding

`threatng_subdomain_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`httpStatus` \*

 | `number` **|** `null` | HTTP response status code |  |
| 

`ipv4` \*

 | `string` **|** `null` | IPv4 address of the subdomain |  |
| 

`ipv6` \*

 | `string` **|** `null` | IPv6 address of the subdomain |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether the subdomain is actively resolving |  |
| `source` | `string` | The source of this finding |  |
| 

`subdomain` \*

 | `string` | The discovered subdomain |  |
| 

`technologies` \*

 | `array` **|** `null` | Technologies detected on the subdomain |  |

---

---

Source: /integrations/directory/torii

# Torii

Visualize Torii users, roles, applications, and contracts in the JupiterOne graph. Map Torii users to employees in your JupiterOne account.

## Installation

> **INFO**
> 
> You will need to create an API key by visiting the Torii [API Access page](https://app.toriihq.com/team/settings/apiAccess). More information can be found [here](https://developers.toriihq.com/reference/introduction-2).

To install the Torii integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Torii. Click **New Instance** to begin configuring the integration.

Creating a Torii instance requires the following:

-   The **Account Name** used to identify the Torii account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your API Key.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Application | `torii_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Contract | `torii_contract` | [Document](https://docs.jupiterone.io/data-model/schemas/Document) |
| Organization | `torii_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Role | `torii_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| User | `torii_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `torii_application` | **HAS** | `torii_user` |
| `torii_application` | **HAS** | `torii_contract` |
| `torii_organization` | **HAS** | `torii_role` |
| `torii_organization` | **HAS** | `torii_user` |
| `torii_organization` | **HAS** | `torii_application` |
| `torii_organization` | **HAS** | `torii_contract` |
| `torii_user` | **ASSIGNED** | `torii_role` |

### Torii User

`torii_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `deletedInIdentitySources` | `boolean` |  |  |
| `external` | `boolean` |  |  |
| `lifecycleStatus` | `string` |  |  |
| `role` | `string` |  |  |
| `roleId` | `integer` |  |  |
| `userId` | `integer` |  |  |

---

---

Source: /integrations/directory/travisci

# TravisCI

Visualize Travis CI repositories, map Travis CI users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to create an API Token on Travis CI. This can be found under your **Settings > API Authentication** in Travis CI.

### Configuration in JupiterOne

To install the Travis CI integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Travis CI. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Travis CI account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Travis CI **Hostname** and **API Token**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `travisci_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| CodeRepo | `travisci_coderepo` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| User | `travisci_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `travisci_account` | **IS** | `travisci_user` |
| `travisci_user` | **CREATED** | `travisci_coderepo` |
| `travisci_user` | **USES** | `travisci_coderepo` |

---

Source: /integrations/directory/trellix

# Trellix

Visualize Trellix Endpoint protection groups and its corresponding protected devices and findings and monitor changes through alerts and queries.

## Installation

To use this integration, JupiterOne requires Client Credentials to a Trellix account. The process to obrain credentials is described in [Trellix documentation](https://developer.manage.trellix.com/mvision/selfservice/access_manag) under the 'API Access Management' section. There, you will need to request a client ID and Secret. Follow instructions specified and make sure you request a client that has access to at least the following scopes:

-   Devices Read Scope (epo.device.r)
-   Groups Read Scope (epo.grps.r)
-   Threats Read Scope (soc.act.tg)

After requesting the client, you will need to wait for Trellix to approve it. Once approved you will get the Cliend ID and Secret that you can use to integrate with JupiterOne.

### Configuration in JupiterOne

To install the Trellix integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Trellix. Click **New Instance** to begin configuring your integration, providing the following:

-   **API Key**: unique identifier used to authenticate and control access to Trellix API. You should be able to find it [here](https://developer.manage.trellix.com/mvision/selfservice/access_manag)
    
-   **Client ID**: Public identifier for the client created for Jupiter One who must have access to the previously mentioned scopes.
    
-   **Client Secret**: Private key pair of the Client ID, both are necessary to be able to authenticate the user in Trellix.
    
-   **Account Name** used to identify the Trellix account in JupiterOne.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Vulnerability Filters**: here you will be able to customize what severities you want to fetch when retrieving threats.
    
-   **Data Source Settigns**: here you will be able to customize the steps to be ingested. If desired, specific steps can be enabled/disabled from here.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `trellix_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device | `trellix_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Group | `trellix_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Service | `trellix_endpoint_protection` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Threat | `trellix_threat` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `trellix_account` | **HAS** | `trellix_endpoint_protection` |
| `trellix_account` | **HAS** | `trellix_group` |
| `trellix_account` | **HAS** | `trellix_device` |
| `trellix_device` | **ASSIGNED** | `trellix_group` |
| `trellix_threat` | **EXPLOITS** | `trellix_device` |

### Trellix Account

`trellix_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `description` | `string` |  |  |

---

### Trellix Device

`trellix_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentPlatform` | `string` |  |  |
| `agentState` | `number` |  |  |
| `agentVersion` | `string` |  |  |
| `computerName` | `string` |  |  |
| `cpuSpeed` | `number` |  |  |
| `cpuType` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `domainName` | `string` |  |  |
| `excludedTags` | `string` |  |  |
| `hardwareModel` | `string` |  |  |
| `hardwareSerial` | `string` |  |  |
| `hardwareVendor` | `string` |  |  |
| `ipAddress` | `string` |  |  |
| `ipHostName` | `string` |  |  |
| `isPortable` | `string` |  |  |
| `macAddress` | `string` |  |  |
| `managed` | `string` |  |  |
| `managedState` | `number` |  |  |
| `name` | `string` |  |  |
| `nodePath` | `string` |  |  |
| `numOfCpu` | `number` |  |  |
| `parentId` | `number` |  |  |
| `tags` | `array` of `string`s |  |  |
| `tenantId` | `number` |  |  |
| `totalPhysicalMemory` | `number` |  |  |
| `userName` | `string` |  |  |

---

### Trellix Endpoint Protection

`trellix_endpoint_protection` inherits from [Service](/data-model/schemas/Service.md)

---

### Trellix Group

`trellix_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `groupTypeId` | `number` |  |  |
| `l1ParentId` | `number` |  |  |
| `l2ParentId` | `number` |  |  |
| `nodePath` | `string` |  |  |
| `nodeTextPath` | `string` |  |  |
| `nodeTextPath2` | `string` |  |  |
| `notes` | `array` of `string`s |  |  |
| `parentId` | `number` |  |  |

---

---

Source: /integrations/directory/trellix-epo

# Trellix ePO

## Installation

> **INFO**
> 
> You will need your Trellix ePolicy Orchestrator (ePO) instance URL (hostname and port), username, and password to set up this integration. Ensure you have an account with appropriate permissions to access the Trellix ePolicy Orchestrator (ePO) API.

### Configuration in Trellix ePolicy Orchestrator (ePO)

1.  Ensure you have access to your Trellix ePolicy Orchestrator (ePO) instance with administrative permissions.
2.  Note your Trellix ePolicy Orchestrator (ePO) instance URL including the hostname and port (e.g., `https://hostname:8443`).
3.  Create or use an existing user account with API access permissions.
4.  Have your username and password ready for JupiterOne configuration.

### Configuration in JupiterOne

To install the Trellix ePolicy Orchestrator (ePO) integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Trellix ePO. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Trellix ePolicy Orchestrator (ePO) account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Trellix ePolicy Orchestrator (ePO) **Base URL** (hostname and port), for example `https://hostname:8443`.
    
-   Your Trellix ePolicy Orchestrator (ePO) **Username** for API access.
    
-   Your Trellix ePolicy Orchestrator (ePO) **Password** for API access.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `trellix_epo_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| User | `trellix_epo_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `trellix_epo_account` | **HAS** | `trellix_epo_user` |

### Trellix Epo Account

`trellix_epo_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Trellix Epo User

`trellix_epo_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isAdmin` | `boolean` |  |  |

---

## Release Notes

-   **2025-04-24** — Added Trellix ePO device user ingestion as new entities, relating device users to the hosts they use.

---

Source: /integrations/directory/trend-micro

# Trend Cloud One

Visualize Trend Micro administrators, endpoint agents, and devices, map Trend Micro agents to devices and owners, and monitor changes through queries and alerts.

## Installation

For this integration, you will need an API key from Trend Micro Cloud One.

### Prerequisites

Create an API key in the [Trend Micro Cloud One console](https://cloudone.trendmicro.com/):

1.  Log in to the Cloud One console and navigate to **Administration** > **API Keys**.
2.  Click **New** and give the key a descriptive name (for example, `jupiterone-read`).
3.  Assign the key a role with read access across the Cloud One services you want JupiterOne to ingest (Workload Security, File Storage Security, and Account Management).
4.  Copy the generated API key — it will not be shown again.

For details, see [Trend Micro's API key documentation](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-api-key).

### Configuration in JupiterOne

To install the Trend Micro integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Trend Micro. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Trend Micro account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Cloud One Region** — the region where your Cloud One account data is hosted (for example, `us-1`, `gb-1`, or `au-1`). See the [Cloud One regions reference](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-c1-regions) for a full list of valid values.
    
-   Your Trend Micro **API Key** generated for use with JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (7)

-   `https://accounts.cloudone.trendmicro.com/api/apikeys`
-   `https://accounts.cloudone.trendmicro.com/api/roles`
-   `https://accounts.cloudone.trendmicro.com/api/users`
-   `https://filestorage.{region}.cloudone.trendmicro.com/api/events`
-   `https://filestorage.{region}.cloudone.trendmicro.com/api/stacks`
-   `https://workload.{region}.cloudone.trendmicro.com/api/computergroups`
-   `https://workload.{region}.cloudone.trendmicro.com/api/computers`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (10)

-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-file-storage-security-Events](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-file-storage-security-Events)
-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-file-storage-security-Stack](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-file-storage-security-Stack)
-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-file-storage-security-api-reference](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-file-storage-security-api-reference)
-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-api-key](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-api-key)
-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-api-reference](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-api-reference)
-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-role](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-role)
-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-user-account](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-user-account)
-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-workload-security-api-reference](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-workload-security-api-reference)
-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-workload-security-computergroups](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-workload-security-computergroups)
-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-workload-security-computers](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-workload-security-computers)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (3)

| Step | Endpoints |
| --- | --- |
| Build administrator role relationships | \- |
| Build computer group relationships | \- |
| Fetch File Storage Scan Findings | `https://filestorage.{region}.cloudone.trendmicro.com/api/events` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Administrator | `trend_micro_administrator` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Administrator Role | `trend_micro_administrator_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| API Key | `trend_micro_api_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| File Storage AWS Stack | `trend_cloud_one_file_storage_aws_stack` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| File Storage Azure Stack | `trend_cloud_one_file_storage_azure_stack` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| File Storage GCP Stack | `trend_cloud_one_file_storage_gcp_stack` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| File Storage Scan Event Finding | `trend_cloud_one_file_storage_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| TrendMicro Host | `trend_cloud_one_workload_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Workload Computer Group | `trend_cloud_one_workload_computer_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Workload Sensor | `trend_cloud_one_workload_sensor` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `trend_cloud_one_file_storage_aws_stack` | **MANAGES** | `trend_cloud_one_file_storage_aws_stack` |
| `trend_cloud_one_file_storage_aws_stack` | **IDENTIFIED** | `trend_cloud_one_file_storage_finding` |
| `trend_cloud_one_file_storage_azure_stack` | **MANAGES** | `trend_cloud_one_file_storage_azure_stack` |
| `trend_cloud_one_file_storage_azure_stack` | **IDENTIFIED** | `trend_cloud_one_file_storage_finding` |
| `trend_cloud_one_file_storage_gcp_stack` | **MANAGES** | `trend_cloud_one_file_storage_gcp_stack` |
| `trend_cloud_one_file_storage_gcp_stack` | **IDENTIFIED** | `trend_cloud_one_file_storage_finding` |
| `trend_cloud_one_workload_computer_group` | **HAS** | `trend_cloud_one_workload_sensor` |
| `trend_cloud_one_workload_sensor` | **PROTECTS** | `trend_cloud_one_workload_host` |
| `trend_micro_administrator` | **ASSIGNED** | `trend_micro_administrator_role` |

### Trend Cloud One File Storage Aws Stack

`trend_cloud_one_file_storage_aws_stack` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `awsAccount` | `string` |  |  |
| `awsManagementRole` | `string` |  |  |
| `awsRegion` | `string` |  |  |
| `awsScannerLambdaAliasArn` | `string` |  |  |
| `awsScannerQueueUrl` | `string` |  |  |
| 
`provider` \*

 | `string` |  | **const**: aws |
| 

`status` \*

 | `string` |  | **Any of**:

-   `ok`

-   `creating`

-   `creation-failed`

 |
| `statusDetail` | `string` |  |  |
| 

`storageName` \*

 | `string` | The name of the protected storage. |  |
| 

`type` \*

 | `string` |  | **Any of**:

-   `scanner`

-   `storage`

 |

---

### Trend Cloud One File Storage Azure Stack

`trend_cloud_one_file_storage_azure_stack` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `azureBlobActionTagRoleAssignmentId` | `string` |  |  |
| `azureBlobActionTagRoleDefinitionName` | `string` |  |  |
| `azureBlobListenerRoleAssignmentId` | `string` |  |  |
| `azureBlobListenerRoleDefinitionName` | `string` |  |  |
| `azureBlobSystemTopicSubscriptionId` | `string` |  |  |
| `azureResourceGroupId` | `string` |  |  |
| `azureScannerIdentityPrincipalId` | `string` |  |  |
| `azureScannerQueueNamespace` | `string` |  |  |
| `azureSubscriptionName` | `string` |  |  |
| `azureTenantId` | `string` |  |  |
| 
`provider` \*

 | `string` |  | **const**: azure |
| 

`status` \*

 | `string` |  | **Any of**:

-   `ok`

-   `creating`

-   `creation-failed`

 |
| `statusDetail` | `string` |  |  |
| 

`storageName` \*

 | `string` | The name of the protected storage. |  |
| 

`type` \*

 | `string` |  | **Any of**:

-   `scanner`

-   `storage`

 |

---

### Trend Cloud One File Storage Finding

`trend_cloud_one_file_storage_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`detectionType` \*

 | `string` |  |  |
| 

`filename` \*

 | `string` | The hash of the name of the scanned file. |  |
| 

`malwareName` \*

 | `string` |  |  |
| 

`malwareType` \*

 | `string` |  |  |
| 

`numericSeverity` \*

 | `number` | Always 0 as Cloud One does not provide this value. |  |
| 

`open` \*

 | `boolean` | Always true as Cloud One does not provide this value. |  |
| 

`provider` \*

 | `string` |  | **Any of**:

-   `aws`

-   `azure`

-   `gcp`

 |
| 

`providerAccount` \*

 | `string` |  |  |
| 

`severity` \*

 | `string` | Always unknown as Cloud One does not provide this value. |  |
| 

`storageName` \*

 | `string` | The name of the protected storage. |  |

---

### Trend Cloud One File Storage Gcp Stack

`trend_cloud_one_file_storage_gcp_stack` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `gcpDeploymentName` | `string` |  |  |
| `gcpIsLegacyDeployment` | `boolean` |  |  |
| `gcpProjectId` | `string` |  |  |
| `gcpRegion` | `string` |  |  |
| `gcpScannerSecretsName` | `string` |  |  |
| `gcpScannerServiceAccountId` | `string` |  |  |
| `gcpScannerTopic` | `string` |  |  |
| `gcpScanResultTopic` | `string` |  |  |
| 
`provider` \*

 | `string` |  | **const**: gcp |
| 

`status` \*

 | `string` |  | **Any of**:

-   `ok`

-   `creating`

-   `creation-failed`

 |
| `statusDetail` | `string` |  |  |
| 

`storageName` \*

 | `string` | The name of the protected storage. |  |
| 

`type` \*

 | `string` |  | **Any of**:

-   `scanner`

-   `storage`

 |

---

### Trend Cloud One Workload Host

`trend_cloud_one_workload_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentGUID` | `string` |  |  |
| `agentStatus` | `string` |  |  |
| `applianceStatus` | `string` |  |  |
| `awsAccountId` | `string` **|** `null` |  |  |
| `ec2InstanceId` | `string` **|** `null` |  |  |
| `hostGUID` | `string` |  |  |

---

### Trend Cloud One Workload Sensor

`trend_cloud_one_workload_sensor` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentGUID` | `string` |  |  |
| `agentStatus` | `string` **|** `null` |  |  |
| `antiMalwareStatus` | `string` |  |  |
| `applianceStatus` | `string` **|** `null` |  |  |
| `applicationControlStatus` | `string` |  |  |
| `awsAccountId` | `string` **|** `null` |  |  |
| `cloudProvider` | `string` |  |  |
| `ec2InstanceId` | `string` **|** `null` |  |  |
| `firewallStatus` | `string` |  |  |
| `groupId` | `string` |  |  |
| `hostGUID` | `string` |  |  |
| `hostname` | `string` |  |  |
| `integrityMonitoringStatus` | `string` |  |  |
| `intrusionPreventionStatus` | `string` |  |  |
| `logInspectionStatus` | `string` |  |  |
| `platform` | `string` |  |  |
| `securityUpdateStatus` | `string` |  |  |
| `webReputationStatus` | `string` |  |  |

---

---

Source: /integrations/directory/trend-vision-one

# Trend Micro Vision One

TrendMicroVisionOne enhances and consolidates detection, investigation and response capabilities across email, endpoints, servers, cloud workloads and networks.

## Installation

### In TrendMicroVisionOne

1.  Create a TrendMicro Vision One Account.
2.  Login to the Tenant using the URL: [https://portal.{country\_Region}.xdr.trendmicro.com](https://portal.%7Bcountry_Region%7D.xdr.trendmicro.com) ![Login](/assets/images/login-459c56b5187820a125a8efce632b48a9.png)
3.  Create a User Role
    -   Go to **Administration** > **User Role** > **Add Role** ![Add Role](/assets/images/addrole-402d9faeef83cf9aa85077d517e1b172.png)
    -   Under the **General Information** section, provide the appropriate **role name** and **role description**. ![Role Name and Description](/assets/images/rolenamedesc-684037d2961ed037fb2393b4256674e2.png)
    -   Under the Permission section, provide the following permissions:
        -   Cloud Account Management (View)
        -   User Accounts (View)
        -   Endpoint Inventory (View)
        -   Workbench (View, Filter, Search)
        -   Report Management (View, Configure, and Download)
    -   Under the Scope section, select necessary scopes. ![Scopes](/assets/images/scopes-43df654a39c7fb1ca4b57274cde2fc70.png)
    -   Click on the Save button.
4.  Generate API Key
    -   Go to **Administration** > **API Keys** > **Add API Key** ![API Key Generation](/assets/images/apikeygeneration-c2506754416c77f27337699c252e0401.png)
    -   Provide the API key name, Select the Role provided in step 3, and the Expiration time as **No Expiration Date**.
    -   Turn on the status and add the description for the API key.
    -   Click on the Add button.

### Configuration in JupiterOne

To install the Trend Micro integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Trend Micro. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

#### Authentication

-   In **Trend Micro Vision One API Key** enter the API key previously generated.
    
-   In **Trend Micro Vision One API Base URL** Enter the Trend Micro Vision One URL (e.g. `https://api.in.xdr.trendmicro.com`).
    

\[Optional\] Disable TLS Verification - Set this to true in advanced settings only if you have an on-prem Trend Micro Vision One server that does not have a valid SSL certificate configured. For most cases this value should be false.

1.  Click **Create Configuration** after you have entered all the values.

#### General Settings

-   The **Account Name** used to identify the Trend Micro account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `trend_micro_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `trend_micro_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Device\_Sensor\_Agent | `trend_micro_sensor` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Device\_Sensor\_Agent | `trend_micro_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Service | `trend_micro_vision_one` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Vulnerability | `trend_micro_vulnerability` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Vulnerability | `trend_micro_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `trend_micro_account` | **HAS** | `trend_micro_sensor` |
| `trend_micro_account` | **HAS** | `trend_micro_vision_one` |
| `trend_micro_sensor` | **PROTECTS** | `trend_micro_host` |
| `trend_micro_sensor` | **HAS** | `trend_micro_alert` |
| `trend_micro_vulnerability` | **EXPLOITS** | `trend_micro_sensor` |

### Trend Micro Host

`trend_micro_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `policyName` | `string` **|** `null` | Name of the Trend Micro Vision One protection policy assigned to the endpoint agent. |  |

---

### Trend Micro Sensor

`trend_micro_sensor` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `policyName` | `string` **|** `null` | Name of the Trend Micro Vision One protection policy assigned to the endpoint agent. |  |

---

### Trend Micro Vulnerability

`trend_micro_vulnerability` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

---

### Trend Micro Vulnerability

`trend_micro_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

---

## Release Notes

-   **2025-06-04** — New Trend Micro Vision One integration: ingests host agents, vulnerability findings, and security alerts with host relationships.

---

Source: /integrations/directory/tufin

# Tufin

Visualize Tufin-managed firewalls, security policies, firewall rules, network zones, and policy violations, map violations to the rules that triggered them, and monitor firewall policy changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need credentials for a Tufin Orchestration Suite (TOS) user with access to the SecureTrack and optionally SecureChange APIs. See the [Tufin user management documentation](https://forum.tufin.com/support/kc/latest/Content/Suite/1073.htm) and [user roles documentation](https://forum.tufin.com/support/kc/latest/Content/Suite/10096.htm) for full details.
> 
> ### SecureTrack user setup
> 
> The integration uses SecureTrack to collect firewalls, policies, firewall rules, network zones, and policy violations.
> 
> 1.  Log in to the TOS web UI as an administrator.
>     
> 2.  Navigate to **Settings → Administration → Users**.
>     
> 3.  Create a dedicated user and assign it the **Administrator** role in SecureTrack.
>     
>     > A **User** role is sufficient for devices, policies, rules, and policy violations, but the **Administrator** role is required to access network zones via the API.
>     
> 4.  Assign the user access to all relevant devices.
>     
> 
> ### SecureChange user setup (optional)
> 
> SecureChange is a separate application within TOS and requires independent user configuration. Skip this section if you do not want to ingest SecureChange users or tickets.
> 
> 1.  Navigate to **Settings → Users** in the SecureChange UI (or use LDAP group import).
> 2.  Add the user to SecureChange and assign the appropriate role:
>     -   **Auditor** — read-only access to tickets. Sufficient if you only need ticket ingestion.
>     -   **System Administrator** — required if you also want to ingest SecureChange users.

To install the Tufin integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Tufin. Click **New Instance** to begin configuring your integration.

Creating a Tufin instance requires the following:

-   The **Account Name** used to identify the Tufin account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your TOS server **Hostname** (or IP address), e.g. `tos.example.com`.
    
-   Your TOS **Username** and **Password** to authenticate with the SecureTrack and SecureChange APIs.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `tufin_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Firewall | `tufin_firewall` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| FirewallRule | `tufin_firewall_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| NetworkZone | `tufin_network_zone` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Policy | `tufin_policy` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| PolicyViolation | `tufin_policy_violation` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| SecurityPolicy | `tufin_security_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Ticket | `tufin_ticket` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| User | `tufin_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `tufin_account` | **HAS** | `tufin_firewall` |
| `tufin_account` | **HAS** | `tufin_security_policy` |
| `tufin_account` | **HAS** | `tufin_network_zone` |
| `tufin_account` | **HAS** | `tufin_user` |
| `tufin_firewall` | **HAS** | `tufin_policy` |
| `tufin_firewall_rule` | **HAS** | `tufin_policy_violation` |
| `tufin_policy` | **HAS** | `tufin_firewall_rule` |
| `tufin_user` | **OPENED** | `tufin_ticket` |

### Tufin Account

`tufin_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`hostname` \*

 | `string` | The hostname or IP address of the TOS server. |  |

---

### Tufin Firewall

`tufin_firewall` inherits from [Firewall](/data-model/schemas/Firewall.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`deviceId` \*

 | `string` | The unique identifier of the device in Tufin SecureTrack. |  |
| 

`domainId` \*

 | `number` **|** `null` | The identifier of the SecureTrack domain that owns this device. |  |
| 

`domainName` \*

 | `string` **|** `null` | The name of the SecureTrack domain that owns this device. |  |
| 

`hasTopology` \*

 | `boolean` **|** `null` | Whether the device participates in the SecureTrack topology map. |  |
| 

`ipAddress` \*

 | `string` **|** `null` | The management IP address of the device. |  |
| 

`isOffline` \*

 | `boolean` **|** `null` | Whether the device is currently offline from Tufin SecureTrack. |  |
| 

`model` \*

 | `string` **|** `null` | The model of the device as reported by SecureTrack. |  |
| 

`parentId` \*

 | `number` **|** `null` | The identifier of the parent device, when this device is virtual or managed. |  |
| 

`vendor` \*

 | `string` **|** `null` | The vendor of the device as reported by SecureTrack. |  |
| 

`virtualType` \*

 | `string` **|** `null` | The virtualization type reported by SecureTrack (e.g. context, vsys). |  |

---

### Tufin Firewall Rule

`tufin_firewall_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `string` **|** `null` | The action enforced by the rule (e.g. accept, drop, reject). |  |
| 

`comment` \*

 | `string` **|** `null` | Free-form comment associated with the rule. |  |
| 

`deviceId` \*

 | `number` | The identifier of the device that owns this rule. |  |
| 

`isImplicit` \*

 | `boolean` **|** `null` | Whether the rule is implicitly added by the device rather than user-defined. |  |
| 

`ruleId` \*

 | `number` | The unique identifier of the rule in SecureTrack. |  |
| 

`ruleNumber` \*

 | `number` **|** `null` | The order of the rule within its policy. |  |
| 

`ruleType` \*

 | `string` **|** `null` | The type/category of the rule as reported by SecureTrack. |  |

---

### Tufin Network Zone

`tufin_network_zone` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainId` \*

 | `number` **|** `null` | The identifier of the SecureTrack domain that owns this zone. |  |
| 

`domainName` \*

 | `string` **|** `null` | The name of the SecureTrack domain that owns this zone. |  |
| 

`zoneId` \*

 | `number` | The unique identifier of the zone in SecureTrack. |  |

---

### Tufin Policy

`tufin_policy` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`deviceId` \*

 | `number` | The identifier of the device that owns this policy. |  |
| 

`policyId` \*

 | `number` | The unique identifier of the policy in SecureTrack. |  |

---

### Tufin Policy Violation

`tufin_policy_violation` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`deviceId` \*

 | `number` | The identifier of the device whose rule triggered the violation. |  |
| 

`policyName` \*

 | `string` **|** `null` | The Unified Security Policy control name (policy\_control\_name) that this rule violates. |  |
| 

`ruleId` \*

 | `number` | The identifier of the rule that triggered the violation. |  |
| 

`ruleNumber` \*

 | `number` **|** `null` | The order of the violating rule within its policy. |  |

---

### Tufin Security Policy

`tufin_security_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainId` \*

 | `number` **|** `null` | The identifier of the SecureTrack domain that owns this policy. |  |
| 

`domainName` \*

 | `string` **|** `null` | The name of the SecureTrack domain that owns this policy. |  |
| 

`policyId` \*

 | `number` | The unique identifier of the Unified Security Policy in SecureTrack. |  |

---

### Tufin Ticket

`tufin_ticket` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`currentStep` \*

 | `string` **|** `null` | The current workflow step the ticket is on. |  |
| 

`expiresOn` \*

 | `number` **|** `null` | The ticket expiration date as a Unix timestamp in milliseconds. |  |
| 

`priority` \*

 | `string` **|** `null` | The priority assigned to the ticket. |  |
| 

`requester` \*

 | `string` **|** `null` | The username of the user who opened the ticket. |  |
| 

`slaStatus` \*

 | `string` **|** `null` | The SLA status reported by SecureChange. |  |
| 

`ticketId` \*

 | `number` | The unique identifier of the ticket in SecureChange. |  |
| 

`ticketStatus` \*

 | `string` **|** `null` | The current status of the ticket as reported by SecureChange. |  |
| 

`workflowName` \*

 | `string` **|** `null` | The name of the SecureChange workflow handling the ticket. |  |

---

### Tufin User

`tufin_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`authenticationMethod` \*

 | `string` **|** `null` | The authentication method configured for the user (e.g. local, LDAP). |  |
| 

`userId` \*

 | `number` | The unique identifier of the user in SecureChange. |  |
| 

`userType` \*

 | `string` **|** `null` | The party type reported by SecureChange (e.g. user, group, ldap\_user). |  |

---

---

Source: /integrations/directory/upwind

# Upwind

Visualize Upwind cloud security posture including vulnerability findings, threat detections, configuration findings, and inventory assets. Monitor changes through queries and alerts.

## Installation

### Prerequisites in Upwind

Before configuring the integration in JupiterOne, you must generate API credentials in Upwind.

> **INFO**
> 
> You will need the following parameters:
> 
> -   **Client ID** and **Client Secret** — OAuth 2.0 credentials for API authentication
> -   **Organization ID** — Your Upwind organization identifier (e.g., `org_123456789`)
> -   **Region** — The regional API endpoint your Upwind account uses: `us`, `eu`, or `me`

### Step 1: Generate API Credentials in Upwind

1.  Log in to the [Upwind console](https://console.upwind.io).
2.  Navigate to **Settings** > **Credentials**.
3.  Click **Generate Credential**.
4.  Select **API (Call the Upwind API service)**.
5.  Click **Generate New Credentials**.
6.  Copy and securely store the **Client ID** and **Client Secret**. The client secret is shown only once.

> **WARNING**
> 
> Treat your client credentials like a password. Store them securely and never share them in plain text.

### Step 2: Find Your Organization ID

Your Organization ID is available in the Upwind console URL or in your account settings. It follows the format `org_` followed by alphanumeric characters (e.g., `org_123456789`).

### Step 3: Determine Your Region

Upwind operates in three regional environments. Select the region that matches your Upwind deployment:

| Region | API Endpoint |
| --- | --- |
| US (default) | `https://api.upwind.io` |
| EU | `https://api.eu.upwind.io` |
| ME | `https://api.me.upwind.io` |

### Step 4: Configure the Integration in JupiterOne

Navigate to the **Integrations** tab in JupiterOne and select Upwind. Click **New Instance** to begin.

Creating an Upwind instance requires the following:

-   The **Account Name** used to identify this Upwind account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the AccountName toggle is enabled.
    
-   **Description** to help identify the integration instance (optional).
    
-   **Polling Interval** that suits your monitoring needs. You may leave this as `DISABLED` and invoke the integration manually.
    
-   Your Upwind **Client ID** and **Client Secret** from Step 1.
    
-   Your Upwind **Organization ID** from Step 2.
    
-   Your Upwind **Region** (`us`, `eu`, or `me`). Defaults to `us` if not specified.
    

## Data Volume Configuration

The following settings control which findings and detections are ingested. Narrowing these filters reduces ingestion volume and keeps your graph focused on the most relevant security data.

### Vulnerability Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Vulnerability Severity** | Severity levels of vulnerability findings to include. Leave all unselected to ingest all severities. | Critical, High | Critical, High, Medium, Low, Unclassified, Other |
| **Exploitable Only** | When enabled, only ingests vulnerabilities marked as exploitable. | Disabled | — |
| **Fix Available Only** | When enabled, only ingests vulnerabilities that have a fix available. | Disabled | — |

### Configuration Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Configuration Finding Severity** | Severity levels of configuration findings to include. Leave all unselected to ingest all severities. | Critical, High | Critical, High, Medium, Low |
| **Failed Findings Only** | When enabled, only ingests configuration findings with a FAIL status, excluding findings that pass. | Disabled | — |
| **Configuration Findings Ingestion Window** | How far back to look for configuration findings. Reducing this window limits the volume of findings ingested on each run. | 30 days | 7, 15, 30, 60, 90, 180, 365 |

### Threat Detections

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Threat Detection Severity** | Severity levels of threat detections to include. Leave all unselected to ingest all severities. | Critical, High | Critical, High, Medium, Low |
| **Threat Detections Ingestion Window** | How far back to look for threat detections. Reducing this window limits the volume of detections ingested on each run. | 30 days | 7, 15, 30, 60, 90, 180, 365 |

Click **Create** once all values are provided to finish setting up the integration.

### Next steps

Once configured, the integration will run on the polling interval you selected, populating data in JupiterOne. See the [Instance management guide](/integrations/instance-management.md) to learn more about managing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (9)

-   `https://api.upwind.io/v1/organizations/{organizationId}/apisecurity-endpoints`
-   `https://api.upwind.io/v1/organizations/{organizationId}/configuration-findings`
-   `https://api.upwind.io/v1/organizations/{organizationId}/configuration-frameworks`
-   `https://api.upwind.io/v1/organizations/{organizationId}/configuration-rules`
-   `https://api.upwind.io/v1/organizations/{organizationId}/sbom-packages`
-   `https://api.upwind.io/v1/organizations/{organizationId}/threat-detections`
-   `https://api.upwind.io/v1/organizations/{organizationId}/threat-policies`
-   `https://api.upwind.io/v1/organizations/{organizationId}/vulnerability-findings`
-   `https://api.upwind.io/v2/organizations/{organizationId}/inventory/assets/search`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (11)

-   [https://docs.upwind.io/restapi/management/v1](https://docs.upwind.io/restapi/management/v1)
-   [https://docs.upwind.io/restapi/v1/list-api-endpoints](https://docs.upwind.io/restapi/v1/list-api-endpoints)
-   [https://docs.upwind.io/restapi/v1/list-configuration-findings](https://docs.upwind.io/restapi/v1/list-configuration-findings)
-   [https://docs.upwind.io/restapi/v1/list-configuration-frameworks](https://docs.upwind.io/restapi/v1/list-configuration-frameworks)
-   [https://docs.upwind.io/restapi/v1/list-configuration-rules](https://docs.upwind.io/restapi/v1/list-configuration-rules)
-   [https://docs.upwind.io/restapi/v1/list-sbom-packages](https://docs.upwind.io/restapi/v1/list-sbom-packages)
-   [https://docs.upwind.io/restapi/v1/list-threat-detections](https://docs.upwind.io/restapi/v1/list-threat-detections)
-   [https://docs.upwind.io/restapi/v1/list-threat-policies](https://docs.upwind.io/restapi/v1/list-threat-policies)
-   [https://docs.upwind.io/restapi/v1/list-vulnerability-findings](https://docs.upwind.io/restapi/v1/list-vulnerability-findings)
-   [https://docs.upwind.io/restapi/v2/inventory](https://docs.upwind.io/restapi/v2/inventory)
-   [https://docs.upwind.io/settings/credentials](https://docs.upwind.io/settings/credentials)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (6)

| Step | Endpoints |
| --- | --- |
| Fetch API Endpoints | `https://api.upwind.io/v1/organizations/{organizationId}/apisecurity-endpoints` |
| Fetch Configuration Findings | `https://api.upwind.io/v1/organizations/{organizationId}/configuration-findings` |
| Fetch Configuration Rules | `https://api.upwind.io/v1/organizations/{organizationId}/configuration-rules` |
| Fetch Inventory Assets | `https://api.upwind.io/v2/organizations/{organizationId}/inventory/assets/search` |
| Fetch Threat Detections | `https://api.upwind.io/v1/organizations/{organizationId}/threat-detections` |
| Fetch Vulnerability Findings | `https://api.upwind.io/v1/organizations/{organizationId}/vulnerability-findings` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `upwind_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| API Endpoint | `upwind_api_endpoint` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| AWS Auto Scaling Group | `upwind_aws_asg` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| AWS DynamoDB Table | `upwind_aws_dynamodb_table` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| AWS EBS Volume | `upwind_aws_ebs_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| AWS EC2 Instance | `upwind_aws_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS ECS Cluster | `upwind_aws_ecs_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS ECS Service | `upwind_ecs_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS ECS Task | `upwind_ecs_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS EKS Cluster | `upwind_eks_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS IAM Group | `upwind_aws_iam_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| AWS IAM Policy | `upwind_aws_iam_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| AWS IAM Role | `upwind_aws_iam_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| AWS IAM User | `upwind_aws_iam_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| AWS Internet Gateway | `upwind_aws_igw` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Lambda Function | `upwind_aws_lambda` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| AWS NAT Gateway | `upwind_aws_nat_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Network ACL | `upwind_aws_network_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS RDS Cluster | `upwind_aws_rds_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS RDS Instance | `upwind_aws_rds_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| AWS Route Table | `upwind_aws_route_table` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS S3 Bucket | `upwind_aws_s3_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Security Group | `upwind_aws_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Subnet | `upwind_aws_subnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS VPC | `upwind_aws_vpc` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Azure AKS Cluster | `upwind_aks_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Azure Function App | `upwind_azure_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| Azure Virtual Machine | `upwind_azure_vm` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Azure VMSS | `upwind_azure_vmss` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| BYOC Host | `upwind_byoc_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Cloud Account | `upwind_cloud_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Configuration Finding | `upwind_configuration_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Configuration Framework | `upwind_configuration_framework` | [Framework](https://docs.jupiterone.io/data-model/schemas/Framework) |
| Configuration Rule | `upwind_configuration_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Container Image | `upwind_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| GCP Cloud Function | `upwind_gcp_cloud_run_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| GCP Cloud Run | `upwind_gcp_cloud_run_container` | [Workload](https://docs.jupiterone.io/data-model/schemas/Workload) |
| GCP Cloud Run Job | `upwind_gcp_cloud_run_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| GCP Compute Instance | `upwind_gcp_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| GCP GKE Cluster | `upwind_gke_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| GCP Instance Group | `upwind_gcp_instance_group` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Host | `upwind_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Host Container | `upwind_container` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| Inventory Asset | `upwind_inventory_asset` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Kubernetes Cluster | `upwind_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Kubernetes CronJob | `upwind_k8s_cronjob` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Kubernetes DaemonSet | `upwind_k8s_daemonset` | [Workload](https://docs.jupiterone.io/data-model/schemas/Workload) |
| Kubernetes Deployment | `upwind_k8s_deployment` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Kubernetes Node | `upwind_k8s_node` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Kubernetes ReplicaSet | `upwind_k8s_replicaset` | [Workload](https://docs.jupiterone.io/data-model/schemas/Workload) |
| Kubernetes Standalone Pod | `upwind_k8s_pod` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| Kubernetes StatefulSet | `upwind_k8s_statefulset` | [Workload](https://docs.jupiterone.io/data-model/schemas/Workload) |
| Resource | `upwind_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| SBOM Package | `upwind_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Service | `upwind_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Threat Detection | `upwind_threat_detection` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Threat Policy | `upwind_threat_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Vulnerability Finding | `upwind_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `upwind_account` | **HAS** | `upwind_service` |
| `upwind_aws_instance` | **HAS** | `upwind_vulnerability` |
| `upwind_azure_vm` | **HAS** | `upwind_vulnerability` |
| `upwind_byoc_host` | **HAS** | `upwind_vulnerability` |
| `upwind_cloud_account` | **HAS** | `upwind_resource` |
| `upwind_cloud_account` | **HAS** | `upwind_aws_instance` |
| `upwind_cloud_account` | **HAS** | `upwind_azure_vm` |
| `upwind_cloud_account` | **HAS** | `upwind_gcp_instance` |
| `upwind_cloud_account` | **HAS** | `upwind_k8s_node` |
| `upwind_cloud_account` | **HAS** | `upwind_host` |
| `upwind_cloud_account` | **HAS** | `upwind_byoc_host` |
| `upwind_configuration_framework` | **HAS** | `upwind_configuration_rule` |
| `upwind_configuration_rule` | **IDENTIFIED** | `upwind_configuration_finding` |
| `upwind_gcp_instance` | **HAS** | `upwind_vulnerability` |
| `upwind_host` | **HAS** | `upwind_vulnerability` |
| `upwind_k8s_node` | **HAS** | `upwind_vulnerability` |
| `upwind_resource` | **HAS** | `upwind_threat_detection` |
| `upwind_resource` | **HAS** | `upwind_configuration_finding` |
| `upwind_resource` | **HAS** | `upwind_api_endpoint` |
| `upwind_resource` | **IS** | `upwind_inventory_asset` |
| `upwind_resource` | **IS** | `upwind_aws_instance` |
| `upwind_resource` | **IS** | `upwind_aws_lambda` |
| `upwind_resource` | **IS** | `upwind_aws_asg` |
| `upwind_resource` | **IS** | `upwind_aws_vpc` |
| `upwind_resource` | **IS** | `upwind_aws_security_group` |
| `upwind_resource` | **IS** | `upwind_aws_network_acl` |
| `upwind_resource` | **IS** | `upwind_aws_subnet` |
| `upwind_resource` | **IS** | `upwind_aws_igw` |
| `upwind_resource` | **IS** | `upwind_aws_nat_gateway` |
| `upwind_resource` | **IS** | `upwind_aws_route_table` |
| `upwind_resource` | **IS** | `upwind_aws_s3_bucket` |
| `upwind_resource` | **IS** | `upwind_aws_ebs_volume` |
| `upwind_resource` | **IS** | `upwind_aws_rds_instance` |
| `upwind_resource` | **IS** | `upwind_aws_rds_cluster` |
| `upwind_resource` | **IS** | `upwind_aws_dynamodb_table` |
| `upwind_resource` | **IS** | `upwind_aws_iam_user` |
| `upwind_resource` | **IS** | `upwind_aws_iam_role` |
| `upwind_resource` | **IS** | `upwind_aws_iam_policy` |
| `upwind_resource` | **IS** | `upwind_aws_iam_group` |
| `upwind_resource` | **IS** | `upwind_aws_ecs_cluster` |
| `upwind_resource` | **IS** | `upwind_ecs_service` |
| `upwind_resource` | **IS** | `upwind_ecs_task` |
| `upwind_resource` | **IS** | `upwind_eks_cluster` |
| `upwind_resource` | **IS** | `upwind_azure_vm` |
| `upwind_resource` | **IS** | `upwind_azure_function` |
| `upwind_resource` | **IS** | `upwind_azure_vmss` |
| `upwind_resource` | **IS** | `upwind_aks_cluster` |
| `upwind_resource` | **IS** | `upwind_gcp_instance` |
| `upwind_resource` | **IS** | `upwind_gcp_instance_group` |
| `upwind_resource` | **IS** | `upwind_gcp_cloud_run_container` |
| `upwind_resource` | **IS** | `upwind_gcp_cloud_run_function` |
| `upwind_resource` | **IS** | `upwind_gcp_cloud_run_job` |
| `upwind_resource` | **IS** | `upwind_gke_cluster` |
| `upwind_resource` | **IS** | `upwind_cluster` |
| `upwind_resource` | **IS** | `upwind_k8s_node` |
| `upwind_resource` | **IS** | `upwind_k8s_deployment` |
| `upwind_resource` | **IS** | `upwind_k8s_statefulset` |
| `upwind_resource` | **IS** | `upwind_k8s_daemonset` |
| `upwind_resource` | **IS** | `upwind_k8s_replicaset` |
| `upwind_resource` | **IS** | `upwind_k8s_cronjob` |
| `upwind_resource` | **IS** | `upwind_k8s_pod` |
| `upwind_resource` | **IS** | `upwind_host` |
| `upwind_resource` | **IS** | `upwind_byoc_host` |
| `upwind_resource` | **IS** | `upwind_container` |
| `upwind_service` | **HAS** | `upwind_cloud_account` |
| `upwind_threat_policy` | **IDENTIFIED** | `upwind_threat_detection` |
| `upwind_vulnerability` | **EXPLOITS** | `upwind_resource` |
| `upwind_vulnerability` | **EXPLOITS** | `upwind_image` |
| `upwind_vulnerability` | **EXPLOITS** | `upwind_package` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `upwind_aws_instance` | **IS** | `aws_instance` | FORWARD |
| `upwind_aws_lambda` | **IS** | `aws_lambda_function` | FORWARD |
| `upwind_azure_vm` | **IS** | `azure_vm` | FORWARD |
| `upwind_gcp_instance` | **IS** | `google_compute_instance` | FORWARD |

### Upwind Account

`upwind_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `organizationId` | `string` |  |  |

---

### Upwind Api Endpoint

`upwind_api_endpoint` inherits from [ApplicationEndpoint](/data-model/schemas/ApplicationEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authenticationState` | `string` |  |  |
| `domains` | `array` of `string`s |  |  |
| `firstSeenOn` | `number` |  |  |
| `internetExposed` | `boolean` |  |  |
| `lastSeenOn` | `number` |  |  |
| `method` | `string` |  |  |
| `resourceId` | `string` |  |  |
| `statusCodes` | `array` of `string`s |  |  |
| `uri` | `string` |  |  |

---

### Upwind Cloud Account

`upwind_cloud_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| `provider` | `string` |  |  |

---

### Upwind Configuration Finding

`upwind_configuration_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `checkId` | `string` |  |  |
| `checkRemediation` | `string` |  |  |
| `checkTitle` | `string` |  |  |
| `firstSeenOn` | `number` |  |  |
| `frameworkId` | `string` |  |  |
| `frameworkTitle` | `string` |  |  |
| `lastSeenOn` | `number` |  |  |
| `resourceId` | `string` |  |  |
| `resourceName` | `string` |  |  |
| `resourceType` | `string` |  |  |
| `title` | `string` |  |  |

---

### Upwind Configuration Framework

`upwind_configuration_framework` inherits from [Framework](/data-model/schemas/Framework.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cloudProvider` | `string` |  |  |
| `frameworkStatus` | `string` |  |  |
| `revision` | `string` |  |  |
| `title` | `string` |  |  |
| `version` | `string` |  |  |

---

### Upwind Configuration Rule

`upwind_configuration_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdOn` | `number` |  |  |
| `findingsCount` | `integer` |  |  |
| `framework` | `string` |  |  |
| `updatedOn` | `number` |  |  |

---

### Upwind Image

`upwind_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `digest` | `string` |  |  |
| `osName` | `string` |  |  |
| `osVersion` | `string` |  |  |
| `tag` | `string` |  |  |
| `uri` | `string` |  |  |

---

### Upwind Inventory Asset

`upwind_inventory_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetCategory` | `string` |  |  |
| `assetSubCategory` | `string` |  |  |
| `cloudAccountId` | `string` |  |  |
| `cloudAccountName` | `string` |  |  |
| `cloudProvider` | `string` |  |  |
| `cloudResourceId` | `string` |  |  |
| `clusterId` | `string` |  |  |
| `clusterName` | `string` |  |  |
| `criticalDetectionsCount` | `integer` |  |  |
| `criticalVulnCount` | `integer` |  |  |
| `criticalVulnerabilitiesCount` | `integer` |  |  |
| `externalId` | `string` |  |  |
| `hasActiveInternetEgress` | `boolean` |  |  |
| `hasActiveInternetIngress` | `boolean` |  |  |
| `highDetectionsCount` | `integer` |  |  |
| `highVulnCount` | `integer` |  |  |
| `highVulnerabilitiesCount` | `integer` |  |  |
| `lowVulnCount` | `integer` |  |  |
| `mediumVulnCount` | `integer` |  |  |
| `namespace` | `string` |  |  |
| `region` | `string` |  |  |
| `resourceLabel` | `string` |  |  |
| `resourceType` | `string` |  |  |
| `status` | `string` |  |  |
| `totalVulnCount` | `integer` |  |  |

---

### Upwind Package

`upwind_package` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cloudAccountId` | `string` |  |  |
| `cloudProvider` | `string` |  |  |
| `criticalVulnCount` | `integer` |  |  |
| `framework` | `string` |  |  |
| `highVulnCount` | `integer` |  |  |
| `inUse` | `boolean` |  |  |
| `licenses` | `array` of `string`s |  |  |
| `lowVulnCount` | `integer` |  |  |
| `mediumVulnCount` | `integer` |  |  |
| `packageManager` | `string` |  |  |
| `packageType` | `string` |  |  |
| `totalVulnCount` | `integer` |  |  |
| `version` | `string` |  |  |

---

### Upwind Resource

`upwind_resource` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cloudAccountId` | `string` |  |  |
| `cloudAccountName` | `string` |  |  |
| `cloudProvider` | `string` |  |  |
| `clusterId` | `string` |  |  |
| `clusterName` | `string` |  |  |
| `externalId` | `string` |  |  |
| `internetExposed` | `boolean` |  |  |
| `namespace` | `string` |  |  |
| `region` | `string` |  |  |
| `resourceType` | `string` |  |  |

---

### Upwind Service

`upwind_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` of `string`s |  |  |
| 

`function` \*

 | `array` of `string`s |  |  |

---

### Upwind Threat Detection

`upwind_threat_detection` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `firstSeenOn` | `number` |  |  |
| `lastSeenOn` | `number` |  |  |
| `mitreTacticId` | `string` |  |  |
| `mitreTacticName` | `string` |  |  |
| `mitreTechniqueId` | `string` |  |  |
| `mitreTechniqueName` | `string` |  |  |
| `occurrenceCount` | `integer` |  |  |
| `resourceId` | `string` |  |  |
| `resourceName` | `string` |  |  |
| `resourceType` | `string` |  |  |
| `threatCategory` | `string` |  |  |

---

### Upwind Threat Policy

`upwind_threat_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `enabled` | `boolean` |  |  |
| `managedBy` | `string` |  |  |
| `openIssues` | `integer` |  |  |
| `policyCategory` | `string` |  |  |
| `scope` | `string` |  |  |
| `severity` | `string` |  |  |

---

### Upwind Vulnerability

`upwind_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cvssScore` | `number` |  |  |
| `cvssV2Score` | `string` |  |  |
| `cvssV2Severity` | `string` |  |  |
| `cvssV4Score` | `string` |  |  |
| `cvssV4Severity` | `string` |  |  |
| `epssScore` | `string` |  |  |
| `epssSeverity` | `string` |  |  |
| `exploitable` | `boolean` |  |  |
| `firstSeenOn` | `number` |  |  |
| `fixedInVersion` | `string` |  |  |
| `imageDigest` | `string` |  |  |
| `imageName` | `string` |  |  |
| `lastScanOn` | `number` |  |  |
| `packageName` | `string` |  |  |
| `packageType` | `string` |  |  |
| `packageVersion` | `string` |  |  |
| `resourceId` | `string` |  |  |
| `resourceName` | `string` |  |  |
| `resourceType` | `string` |  |  |
| `source` | `string` |  |  |

---

## Release Notes

-   **2026-01-22** — New Upwind integration: ingests cloud resources (AWS, Azure, and GCP), vulnerabilities, configuration findings, configuration frameworks, and API endpoints with cross-cloud relationship mapping.

---

Source: /integrations/directory/veracode

# Veracode

Visualize Veracode application scan results and findings, map findings to a code repo or project, and monitor changes and CWEs through queries and alerts.

## Installation

This integration requires a configured API ID and Secret Key from Veracode. This can be acquired

> **INFO**
> 
> Depending on your Veracode account configuration, you may need to create an API Service account to generate your credentials. See [Veracode's documentation](https://docs.veracode.com/r/t_create_api_creds) for more information.

### Configuration in JupiterOne

To install the Veracode integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Veracode. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Veracode account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Veracode **API ID** and **Secret Key**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `veracode_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Assessment | `veracode_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Finding | `veracode_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Project | `veracode_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `veracode_account` | **HAS** | `veracode_project` |
| `veracode_assessment` | **IDENTIFIED** | `veracode_finding` |
| `veracode_project` | **HAS** | `veracode_assessment` |
| `veracode_project` | **HAS** | `veracode_finding` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `veracode_finding` | **EXPLOITS** | `cwe` | FORWARD |

---

Source: /integrations/directory/vmware-cloud-director

# VMware Cloud Director

Visualize VMware Cloud Director organizations, VDCs, VDC groups, edge gateways, networks, firewall rules, virtual machines, users, and roles, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> The integration authenticates against the VMware Cloud Director CloudAPI as a **tenant-scoped** user. System (provider/sysadmin) login is not currently supported, so the configured user only sees the organization it logs in to.

### Configuration in VMware Cloud Director

You will need a VMware Cloud Director user with read access to the resources you want to ingest (organizations, users, roles, VDCs, VDC groups, edge gateways, networks, firewall rules, and virtual machines).

Collect the following information for use when configuring the integration in JupiterOne:

-   The **API host** of your VMware Cloud Director instance, e.g. `vcd.example.com`.
-   The **username** of the tenant user the integration will sign in as. The value must not contain `@` or `:` characters — VMware Cloud Director uses both as delimiters in the basic-auth credential it accepts at `POST /cloudapi/1.0.0/sessions`.
-   The **password** for that user.
-   The **organization name** the user belongs to. As with the username, the value must not contain `@` or `:` characters.

The integration uses these credentials to obtain a bearer JWT from `POST /cloudapi/1.0.0/sessions` (returned via the `X-VMWARE-VCLOUD-ACCESS-TOKEN` response header) and re-mints the token automatically on `401` responses, so long collection runs survive the token's lifetime.

### Configuration in JupiterOne

To install the VMware Cloud Director integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select VMware Cloud Director. Click **New Instance** to begin configuring your integration.

Creating a VMware Cloud Director instance requires the following:

-   The **Account Name** used to identify the VMware Cloud Director account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **API Host**, **Username**, **Password**, and **Organization Name** collected in the previous section.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `vmware_cloud_director_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| EdgeGateway | `vmware_cloud_director_edge_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| FirewallRule | `vmware_cloud_director_firewall_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Network | `vmware_cloud_director_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Organization | `vmware_cloud_director_org` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Role | `vmware_cloud_director_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Service | `vmware_cloud_director_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `vmware_cloud_director_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vdc | `vmware_cloud_director_vdc` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| VdcGroup | `vmware_cloud_director_vdc_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| VirtualMachine | `vmware_cloud_director_virtual_machine` | [Workload](https://docs.jupiterone.io/data-model/schemas/Workload) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `vmware_cloud_director_account` | **HAS** | `vmware_cloud_director_service` |
| `vmware_cloud_director_account` | **HAS** | `vmware_cloud_director_org` |
| `vmware_cloud_director_account` | **HAS** | `vmware_cloud_director_role` |
| `vmware_cloud_director_edge_gateway` | **CONNECTS** | `vmware_cloud_director_network` |
| `vmware_cloud_director_edge_gateway` | **HAS** | `vmware_cloud_director_firewall_rule` |
| `vmware_cloud_director_org` | **HAS** | `vmware_cloud_director_user` |
| `vmware_cloud_director_org` | **HAS** | `vmware_cloud_director_vdc` |
| `vmware_cloud_director_org` | **HAS** | `vmware_cloud_director_vdc_group` |
| `vmware_cloud_director_user` | **ASSIGNED** | `vmware_cloud_director_role` |
| `vmware_cloud_director_vdc` | **HAS** | `vmware_cloud_director_edge_gateway` |
| `vmware_cloud_director_vdc` | **CONTAINS** | `vmware_cloud_director_network` |
| `vmware_cloud_director_vdc` | **CONTAINS** | `vmware_cloud_director_virtual_machine` |
| `vmware_cloud_director_vdc_group` | **CONTAINS** | `vmware_cloud_director_vdc` |
| `vmware_cloud_director_vdc_group` | **HAS** | `vmware_cloud_director_edge_gateway` |

### Vmware Cloud Director Account

`vmware_cloud_director_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`apiHost` \*

 | `string` | The hostname of the VMware Cloud Director API endpoint. |  |

---

### Vmware Cloud Director Edge Gateway

`vmware_cloud_director_edge_gateway` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`backingId` \*

 | `string` **|** `null` | The identifier of the underlying NSX backing object for the gateway. |  |
| 

`deploymentMode` \*

 | `string` **|** `null` | The deployment topology of the edge gateway (e.g. STANDARD, ACTIVE\_STANDBY). |  |
| 

`gatewayType` \*

 | `string` **|** `null` | The backing gateway type reported by VCD (e.g. NSXT\_BACKED, NSXV\_BACKED). |  |
| 

`isDistributedRoutingEnabled` \*

 | `boolean` **|** `null` | Whether distributed routing is enabled on the edge gateway. |  |
| 

`isUniversalVdcGroupEdge` \*

 | `boolean` **|** `null` | Whether the edge gateway belongs to a universal VDC group. |  |
| 

`orgVdcNetworkCount` \*

 | `number` **|** `null` | The number of org VDC networks attached to the edge gateway. |  |

---

### Vmware Cloud Director Firewall Rule

`vmware_cloud_director_firewall_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `string` **|** `null` | The action taken when the rule matches (ALLOW, DROP, REJECT). Sourced from `actionValue` with a fallback to the deprecated `action` field on older VCD versions. |  |
| 

`direction` \*

 | `string` **|** `null` | The traffic direction the rule applies to (IN, OUT, IN\_OUT). |  |
| 

`ipProtocol` \*

 | `string` **|** `null` | The IP protocol family the rule applies to (IPV4, IPV6, IPV4\_IPV6). |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` | Whether matches against the rule are logged. |  |
| 

`ruleCategory` \*

 | `string` | Whether the rule is system-managed, a tenant default, or user-defined (SYSTEM, DEFAULT, USER). |  |

---

### Vmware Cloud Director Network

`vmware_cloud_director_network` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`connectionType` \*

 | `string` **|** `null` | How the network connects to its upstream router (INTERNAL, DISTRIBUTED, NON\_DISTRIBUTED). |  |
| 

`dnsServer1` \*

 | `string` **|** `null` | The primary DNS server distributed to clients on the network. |  |
| 

`dnsServer2` \*

 | `string` **|** `null` | The secondary DNS server distributed to clients on the network. |  |
| 

`gateway` \*

 | `string` **|** `null` | The IP address of the primary subnet gateway. |  |
| 

`isRouteAdvertised` \*

 | `boolean` **|** `null` | Whether routes for the network are advertised to upstream gateways. |  |
| 

`isShared` \*

 | `boolean` **|** `null` | Whether the network is shared with other VDCs. |  |
| 

`networkType` \*

 | `string` **|** `null` | The type of org VDC network (NAT\_ROUTED, ISOLATED, DIRECT, CROSS\_VDC, OPAQUE). |  |
| 

`prefixLength` \*

 | `number` **|** `null` | The CIDR prefix length of the primary subnet. |  |
| 

`totalIpCount` \*

 | `number` **|** `null` | The total number of IP addresses available in the network. |  |
| 

`usedIpCount` \*

 | `number` **|** `null` | The number of IP addresses currently allocated from the network. |  |

---

### Vmware Cloud Director Org

`vmware_cloud_director_org` inherits from [Organization](/data-model/schemas/Organization.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`catalogCount` \*

 | `number` **|** `null` | The number of catalogs in the organization. |  |
| 

`isManageOrgsAllowed` \*

 | `boolean` **|** `null` | Whether this organization can manage other organizations. |  |
| 

`isPublishAllowed` \*

 | `boolean` **|** `null` | Whether this organization can publish catalogs. |  |
| 

`orgVdcCount` \*

 | `number` **|** `null` | The number of VDCs that belong to the organization. |  |
| 

`runningVMCount` \*

 | `number` **|** `null` | The number of currently running VMs in the organization. |  |
| 

`userCount` \*

 | `number` **|** `null` | The number of users in the organization. |  |
| 

`vappCount` \*

 | `number` **|** `null` | The number of vApps in the organization. |  |

---

### Vmware Cloud Director Role

`vmware_cloud_director_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`bundleKey` \*

 | `string` **|** `null` | The localization bundle key used by the VCD UI to display the role name. |  |

---

### Vmware Cloud Director Service

`vmware_cloud_director_service` inherits from [Service](/data-model/schemas/Service.md)

---

### Vmware Cloud Director User

`vmware_cloud_director_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`deployedVmQuota` \*

 | `number` **|** `null` | The maximum number of VMs the user is allowed to keep deployed concurrently. |  |
| 

`isGroupRole` \*

 | `boolean` **|** `null` | Whether the user inherits its role assignments from a group rather than directly. |  |
| 

`isLocked` \*

 | `boolean` **|** `null` | Whether the user account is locked out, typically after failed sign-in attempts. |  |
| 

`isStranded` \*

 | `boolean` **|** `null` | Whether the user is in a stranded state (no longer linked to its identity provider). |  |
| 

`providerType` \*

 | `string` **|** `null` | The identity provider type for the user (e.g. INTEGRATED, SAML, LDAP). |  |
| 

`storedVmQuota` \*

 | `number` **|** `null` | The maximum number of VMs the user is allowed to keep stored. |  |

---

### Vmware Cloud Director Vdc

`vmware_cloud_director_vdc` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`allocationType` \*

 | `string` **|** `null` | The allocation model for the VDC (AllocationVApp, AllocationPool, ReservationPool, Flex). |  |
| 

`isNetworkingTenancyEnabled` \*

 | `boolean` **|** `null` | Whether NSX-T multi-tenant networking is enabled for the VDC. |  |

---

### Vmware Cloud Director Vdc Group

`vmware_cloud_director_vdc_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`groupType` \*

 | `string` **|** `null` | The scope of the VDC group (LOCAL or UNIVERSAL). |  |
| 

`isDfwEnabled` \*

 | `boolean` **|** `null` | Whether the NSX-T Distributed Firewall is enabled on the group. |  |
| 

`isUniversalNetworkingEnabled` \*

 | `boolean` **|** `null` | Whether universal (cross-site) networking is enabled on the group. |  |
| 

`networkProviderType` \*

 | `string` **|** `null` | The network provider type backing the group (NSX\_T, NSXV). |  |
| 

`participatingVdcCount` \*

 | `number` **|** `null` | The number of organization VDCs that participate in the group. |  |

---

### Vmware Cloud Director Virtual Machine

`vmware_cloud_director_virtual_machine` inherits from [Workload](/data-model/schemas/Workload.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`moref` \*

 | `string` **|** `null` | The vCenter managed object reference (moref) for the underlying VM. |  |

---

## Release Notes

-   **2026-05-07** — Added initial VMware Cloud Director integration, ingesting organizations, roles, users, vApps, virtual machines, and networks.

---

Source: /integrations/directory/vsphere

# vSphere

Visualize vSphere data and monitor changes through queries and alerts.

## Installation

This integration supports VMware vSphere versions 6.5–8.0. Some data types are only available on newer versions:

-   **VM Guest Identity**: vSphere 6.7.0 and newer
-   **Namespace ingestion**: vSphere 7.0.0 and newer
-   **Distributed Switch ingestion**: vSphere 7.0.0 and newer

### Prerequisites

1.  Access to a VMware vCenter instance with a service account that has the **Read-Only** role assigned at the root of the vCenter inventory (propagated to all children). The integration reads all inventory data using this account.
    
2.  Your vCenter credentials:
    
    -   The vCenter domain (hostname), for example `vcenter.sddc-X-YY-ZZ-F.vmwarevmc.com`
    -   The service account login and password

### Configuration in JupiterOne

To install the VMware vSphere integration in JupiterOne, navigate to **Integrations**, select **VMware vSphere**, and click **New Instance**.

Creating an instance requires the following:

-   **Account Name** — a display name for this vSphere account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
-   **Description** — optional label for this integration instance.
-   **Polling Interval** — how often JupiterOne collects data from vSphere. Set to `DISABLED` to run manually.
-   **vSphere Domain** — the hostname of your vCenter server (for example, `vcenter.sddc-X-YY-ZZ-F.vmwarevmc.com` for a VMware Cloud-hosted vCenter).
-   **vCenter Login** — the login or email address of the service account.
-   **vCenter Password** — the password for the service account.

Click **Create** once all required values are provided.

### Optional configuration

| Field | Description | Default |
| --- | --- | --- |
| **Uses NSX** | When enabled, the integration queries distributed switch compatibility using VMware NSX (NSXT\_CONTAINER\_PLUGIN) as the network provider instead of standard vSphere networking. Enable this if your environment uses VMware NSX for Kubernetes workload networking. | Disabled |
| **Disable TLS Verification** | When enabled, TLS certificate verification is skipped for connections to the vCenter host. Use this only for vCenter hosts that cannot present a valid certificate (for example, those using self-signed certificates). | Disabled |

> **CAUTION**
> 
> Disabling TLS verification reduces transport security. Use a valid TLS certificate on your vCenter host whenever possible.

### Next steps

Once configured, the integration will run on the polling interval you selected and populate vSphere inventory data in JupiterOne. See the [Instance management guide](/integrations/instance-management.md) to learn how to edit or disable an integration instance.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `vsphere_client` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Cluster | `vsphere_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Data Center | `vsphere_data_center` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Datastore | `vsphere_datastore` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Distributed Switch | `vsphere_distributed_switch` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Host | `vsphere_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Namespace | `vsphere_namespace` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Network | `vsphere_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Virtual Machine | `vsphere_vm` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `vsphere_client` | **MANAGES** | `vsphere_data_center` |
| `vsphere_cluster` | **USES** | `vsphere_distributed_switch` |
| `vsphere_vm` | **USES** | `vsphere_network` |

## Release Notes

-   **2026-07-17** — vSphere virtual machines are now classified as hosts and participate in unified device correlation, using hostname, IP addresses, MAC addresses, and BIOS UUID for matching.

---

Source: /integrations/directory/watchtowr

# watchTowr

The watchTowr integration adds visibility about continuous Automated Red Teaming and Attack Surface Management. This integration enables JupiterOne users to better manage assets, assess risks, and respond to incidents more effectively by leveraging watchTowr's findings.

## Installation

To use this integration, JupiterOne requires a watchTowr API Token. The process to obtain credentials is following:

1.  Login into watchTowr using your login credentials
2.  Click the 'Integrations' menu option
3.  Under 'Client API' section click on 'Client API'
4.  Click on 'Regenerate New API Token', you will see the generated token under 'API Authentication' section.

> **NOTE**
> 
> In the `API Whitelist Management` section, please turn off whitelisting or contact JupiterOne support to get our list of outbound IPs used for integrations.

### Configuration in JupiterOne

To install the watchTowr integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select watchTowr. Click **New Instance** to begin configuring your integration, providing the following:

-   **API Token**: unique identifier used to authenticate and control access to watchTowr API. You should be able to find it [here](https://jigsaw.core.watchtowr.com/integrations/api-settings). If you don't have one yet see above section to generate one.
    
-   **Account Name** used to identify the watchTowr account in JupiterOne.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Vulnerability Filters**: here you will be able to customize what severities you want to fetch when retrieving findings.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `watchtowr_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cloud Storage | `watchtowr_cloud_storage` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Container | `watchtowr_container` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| Domain | `watchtowr_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| Finding | `watchtowr_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| IP Address | `watchtowr_ip_address` | [IpAddress](https://docs.jupiterone.io/data-model/schemas/IpAddress) |
| Mobile Applications | `watchtowr_mobile_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Package Manager | `watchtowr_package_manager` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Saas Platform | `watchtowr_saas_platform` | [Vendor](https://docs.jupiterone.io/data-model/schemas/Vendor) |
| Service | `watchtowr_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Source code repositories | `watchtowr_source_code_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| Subdomain | `watchtowr_subdomain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `watchtowr_account` | **HAS** | `watchtowr_service` |
| `watchtowr_cloud_storage` | **HAS** | `watchtowr_finding` |
| `watchtowr_container` | **HAS** | `watchtowr_finding` |
| `watchtowr_domain` | **HAS** | `watchtowr_finding` |
| `watchtowr_ip_address` | **HAS** | `watchtowr_finding` |
| `watchtowr_mobile_application` | **HAS** | `watchtowr_finding` |
| `watchtowr_package_manager` | **HAS** | `watchtowr_finding` |
| `watchtowr_saas_platform` | **HAS** | `watchtowr_finding` |
| `watchtowr_service` | **IDENTIFIED** | `watchtowr_finding` |
| `watchtowr_service` | **SCANS** | `watchtowr_cloud_storage` |
| `watchtowr_service` | **SCANS** | `watchtowr_container` |
| `watchtowr_service` | **SCANS** | `watchtowr_source_code_repository` |
| `watchtowr_service` | **SCANS** | `watchtowr_mobile_application` |
| `watchtowr_service` | **SCANS** | `watchtowr_domain` |
| `watchtowr_service` | **SCANS** | `watchtowr_subdomain` |
| `watchtowr_service` | **SCANS** | `watchtowr_ip_address` |
| `watchtowr_service` | **SCANS** | `watchtowr_package_manager` |
| `watchtowr_service` | **SCANS** | `watchtowr_saas_platform` |
| `watchtowr_source_code_repository` | **HAS** | `watchtowr_finding` |
| `watchtowr_subdomain` | **HAS** | `watchtowr_finding` |

### Watchtowr Finding

`watchtowr_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`affectedType` \*

 | `string` **|** `null` |  |  |
| 

`cve` \*

 | `string` **|** `null` |  |  |
| 

`cvssMetrics` \*

 | `string` **|** `null` |  |  |
| 

`cvssScore` \*

 | `number` **|** `null` |  |  |
| 

`epssScore` \*

 | `number` **|** `null` |  |  |
| 

`evidence` \*

 | `string` **|** `null` |  |  |
| `recommendation` | `string` |  | **deprecated**: true |
| `recommendationAction` | `string` |  |  |
| 

`retestEvidence` \*

 | `string` **|** `null` |  |  |
| 

`tags` \*

 | `array` **|** `null` |  |  |

---

## Release Notes

-   **2025-10-27** — Added recommended action property to Watchtowr finding entities, standardizing remediation guidance to the shared ontology field.
-   **2025-06-05** — Promoted Watchtowr finding entities to carry both the Finding and Vulnerability entity classes, enabling vulnerability-based queries.

---

Source: /integrations/directory/wazuh

# Wazuh

Visualize Wazuh endpoint agents and devices, map Wazuh agents to devices and employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> Before configuring this integration in JupiterOne, you need to create API credentials in Wazuh:
> 
> **Required in Wazuh:**
> 
> -   Access to your Wazuh Manager API URL
> -   A dedicated service account username and password for API access
> -   The service account should have read-only permissions (not administrator credentials)
> 
> **Authentication:** This integration uses HTTP Basic authentication to obtain a JWT token from the Wazuh API, which is then used for subsequent API requests.
> 
> **Recommended Setup:**
> 
> 1.  Create a dedicated user in Wazuh (e.g., `jupiterone-readonly`)
> 2.  Assign read-only permissions to this user via **Security > Users > Create User** in the Wazuh Dashboard
> 3.  Do not use administrator credentials for the integration
> 
> **Manager URL Format:**
> 
> -   Self-hosted: `https://your-wazuh-server:55000`
> -   Wazuh Cloud: `https://${wazuhCloudEnvId}.cloud.wazuh.com/api/wazuh`

> **NOTE**
> 
> If you are using Wazuh Cloud, contact [JupiterOne Support](https://info.jupiterone.com/contact-us) to obtain a list of IPs for Wazuh to whitelist. After you get the IP list, contact Wazuh Support to make changes to your Wazuh Cloud account to expose the API.
> 
> After you have done this, the JupiterOne integration can connect to your Wazuh Cloud instance. Be sure to structure your **MANAGER\_URL** in the JupiterOne integration configuration to be in the following format: `https://${wauzhCloudEnvId}.cloud.wazuh.com/api/wazuh`

### Configuration in JupiterOne

To install the Wazuh integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Wazuh. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Wazuh account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Wazuh **Manager URL**, the **Username** to authenticate with the Manager URL, and the**Password** associated with the username.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `wazuh_manager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service), [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Agent | `wazuh_agent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `wazuh_manager` | **HAS** | `wazuh_agent` |

## Release Notes

-   **2019-03-05** — New Wazuh integration: ingests the Wazuh manager service and connected host agents, providing visibility into Wazuh-monitored endpoints and their connection status.

---

Source: /integrations/directory/whitehat

# WhiteHat

Visualize WhiteHat Security scans, vulnerabilities, and findings, map them to code repositories, projects, or applications, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> For this integration, you will need to create an API Token key within your Whitehat account. See [their documentation](https://apidocs.whitehatsec.com/whs/docs/authentication) for more information.

### Configuration in JupiterOne

To install the Whitehat integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Whitehat. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Whitehat account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Whitehat **API Key** generated for use with JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `whitehat_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Appliance | `whitehat_appliance` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Application and Mobile Application | `whitehat_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Assessment | `whitehat_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Asset | `whitehat_asset` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Codebase | `whitehat_codebase` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Component | `whitehat_component` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Endpoint | `web_app_endpoint` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| Finding | `whitehat_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Group | `whitehat_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Role | `whitehat_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Scan Type | `whitehat_scan` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Site | `web_app_domain` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| User | `whitehat_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `web_app_domain` | **HAS** | `whitehat_assessment` |
| `web_app_domain` | **HAS** | `whitehat_finding` |
| `web_app_domain` | **HAS** | `web_app_endpoint` |
| `whitehat_account` | **HAS** | `whitehat_user` |
| `whitehat_account` | **HAS** | `whitehat_asset` |
| `whitehat_account` | **HAS** | `whitehat_scan` |
| `whitehat_account` | **HAS** | `whitehat_group` |
| `whitehat_account` | **HAS** | `whitehat_appliance` |
| `whitehat_application` | **HAS** | `whitehat_assessment` |
| `whitehat_application` | **HAS** | `whitehat_codebase` |
| `whitehat_application` | **HAS** | `whitehat_finding` |
| `whitehat_application` | **HAS** | `whitehat_component` |
| `whitehat_assessment` | **IDENTIFIED** | `whitehat_finding` |
| `whitehat_asset` | **HAS** | `web_app_domain` |
| `whitehat_asset` | **HAS** | `whitehat_application` |
| `whitehat_group` | **HAS** | `whitehat_user` |
| `whitehat_scan` | **PERFORMED** | `whitehat_assessment` |
| `whitehat_user` | **ASSIGNED** | `whitehat_role` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `whitehat_component` | **HAS** | `cve` | FORWARD |
| `whitehat_finding` | **EXPLOITS** | `cwe` | FORWARD |

---

Source: /integrations/directory/whois

# Whois

Visualize Whois domains and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> This integration does not require any vendor setup or API credentials. It performs public WHOIS lookups for the domains you specify.
> 
> **Required Configuration:**
> 
> -   A comma-separated list of domain names to monitor (e.g., `google.com,facebook.com,notion.so`)
> 
> **How it Works:** The integration queries public WHOIS servers to retrieve domain registration information including registrar details, registration dates, and expiration dates.
> 
> **No Authentication Required:** WHOIS is a public protocol and does not require API keys or credentials to access domain registration information.

When configuring the Whois integration, the instance creation input for **Domains** expects a comma separated lists of domains.

For example:

```text
google.com,facebook.com,notion.so
```

### Configuration in JupiterOne

To install the Whois integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Whois. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Whois account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Domains** as a comma-separated list that JupiterOne will look up.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Domain | `internet_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |

---

Source: /integrations/directory/wiz

# Wiz

Visualize Wiz Vulnerability Findings and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need the following parameters:
> 
> -   Active service account
>     
>     -   A Wiz service account serves as a machine-to-machine interface to authenticate with the Wiz API. Permissions must be explicitly assigned to a service account by a Wiz user, typically requiring a user with elevated privileges such as a Global Admin. See [their documentation](https://docs.wiz.io/wiz-docs/docs/service-accounts-settings#add-a-service-account) for more information.
>     -   Required API scopes:
>         -   `read:users`
>         -   `read:projects`
>         -   `read:resources`
>         -   `read:host_configuration`
>         -   `read:cloud_configuration`
>         -   `read:reports`
>         -   `create:reports`
>         -   `read:vulnerabilities`
> -   **OAuth Client ID** and **OAuth Client Secret** obtained from the service account
>     
> -   **Access Token API URL** — Example: `https://auth.app.wiz.io/oauth/token`
>     
> -   **GraphQL API URL** — Example: `https://api.<TENANT_DATA_CENTER>.<ENVIRONMENT>/graphql`
>     
>     -   `<TENANT_DATA_CENTER>` is your Wiz regional data center (e.g., `us1`, `us2`, `eu1`, or `eu2`)
>     -   `<ENVIRONMENT>` is one of `app.wiz.io`, `app.wiz.us`, or `gov.wiz.io`

To install the Wiz integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Wiz. Click **New Instance** to begin configuring your integration.

Creating a Wiz instance requires the following:

-   The **Account Name** used to identify the Wiz account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Wiz **Access Token API URL**.
    
-   Your Wiz **GraphQL API URL**.
    
-   Your Wiz **OAuth Client ID** and **OAuth Client Secret**.
    

Click **Create** once all values are provided to finalize the integration.

## Data Volume Configuration

These optional settings control how much data is ingested on each run. Narrowing severity and status filters reduces ingestion volume and run time.

### Ingestion Windows

Each finding type has an independent ingestion window. Only findings updated (or first seen, if **Filter by First Seen** is enabled) within the selected number of days are ingested.

| Field | Description | Default |
| --- | --- | --- |
| **Ingestion Window (days)** — VM Host Vulnerabilities | How many days back to ingest VM host vulnerability findings. | 90 |
| **Ingestion Window (days)** — Host Configuration Findings | How many days back to ingest host configuration findings. | 90 |
| **Ingestion Window (days)** — Bucket Vulnerabilities | How many days back to ingest bucket vulnerability findings. | 90 |
| **Ingestion Window (days)** — Container Vulnerabilities | How many days back to ingest container vulnerability findings. | 90 |
| **Ingestion Window (days)** — Container Image Vulnerabilities | How many days back to ingest container image vulnerability findings. | 90 |
| **Ingestion Window (days)** — Serverless Vulnerabilities | How many days back to ingest serverless vulnerability findings. | 90 |
| **Ingestion Window (days)** — VM Image Vulnerabilities | How many days back to ingest VM image vulnerability findings. | 90 |

Available options for all ingestion window fields: **90**, **180**, **275**, **365** (days).

### Data Filtering Options

#### VM Host Vulnerability Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Severity** | Vendor severity levels to include. | Critical | Critical, High, Medium, Low, None |
| **Status** | Status values to include. | Open, Resolved | Open, Resolved, Rejected |

#### Host Configuration Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Severity** | Severity levels to include. | Critical | Critical, High, Medium, Low, Informational |
| **Status** | Status values to include. | Open | Open, Resolved, Rejected |

#### Bucket Vulnerability Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Severity** | Vendor severity levels to include. | Critical, High | Critical, High, Medium, Low, None |
| **Status** | Status values to include. | Open, Resolved | Open, Resolved, Rejected |

#### Container Vulnerability Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Severity** | Vendor severity levels to include. | Critical, High | Critical, High, Medium, Low, None |
| **Status** | Status values to include. | Open, Resolved | Open, Resolved, Rejected |

#### Container Image Vulnerability Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Severity** | Vendor severity levels to include. | Critical, High | Critical, High, Medium, Low, None |
| **Status** | Status values to include. | Open, Resolved | Open, Resolved, Rejected |

#### Serverless Vulnerability Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Severity** | Vendor severity levels to include. | Critical, High | Critical, High, Medium, Low, None |
| **Status** | Status values to include. | Open, Resolved | Open, Resolved, Rejected |

#### VM Image Vulnerability Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Severity** | Vendor severity levels to include. | Critical, High | Critical, High, Medium, Low, None |
| **Status** | Status values to include. | Open, Resolved | Open, Resolved, Rejected |

#### Cloud Configuration Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Severity** | Severity levels to include. | Critical, High | Critical, High, Medium, Low, None |
| **Status** | Status values to include. | Open | Open, Resolved, Rejected |
| **Result** | Result values to include. | Fail | Fail, Pass, Error, Not Assessed |

### Advanced Configuration

| Field | Description | Default |
| --- | --- | --- |
| **Filter by First Seen** | When enabled, the ingestion window date filter uses the finding's First Seen date instead of Updated At. Applies to all vulnerability types. | Disabled |
| **Use Severity instead of Vendor Severity** | When enabled, filters vulnerability findings by Severity instead of Vendor Severity. Applies to all vulnerability types. | Disabled |
| **Ingest findings of missing and deleted assets** | When enabled, vulnerability findings are retained even when their source asset was not ingested (for example, when the asset belongs to a Wiz project not configured for ingestion, or was deleted). A minimal host record is reconstructed from the finding so the finding is not dropped. Recently-deleted assets still within Wiz's retention window are also ingested with their deleted status. | Disabled |
| **Project IDs to ingest** | An optional list of Wiz project IDs to ingest. When set, only assets and findings belonging to these projects are collected. Provide IDs separated by commas. | All projects |
| **Map assets to ServiceNow CMDB** | When enabled, mapped relationships are emitted from Wiz assets (hosts, containers, serverless functions) to ServiceNow CMDB records, matched by the asset's app ID tag and subscription external ID. Enable only for tenants whose Wiz app ID tag holds a ServiceNow `sys_id`. | Disabled |
| **App ID tag key** | The asset tag key whose value is the ServiceNow application/service `sys_id`. Case-sensitive — must match the tag key exactly as it appears in Wiz. Used only when **Map assets to ServiceNow CMDB** is enabled. | `appid` |
| **Support group tag key** | Asset tag key whose value identifies the responsible support group or team. When set, the tag value is promoted onto the `supportGroup` property of Wiz asset entities so it is queryable without knowing the raw tag key. Case-sensitive. | Not set |
| **Support owner tag key** | Asset tag key whose value is the operational or support owner (typically an email address). Promoted onto the `supportOwner` property of Wiz asset entities. Case-sensitive. | Not set |
| **Business owner tag key** | Asset tag key whose value is the business owner (typically an email address). Promoted onto the `businessOwner` property of Wiz asset entities. Case-sensitive. | Not set |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (8)

-   `create:reports`
-   `read:cloud_configuration`
-   `read:host_configuration`
-   `read:projects`
-   `read:reports`
-   `read:resources`
-   `read:users`
-   `read:vulnerabilities`

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (15)

| Step | OAuth Scopes |
| --- | --- |
| Fetch AI Resources | `read:resources` |
| Fetch Bucket Vulnerability Findings | `read:reports`, `create:reports`, `read:vulnerabilities` |
| Fetch Buckets | `read:resources` |
| Fetch Cloud Configuration Findings | `read:cloud_configuration` |
| Fetch Container Image Vulnerability Findings | `read:reports`, `create:reports`, `read:vulnerabilities` |
| Fetch Container Images | `read:resources` |
| Fetch Container Vulnerability Findings | `read:reports`, `create:reports`, `read:vulnerabilities` |
| Fetch Containers | `read:resources` |
| Fetch Host Configuration Findings | `read:host_configuration` |
| Fetch Hosts | `read:resources` |
| Fetch Serverless Functions | `read:resources` |
| Fetch Serverless Vulnerability Findings | `read:reports`, `create:reports`, `read:vulnerabilities` |
| Fetch VM Image Vulnerability Findings | `read:reports`, `create:reports`, `read:vulnerabilities` |
| Fetch VM Images | `read:resources` |
| Fetch Vulnerability Findings | `read:reports`, `create:reports`, `read:vulnerabilities` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `wiz_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AI Resource | `wiz_ai_resource` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Bucket | `wiz_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Cloud Configuration Finding | `wiz_cloud_configuration_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Container | `wiz_container` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| Container Image | `wiz_container_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Host | `wiz_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Host Configuration Finding | `wiz_host_configuration_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Project | `wiz_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Serverless Function | `wiz_serverless_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| User | `wiz_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| VM Image | `wiz_vm_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Vulnerability Finding | `wiz_vulnerability_finding` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `wiz_account` | **MANAGES** | `wiz_project` |
| `wiz_account` | **MANAGES** | `wiz_user` |
| `wiz_host` | **HAS** | `wiz_vulnerability_finding` |
| `wiz_host_configuration_finding` | **EXPLOITS** | `wiz_host` |
| `wiz_project` | **HAS** | `wiz_host` |
| `wiz_project` | **HAS** | `wiz_cloud_configuration_finding` |
| `wiz_project` | **HAS** | `wiz_bucket` |
| `wiz_project` | **HAS** | `wiz_container` |
| `wiz_project` | **HAS** | `wiz_container_image` |
| `wiz_project` | **HAS** | `wiz_serverless_function` |
| `wiz_project` | **HAS** | `wiz_vm_image` |
| `wiz_project` | **HAS** | `wiz_ai_resource` |
| `wiz_vulnerability_finding` | **EXPLOITS** | `wiz_bucket` |
| `wiz_vulnerability_finding` | **EXPLOITS** | `wiz_container` |
| `wiz_vulnerability_finding` | **EXPLOITS** | `wiz_container_image` |
| `wiz_vulnerability_finding` | **EXPLOITS** | `wiz_serverless_function` |
| `wiz_vulnerability_finding` | **EXPLOITS** | `wiz_vm_image` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `wiz_container` | **CONNECTS** | `service_now_cmdb_object` | FORWARD |
| `wiz_host` | **CONNECTS** | `service_now_cmdb_object` | FORWARD |
| `wiz_serverless_function` | **CONNECTS** | `service_now_cmdb_object` | FORWARD |

### Wiz Account

`wiz_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Wiz Ai Resource

`wiz_ai_resource` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`aiCategory` \*

 | `string` **|** `null` | Coarse category derived from the Wiz `type` enum — `agent` for `AI_AGENT`, `mcp_server` for `MCP_SERVER`. `null` if Wiz returns an unrecognised AI type. |  |
| 

`aiDetectionMethod` \*

 | `string` **|** `null` | How this identity was detected as AI. Always `cloud_inventory` for Wiz-ingested entities — Wiz discovers these via cloud provider / SaaS APIs. |  |
| 

`aiPlatformName` \*

 | `string` **|** `null` | Human-readable AI platform / technology name. Sourced from Wiz `technology.name` (e.g. "Anthropic (claude.ai) Agent", "Salesforce Agentforce Employee Agent", "Microsoft Copilot Studio Agent"). |  |
| 

`cloudAccountExternalId` \*

 | `string` **|** `null` | Provider-side identifier for the owning account / organisation (e.g. an AWS account id, an Anthropic organisation id). Sourced from Wiz `cloudAccount.externalId`. |  |
| 

`cloudAccountId` \*

 | `string` **|** `null` | Wiz internal id for the owning cloud account / organisation. Sourced from Wiz `cloudAccount.id`. |  |
| 

`cloudAccountName` \*

 | `string` **|** `null` | Human-readable name of the owning cloud account / organisation. Sourced from Wiz `cloudAccount.name`. |  |
| 

`cloudPlatform` \*

 | `string` **|** `null` | Cloud platform the AI identity lives on (e.g. `Anthropic`, `Salesforce`, `MicrosoftPowerPlatform`, `AWS`, `GCP`, `Azure`). Sourced from Wiz `cloudPlatform`. |  |
| 

`externalId` \*

 | `string` **|** `null` | Wiz-side external identifier. For SaaS-style agents this typically encodes the upstream provider + organisation + agent IDs (e.g. `anthropic##agent##claude_proj_…`). |  |
| 

`firstSeenOn` \*

 | `number` **|** `null` | Epoch ms when Wiz first observed the identity. Parsed from Wiz `firstSeen`. |  |
| 

`hasAccessToSensitiveData` \*

 | `boolean` **|** `null` | Whether Wiz flagged this identity as having access to sensitive data. Sourced from Wiz `hasAccessToSensitiveData`. |  |
| 

`hasAdminPrivileges` \*

 | `boolean` **|** `null` | Whether Wiz flagged this identity as holding admin-tier privileges. Sourced from Wiz `hasAdminPrivileges`. |  |
| 

`hasHighPrivileges` \*

 | `boolean` **|** `null` | Whether Wiz flagged this identity as holding high-tier privileges. Sourced from Wiz `hasHighPrivileges`. |  |
| 

`hasSensitiveData` \*

 | `boolean` **|** `null` | Whether Wiz flagged this identity as touching sensitive data. Sourced from Wiz `hasSensitiveData`. |  |
| 

`isAccessibleFromInternet` \*

 | `boolean` **|** `null` | Whether Wiz flagged this identity as reachable from the internet (not necessarily wide open). Sourced from Wiz `isAccessibleFromInternet`. |  |
| 

`isOpenToAllInternet` \*

 | `boolean` **|** `null` | Whether Wiz flagged this identity as openly reachable from the public internet. Sourced from Wiz `isOpenToAllInternet`. |  |
| 

`lastSeenOn` \*

 | `number` **|** `null` | Epoch ms when Wiz last observed the identity. Parsed from Wiz `lastSeen`. |  |
| 

`providerUniqueId` \*

 | `string` **|** `null` | Provider-side unique identifier for the resource. May be null when Wiz lacks one (some SaaS-style agents). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the identity is hosted in, when applicable. Sourced from Wiz `region`. |  |
| 

`wizNativeType` \*

 | `string` **|** `null` | Provider-native sub-type per Wiz (e.g. `anthropic#agent`, `agentforce#employeeagent`, `Microsoft/CopilotStudio.Agent`, `hostedAiAgent`). Sourced from Wiz `nativeType`. |  |
| 

`wizTechnologyId` \*

 | `string` **|** `null` | Wiz-internal technology catalog id (`technology.id`) — stable identifier for the upstream technology behind this agent / server. |  |
| 

`wizType` \*

 | `string` **|** `null` | Verbatim Wiz `type` value (e.g. `AI_AGENT`, `MCP_SERVER`). Kept untransformed so a J1QL consumer can filter on Wiz’s native discriminator without re-deriving from `aiCategory`. |  |

---

### Wiz Bucket

`wiz_bucket` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cloudPlatform` | `string` |  |  |
| `cloudProviderId` | `string` |  |  |
| `cloudProviderUrl` | `string` |  |  |
| `isDeleted` | `boolean` | Whether the asset was deleted from the cloud provider. Set to true when ingested via the deleted-asset pass (ingestDeletedAssets config option). |  |
| 
`lastSeenOn` \*

 | `number` **|** `null` |  |  |
| `providerUniqueId` | `string` |  |  |
| `subscriptionExternalId` | `string` |  |  |
| `subscriptionId` | `string` |  |  |

---

### Wiz Cloud Configuration Finding

`wiz_cloud_configuration_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`analyzedOn` \*

 | `null` **|** `number` |  |  |
| 

`evidenceCloudConfigurationLink` \*

 | `null` **|** `string` |  |  |
| 

`evidenceConfigurationPath` \*

 | `null` **|** `string` |  |  |
| 

`evidenceCurrentValue` \*

 | `null` **|** `string` |  |  |
| 

`evidenceExpectedValue` \*

 | `null` **|** `string` |  |  |
| 

`firstSeenOn` \*

 | `null` **|** `number` |  |  |
| 

`isDeleted` \*

 | `null` **|** `boolean` |  |  |
| 

`resolutionReason` \*

 | `null` **|** `string` |  |  |
| 

`resourceCloudPlatform` \*

 | `null` **|** `string` |  |  |
| 

`resourceHasAccessToSensitiveData` \*

 | `null` **|** `boolean` |  |  |
| 

`resourceHasAdminPrivileges` \*

 | `null` **|** `boolean` |  |  |
| 

`resourceHasHighPrivileges` \*

 | `null` **|** `boolean` |  |  |
| 

`resourceHasSensitiveData` \*

 | `null` **|** `boolean` |  |  |
| 

`resourceId` \*

 | `null` **|** `string` |  |  |
| 

`resourceIsAccessibleFromInternet` \*

 | `null` **|** `boolean` |  |  |
| 

`resourceIsAccessibleFromOtherSubscriptions` \*

 | `null` **|** `boolean` |  |  |
| 

`resourceIsAccessibleFromVPN` \*

 | `null` **|** `boolean` |  |  |
| 

`resourceIsOpenToAllInternet` \*

 | `null` **|** `boolean` |  |  |
| 

`resourceName` \*

 | `null` **|** `string` |  |  |
| 

`resourceNativeType` \*

 | `null` **|** `string` |  |  |
| 

`resourceProviderId` \*

 | `null` **|** `string` |  |  |
| 

`resourceRegion` \*

 | `null` **|** `string` |  |  |
| 

`resourceStatus` \*

 | `null` **|** `string` |  |  |
| 

`resourceType` \*

 | `null` **|** `string` |  |  |
| 

`result` \*

 | `null` **|** `string` |  |  |
| 

`ruleDescription` \*

 | `null` **|** `string` |  |  |
| 

`ruleHasAutoRemediation` \*

 | `null` **|** `boolean` |  |  |
| 

`ruleId` \*

 | `null` **|** `string` |  |  |
| 

`ruleIsBuiltin` \*

 | `null` **|** `boolean` |  |  |
| 

`ruleIsEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`ruleName` \*

 | `null` **|** `string` |  |  |
| 

`ruleRemediationInstructions` \*

 | `null` **|** `string` |  |  |
| 

`ruleRisks` \*

 | `null` **|** `array` |  |  |
| 

`ruleServiceType` \*

 | `null` **|** `string` |  |  |
| 

`ruleSeverity` \*

 | `null` **|** `string` |  |  |
| 

`ruleShortId` \*

 | `null` **|** `string` |  |  |
| 

`ruleTargetNativeTypes` \*

 | `null` **|** `array` |  |  |
| 

`securitySubCategoryIds` \*

 | `null` **|** `array` |  |  |
| 

`securitySubCategoryNames` \*

 | `null` **|** `array` |  |  |
| 

`source` \*

 | `null` **|** `string` |  |  |
| 

`statusChangedOn` \*

 | `null` **|** `number` |  |  |
| 

`subscriptionCloudProvider` \*

 | `null` **|** `string` |  |  |
| 

`subscriptionExternalId` \*

 | `null` **|** `string` |  |  |
| 

`subscriptionId` \*

 | `null` **|** `string` |  |  |
| 

`subscriptionName` \*

 | `null` **|** `string` |  |  |
| 

`targetExternalId` \*

 | `null` **|** `string` |  |  |
| 

`targetObjectProviderUniqueId` \*

 | `null` **|** `string` |  |  |

---

### Wiz Container

`wiz_container` inherits from [Container](/data-model/schemas/Container.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `businessOwner` | `string` | Business owner of the asset (typically an email), promoted from the asset tag named by the businessOwnerTagKey config option. |  |
| `cloudPlatform` | `string` |  |  |
| `cloudProviderId` | `string` |  |  |
| `cloudProviderUrl` | `string` |  |  |
| `isDeleted` | `boolean` | Whether the asset was deleted from the cloud provider. Set to true when ingested via the deleted-asset pass (ingestDeletedAssets config option). |  |
| 
`lastSeenOn` \*

 | `number` **|** `null` |  |  |
| `providerUniqueId` | `string` |  |  |
| `subscriptionExternalId` | `string` |  |  |
| `subscriptionId` | `string` |  |  |
| `supportGroup` | `string` | Support group / team responsible for the asset, promoted from the asset tag named by the supportGroupTagKey config option. |  |
| `supportOwner` | `string` | Operational / support owner of the asset (typically an email), promoted from the asset tag named by the supportOwnerTagKey config option. |  |

---

### Wiz Container Image

`wiz_container_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cloudPlatform` | `string` |  |  |
| `cloudProviderId` | `string` |  |  |
| `cloudProviderUrl` | `string` |  |  |
| `isDeleted` | `boolean` | Whether the asset was deleted from the cloud provider. Set to true when ingested via the deleted-asset pass (ingestDeletedAssets config option). |  |
| 
`lastSeenOn` \*

 | `number` **|** `null` |  |  |
| `providerUniqueId` | `string` |  |  |
| `subscriptionExternalId` | `string` |  |  |
| `subscriptionId` | `string` |  |  |

---

### Wiz Host

`wiz_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `businessOwner` | `string` | Business owner of the asset (typically an email), promoted from the asset tag named by the businessOwnerTagKey config option. |  |
| `cloudPlatform` | `string` |  |  |
| `cloudProviderId` | `string` |  |  |
| `cloudProviderUrl` | `string` |  |  |
| `isDeleted` | `boolean` | Whether the asset was deleted from the cloud provider. Set to true when ingested via the deleted-asset pass (ingestDeletedAssets config option). |  |
| `isSynthesizedFromFinding` | `boolean` | True when this host was reconstructed from a vulnerability finding row (ingestDeletedAssets) because its asset was not ingested by the hosts step - e.g. it lives in an un-ingested Wiz project or was deleted. Such hosts are sparse carriers, not full host records. |  |
| `osKernel` | `string` |  |  |
| `providerUniqueId` | `string` |  |  |
| `subscriptionExternalId` | `string` |  |  |
| `subscriptionId` | `string` |  |  |
| `supportGroup` | `string` | Support group / team responsible for the asset, promoted from the asset tag named by the supportGroupTagKey config option. |  |
| `supportOwner` | `string` | Operational / support owner of the asset (typically an email), promoted from the asset tag named by the supportOwnerTagKey config option. |  |

---

### Wiz Host Configuration Finding

`wiz_host_configuration_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`analyzedOn` \*

 | `null` **|** `number` |  |  |
| 

`assessmentError` \*

 | `null` **|** `string` |  |  |
| 

`assessmentErrorMessage` \*

 | `null` **|** `string` |  |  |
| 

`detectedBy` \*

 | `null` **|** `array` |  |  |
| 

`firstSeenOn` \*

 | `null` **|** `number` |  |  |
| 

`hasGraphObject` \*

 | `null` **|** `boolean` |  |  |
| 

`matcherResultDynamicScanner` \*

 | `null` **|** `string` |  |  |
| 

`matcherResultWorkloadScanner` \*

 | `null` **|** `string` |  |  |
| 

`nucleiDescription` \*

 | `null` **|** `string` |  |  |
| 

`ovalDescription` \*

 | `null` **|** `string` |  |  |
| 

`resolutionReason` \*

 | `null` **|** `string` |  |  |
| 

`resourceCloudPlatform` \*

 | `null` **|** `string` |  |  |
| 

`resourceName` \*

 | `null` **|** `string` |  |  |
| 

`resourceNativeType` \*

 | `null` **|** `string` |  |  |
| 

`resourceProviderUniqueId` \*

 | `null` **|** `string` |  |  |
| 

`resourceRegion` \*

 | `null` **|** `string` |  |  |
| 

`resourceStatus` \*

 | `null` **|** `string` |  |  |
| 

`resourceType` \*

 | `null` **|** `string` |  |  |
| 

`result` \*

 | `null` **|** `string` |  |  |
| 

`ruleDescription` \*

 | `null` **|** `string` |  |  |
| 

`ruleExcludedTechnologies` \*

 | `null` **|** `array` |  |  |
| 

`ruleExternalId` \*

 | `null` **|** `string` |  |  |
| 

`ruleIsBuiltin` \*

 | `null` **|** `boolean` |  |  |
| 

`ruleIsEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`ruleIsMissingPrerequisite` \*

 | `null` **|** `boolean` |  |  |
| 

`ruleName` \*

 | `null` **|** `string` |  |  |
| 

`ruleRemediationInstructions` \*

 | `null` **|** `string` |  |  |
| 

`ruleShortName` \*

 | `null` **|** `string` |  |  |
| 

`ruleTargetOperatingSystems` \*

 | `null` **|** `array` |  |  |
| 

`ruleTargetPlatforms` \*

 | `null` **|** `array` |  |  |
| 

`ruleTargetTechnologies` \*

 | `null` **|** `array` |  |  |
| 

`securityFrameworkSubCategoryIds` \*

 | `null` **|** `array` |  |  |
| 

`securityRisks` \*

 | `null` **|** `array` |  |  |
| 

`securityThreats` \*

 | `null` **|** `array` |  |  |
| 

`targetObjectCloudPlatform` \*

 | `null` **|** `string` |  |  |
| 

`targetObjectName` \*

 | `null` **|** `string` |  |  |
| 

`targetObjectNativeType` \*

 | `null` **|** `string` |  |  |
| 

`targetObjectProviderUniqueId` \*

 | `null` **|** `string` |  |  |
| 

`targetObjectRegion` \*

 | `null` **|** `string` |  |  |
| 

`targetObjectStatus` \*

 | `null` **|** `string` |  |  |
| 

`updatedOn` \*

 | `null` **|** `number` |  |  |

---

### Wiz Project

`wiz_project` inherits from [Project](/data-model/schemas/Project.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`archived` \*

 | `boolean` |  |  |
| `businessUnit` | `string` |  |  |
| 

`isFolder` \*

 | `boolean` |  |  |
| 

`slug` \*

 | `string` |  |  |

---

### Wiz Serverless Function

`wiz_serverless_function` inherits from [Function](/data-model/schemas/Function.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `businessOwner` | `string` | Business owner of the asset (typically an email), promoted from the asset tag named by the businessOwnerTagKey config option. |  |
| `cloudPlatform` | `string` |  |  |
| `cloudProviderId` | `string` |  |  |
| `cloudProviderUrl` | `string` |  |  |
| `isDeleted` | `boolean` | Whether the asset was deleted from the cloud provider. Set to true when ingested via the deleted-asset pass (ingestDeletedAssets config option). |  |
| 
`lastSeenOn` \*

 | `number` **|** `null` |  |  |
| `providerUniqueId` | `string` |  |  |
| `subscriptionExternalId` | `string` |  |  |
| `subscriptionId` | `string` |  |  |
| `supportGroup` | `string` | Support group / team responsible for the asset, promoted from the asset tag named by the supportGroupTagKey config option. |  |
| `supportOwner` | `string` | Operational / support owner of the asset (typically an email), promoted from the asset tag named by the supportOwnerTagKey config option. |  |

---

### Wiz User

`wiz_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`authenticationSource` \*

 | `string` |  | **Any of**:

-   `LEGACY`

-   `MODERN`

 |
| 

`isSuspended` \*

 | `boolean` |  |  |
| `lastLoginOn` | `number` |  |  |

---

### Wiz Vm Image

`wiz_vm_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cloudPlatform` | `string` |  |  |
| `cloudProviderId` | `string` |  |  |
| `cloudProviderUrl` | `string` |  |  |
| `isDeleted` | `boolean` | Whether the asset was deleted from the cloud provider. Set to true when ingested via the deleted-asset pass (ingestDeletedAssets config option). |  |
| 
`lastSeenOn` \*

 | `number` **|** `null` |  |  |
| `providerUniqueId` | `string` |  |  |
| `subscriptionExternalId` | `string` |  |  |
| `subscriptionId` | `string` |  |  |

---

### Wiz Vulnerability Finding

`wiz_vulnerability_finding` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetHasWideInternetExposure` \*

 | `boolean` **|** `null` | Whether the underlying asset has wide internet exposure per Wiz's network analysis. Source: Wiz optional custom column `Asset has wide internet exposure`. |  |
| `assetType` | `string` |  |  |
| 

`cnaScore` \*

 | `number` **|** `null` | CNA-assigned CVSS score. Source: Wiz optional custom column `CNAScore`. |  |
| 

`cveDescription` \*

 | `string` **|** `null` | CVE description. Source: Wiz column `CVEDescription`. |  |
| 

`cvssSeverity` \*

 | `string` **|** `null` | CVSS severity. Source: Wiz column `CVSSSeverity`. |  |
| 

`detailedName` \*

 | `string` **|** `null` |  |  |
| 

`detectionMethod` \*

 | `string` **|** `null` |  |  |
| `firstDetectedOn` | `number` |  |  |
| 

`fixedVersion` \*

 | `string` **|** `null` |  |  |
| 

`hasCisaKevExploit` \*

 | `boolean` **|** `null` | Whether the vulnerability appears in CISA KEV. Source: Wiz column `HasCisaKevExploit`. |  |
| 

`hasExploit` \*

 | `boolean` **|** `null` | Whether a public exploit exists. Source: Wiz column `HasExploit`. |  |
| 

`impactScore` \*

 | `number` **|** `null` | CVSS impact subscore. Source: Wiz column `ImpactScore`. |  |
| `lastDetectedOn` | `number` |  |  |
| 

`nvdSeverity` \*

 | `string` **|** `null` | NVD-assigned severity. Source: Wiz column `NvdSeverity`. |  |
| 

`remediation` \*

 | `string` **|** `null` |  |  |
| 

`remediationActions` \*

 | `string` **|** `null` |  |  |
| `resolvedOn` | `number` |  |  |
| 

`vendorSeverity` \*

 | `string` **|** `null` | Upstream vendor (CVE) severity. Source: Wiz column `VendorSeverity`. |  |
| 

`version` \*

 | `string` **|** `null` |  |  |
| 

`wizSeverity` \*

 | `string` **|** `null` | Wiz-calculated severity for the finding (distinct from upstream vendor severity). Source: Wiz column `Severity`. |  |

---

## Release Notes

-   **2026-07-13** — Wiz hosts, containers, and serverless resources can now be linked to their corresponding ServiceNow CMDB records via mapped relationships.
-   **2026-05-14** — Wiz vulnerability findings now include Wiz-calculated severity, NVD severity, CNA score, and internet exposure status.
-   **2026-04-30** — Added cloud configuration findings ingestion, linking findings to their associated Wiz projects.
-   **2026-03-31** — Added OS kernel version property to Wiz host entities.
-   **2026-03-05** — Added serverless function and VM image entities to Wiz ingestion, with vulnerability findings and project relationships for each asset type.
-   **2026-03-05** — Added Wiz bucket, container, and container image entities as new ingested types with asset relationships.
-   **2026-01-23** — Improved rendering of Wiz vulnerability remediation steps and descriptions by converting markdown links to readable text.
-   **2025-12-02** — Added creation and last-updated timestamps to Wiz vulnerability findings.
-   **2025-10-23** — Normalized severity values on Wiz vulnerability findings to lowercase for consistent querying.
-   **2025-09-12** — Added project ID filter configuration option to limit Wiz vulnerability finding ingestion to specific projects.

---

Source: /integrations/directory/workday

# Workday 2.0

Visualize Workday workers and accounts, map employees to their organizational data, and monitor changes through queries and alerts.

## Installation

To use this integration, you must have a Workday tenant and an **Integration System User (ISU)** account with the appropriate security group permissions. The integration authenticates via **OAuth 2.0**: you register a Workday API Client backed by the ISU and provide JupiterOne with the client ID, client secret, and a refresh token.

> **NOTE**
> 
> All tasks below require a Workday administrator. If you do not have administrator access, ask your Workday admin to complete the provider-side steps for you.

### Configuration in Workday

#### Step 1 — Create an Integration System User (ISU)

1.  In Workday, use the search bar to find and open the **Create Integration System User** task.
2.  Enter a descriptive **Username** (for example, `ISU_JupiterOne`) and a secure **Password**.
3.  Leave **Session Timeout Minutes** at `0` — this prevents the session from expiring during API calls.
4.  Click **OK** to create the account.

To prevent the ISU password from expiring and disrupting the integration:

5.  Search for and open the **Maintain Password Rules** task.
6.  Add the ISU account to the **System Users exempt from password expiration** list.

#### Step 2 — Create an Integration System Security Group (ISSG)

1.  Search for and open the **Create Security Group** task.
2.  Set **Type of Tenanted Security Group** to **Integration System Security Group (Unconstrained)**.
3.  Enter a descriptive **Name** (for example, `ISSG_JupiterOne`).
4.  Click **OK**.
5.  On the next screen, add the ISU created in Step 1 as a member of the group.

#### Step 3 — Grant Domain Security Policies

1.  Search for and open the **Maintain Permissions for Security Group** task.
    
2.  Select the ISSG created in Step 2.
    
3.  Under **Domain Security Policy Permissions**, grant **GET** access to the following domains:
    
    | Domain Security Policy | Purpose |
    | --- | --- |
    | Worker Data: Workers | Fetch active worker records |
    | Worker Data: Active and Terminated Workers | Required if ingesting terminated workers |
    | Worker Data: Current Staffing Information | Employment status and job assignments |
    
4.  Click **OK** to save.
    

#### Step 4 — Activate Security Policy Changes

1.  Search for and open the **Activate Pending Security Policy Changes** task.
2.  Enter a comment describing the change (for example, `Create ISU and ISSG for JupiterOne integration`).
3.  Check the **Confirm** checkbox and click **OK**. The domain policy changes take effect immediately.

#### Step 5 — Register an API Client for OAuth 2.0

The Workday REST API requires OAuth 2.0, so register an API Client backed by the ISU:

1.  Search for and open the **Register API Client for Integrations** task.
2.  Enter a **Client Name** (for example, `JupiterOne`).
3.  Enable **Non-Expiring Refresh Tokens**.
4.  Set the **Scope (Functional Areas)** to include the areas that cover worker and person data (for example, **Staffing** and **Contact Information**). The access token inherits the ISU's permissions, so the scope must allow reading workers, legal names, and work emails.
5.  Click **OK**. Workday displays the **Client ID** and **Client Secret** — copy both now, as the secret is shown only once.

#### Step 6 — Generate a Refresh Token

1.  Search for and open the **View API Clients** task, then select the API Client created in Step 5.
2.  From the related actions menu, select **Manage Refresh Token for Integration**.
3.  Select the ISU created in Step 1, generate a new refresh token, and copy it.

#### Finding Your Tenant URL

The Workday REST API base URL follows this pattern:

```text
https://<workday-host>/ccx/api/<tenant-name>
```

To locate your host and tenant name:

1.  Log in to Workday as an administrator.
2.  Search for and open the **Tenant Setup** task.
3.  Navigate to the **Implementation** tab.
4.  Your **Workday Host** (for example, `wd2-impl-services1.workday.com`) and **Tenant Name** are displayed on this page.

**Example:** `https://wd2-impl-services1.workday.com/ccx/api/acme_corp`

### Configuration in JupiterOne

To install the Workday integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Workday**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Workday account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Workday **Tenant URL** — the REST API base URL constructed in the previous section (for example, `https://wd2-impl-services1.workday.com/ccx/api/acme_corp`).
    
-   The **Client ID**, **Client Secret**, and **Refresh Token** from the API Client you registered in Steps 5–6.
    
-   **Include Terminated Workers** _(optional)_ — when enabled, the integration also ingests workers whose employment has ended. Requires the **Worker Data: Active and Terminated Workers** domain security policy to be granted.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `workday_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Worker | `workday_worker` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `workday_account` | **HAS** | `workday_worker` |

### Workday Account

`workday_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`tenant` \*

 | `string` | Workday tenant name parsed from the tenant URL |  |
| 

`tenantUrl` \*

 | `string` | Workday tenant base URL |  |

---

### Workday Worker

`workday_worker` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`employeeType` \*

 | `string` **|** `null` | Worker type descriptor (Employee or Contingent Worker) |  |
| 

`hiredOn` \*

 | `number` **|** `null` | Timestamp (ms) of the most recent hire date |  |
| 

`jobTitle` \*

 | `string` **|** `null` | Business title from primary job position |  |
| 

`location` \*

 | `string` **|** `null` | Primary work location name |  |
| 

`supervisoryOrganizationId` \*

 | `string` **|** `null` | ID of the primary supervisory organization |  |
| 

`supervisoryOrganizationName` \*

 | `string` **|** `null` | Name of the primary supervisory organization |  |

---

---

Source: /integrations/directory/workwize

# Workwize

Visualize Workwize assets and employees, map assets to device owners, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to [generate an API Token in Workwize](https://docs.goworkwize.com/) before initiating the integration in JupiterOne. Once the API Token has been retrieved, proceed to JupiterOne to continue.

### Configuration in Workwize

1.  Log in to your Workwize account.
2.  Navigate to **Settings > API**.
3.  Click **Generate API Token** or **Create New Token**.
4.  Copy and securely save the generated API Token for use in JupiterOne.

> **INFO**
> 
> API tokens should be treated securely and not shared. Ensure the user generating the token has sufficient permissions to access asset and employee data.

### Configuration in JupiterOne

To complete the Workwize integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Workwize. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Workwize account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The Workwize **API Token** generated for use with JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Asset | `workwize_asset` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Employee | `workwize_employee` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Organization | `workwize_organization` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `workwize_employee` | **OWNS** | `workwize_asset` |
| `workwize_organization` | **HAS** | `workwize_employee` |

### Workwize Asset

`workwize_asset` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` |  |  |
| 

`condition` \*

 | `string` |  |  |
| 

`invoiceCurrency` \*

 | `string` **|** `null` |  |  |
| 

`invoicePrice` \*

 | `number` **|** `null` |  |  |
| 

`warehouseStatus` \*

 | `string` |  |  |

---

### Workwize Employee

`workwize_employee` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`departmentId` \*

 | `number` **|** `null` |  |  |
| 

`departmentName` \*

 | `string` **|** `null` |  |  |
| 

`foreignId` \*

 | `string` **|** `null` |  |  |
| 

`isDeactivated` \*

 | `boolean` |  |  |
| 

`jobTitle` \*

 | `string` **|** `null` |  |  |
| 

`registrationStatus` \*

 | `string` |  |  |
| 

`team` \*

 | `string` |  |  |
| 

`userId` \*

 | `number` |  |  |

---

### Workwize Organization

`workwize_organization` inherits from [Account](/data-model/schemas/Account.md)

---

---

Source: /integrations/directory/wpengine

# WP Engine

Visualize WordPress accounts, domains, installs, sites, and users, map WordPress users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to acquire API Credentials from WP Engine. This can be done by accessing your [WP Engine profile page under **API Access**](https://my.wpengine.com/api_access).

> **INFO**
> 
> If you have not already done so, you may need to enable Account API Access within Wordpress to generate your API credentials. See [their documentation](https://wpengine.com/support/enabling-wp-engine-api/) for more information.

### Configuration in JupiterOne

To install the WP Engine integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select WP Engine. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the WP Engine account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your WP Engine **API Credentials**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `wp_engine_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Domain | `wp_engine_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| Install | `wp_engine_install` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Site | `wp_engine_site` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| User | `wp_engine_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `wp_engine_account` | **HAS** | `wp_engine_site` |
| `wp_engine_account` | **HAS** | `wp_engine_install` |
| `wp_engine_install` | **HAS** | `wp_engine_domain` |
| `wp_engine_site` | **HAS** | `wp_engine_install` |
| `wp_engine_user` | **MANAGES** | `wp_engine_account` |

---

Source: /integrations/directory/xmcyber

# XM Cyber

Visualize XM Cyber entities within JupiterOne to proactively identify vulnerabilities and assess your security posture.

## Installation

To install this integration, you will need to configure settings both within \[integration name\] and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your \[integration name\]'s account.

### Configuration on XM Cyber

-   Request an API Key with permissions to fetch entities `GET https://cyberrange.clients.xmcyber.com/api/systemReport/entities`

### Finalize in JupiterOne

To install the XM Cyber integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select XM Cyber. Click **New Instance** to begin configuring the integration.

Creating an integration instance requires the following:

-   The **Account Name** used to identify the XM Cyber account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Enter the XM Cyber API key generated for use by JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `xmcyber_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Entity | `xmcyber_entity` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `xmcyber_account` | **HAS** | `xmcyber_entity` |

---

Source: /integrations/directory/zendesk

# Zendesk

Visualize Zendesk accounts, groups, organizations, tickets, and users, and monitor changes through queries and alerts.

## Installation

JupiterOne's Zendesk integration requires an OAuth App to be created within your Zendesk and authenticating JupiterOne with Zendesk after you have created the OAuth application.

Though it is not required, a Zendesk Pro account provides more data resources to JupiterOne than a regular Zendesk account.

### Configuration in Zendesk

You will need to create the OAuth application to successfully integrate Zendesk with JupiterOne:

1.  Create an OAuth app in Zendesk by going to your Zendesk Admin Center and navigating to **Apps and integrations > APIs > Zendesk APIs**.
    -   This can be accessed here: `https://{your-zendesk-subdomain}.zendesk.com/admin/apps-integrations/apis/apis/oauth_clients.`) though, be sure to input your Zendesk subdomain.
2.  Click on the **Add OAuth Client** button.
3.  Provide information for the OAuth app, and enter '[http://localhost:5000/redirect](http://localhost:5000/redirect)' as the redirect URL for OAuth.

> **INFO**
> 
> See [Zendesk's documentation](https://support.zendesk.com/hc/en-us/articles/4408845965210-Using-OAuth-authentication-with-your-application) for additional assistance configuring an Oauth application.

### Configuration in JupiterOne

To install the Addigy integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Addigy. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Addigy account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Zendesk **Subdomain**
    
    -   e.g.,`https://{this-is-your-zendesk-subdomain}.zendesk.com`

Click **Create** once all values are provided. You will be redirected to authenticate JupiterOne with Zendesk via OAuth flow. Once you complete the authentication process, your integration will be ready for use.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `zendesk_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Group | `zendesk_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Organization | `zendesk_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Ticket | `zendesk_ticket` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| User | `zendesk_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `zendesk_account` | **HAS** | `zendesk_organization` |
| `zendesk_group` | **HAS** | `zendesk_user` |
| `zendesk_group` | **HAS** | `zendesk_ticket` |
| `zendesk_organization` | **HAS** | `zendesk_group` |
| `zendesk_user` | **OPENED** | `zendesk_ticket` |
| `zendesk_user` | **ASSIGNED** | `zendesk_ticket` |

### Zendesk User

`zendesk_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `chatOnly` | `boolean` |  |  |
| `createdAt` | `string` |  |  |
| `defaultGroupId` | `integer` |  |  |
| `ianaTimeZone` | `string` |  |  |
| `locale` | `string` |  |  |
| `localeId` | `integer` |  |  |
| `moderator` | `boolean` |  |  |
| `organizationId` | `integer` |  |  |
| `phone` | `string` |  |  |
| `photoUrl` | `string` |  |  |
| `restrictedAgent` | `boolean` |  |  |
| `role` | `string` |  |  |
| `shared` | `boolean` |  |  |
| `suspended` | `boolean` |  |  |
| `timeZone` | `string` |  |  |
| `updatedAt` | `string` |  |  |
| `url` | `string` |  |  |
| `verified` | `boolean` |  |  |

---

---

Source: /integrations/directory/zentral

# Zentral

Visualize Zentral managed devices, users, device apps, profiles, and certificates, and monitor changes through queries and alerts.

## Installation

JupiterOne requires a Zentral API token and the base URL of your Zentral instance. The service account that owns the token must be granted the `Inventory::Action::"viewMachineSnapshot"` PBAC action, which authorizes the full-inventory export used to collect all device, user, profile, certificate, and application data.

### Configuration in Zentral

#### Create a role

1.  Log in to your Zentral console.
2.  Go to **Platform settings** > **Roles**.
3.  Click **Add role**, enter a name such as `JupiterOne Inventory Reader`, and save.
4.  Note the numeric **ID** displayed in the role list or URL — you will need it when writing the policy.

#### Create a Cedar policy

1.  In **Platform settings**, go to **Policies**.
    
2.  Click **Add policy**, give it a descriptive name, and enable the **Active** toggle.
    
3.  Enter the following Cedar source, replacing `<role-pk>` with the numeric ID from the previous step:
    
    ```text
    permit (
      principal in Role::"<role-pk>",
      action in [Inventory::Action::"viewMachineSnapshot"],
      resource
    );
    ```
    
4.  Save the policy.
    

#### Create a service account and generate a token

1.  Go to **Platform settings** > **Service accounts**.
2.  Click **Add service account**, enter a name such as `jupiterone`, and assign it the **JupiterOne Inventory Reader** role.
3.  Save the service account, then open its detail page and click **Add token**.
4.  Copy the generated API token and store it securely — you will not be able to retrieve it again.
5.  Copy your Zentral **base URL** (the root URL of your instance, for example `https://example.zentral.com`).

### Configuration in JupiterOne

To install the Zentral integration in JupiterOne, navigate to the **Integrations** tab, select **Zentral**, and click **New Instance**.

Creating an instance requires the following:

-   **Account Name** — A label to identify this account in JupiterOne. Ingested entities store this value in `tag.AccountName`.
    
-   **Description** — Optional. Helps distinguish multiple integration instances.
    
-   **Polling Interval** — How often JupiterOne collects data from Zentral. Set to `DISABLED` to run manually.
    
-   **Base URL** — The root URL of your Zentral instance, for example `https://example.zentral.com`.
    
-   **API Token** — The API token generated in the steps above.
    

Click **Create** to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (1)

-   `Inventory::Action::"viewMachineSnapshot"`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (2)

-   `GET {baseUrl}/api/task_result/{task_id}/`
-   `POST {baseUrl}/api/inventory/full_export/`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (2)

-   [https://docs.zentral.io/en/latest/apps/inventory/#apiinventoryfull\_export](https://docs.zentral.io/en/latest/apps/inventory/#apiinventoryfull_export)
-   [https://docs.zentral.io/en/latest/configuration/pbac/](https://docs.zentral.io/en/latest/configuration/pbac/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (1)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Build machine installed MacOS app relationship | `Inventory::Action::"viewMachineSnapshot"` | `POST {baseUrl}/api/inventory/full_export/` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Certificate | `zentral_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| Machine | `zentral_machine` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| MacOS App | `zentral_macos_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Principal User | `zentral_principal_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Profile | `zentral_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Zentral Cloud Account | `zentral_cloud_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `zentral_machine` | **INSTALLED** | `zentral_profile` |
| `zentral_machine` | **USES** | `zentral_certificate` |
| `zentral_machine` | **INSTALLED** | `zentral_macos_app` |
| `zentral_principal_user` | **OWNS** | `zentral_machine` |

### Zentral Certificate

`zentral_certificate` inherits from [Certificate](/data-model/schemas/Certificate.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `validOn` | `number` |  |  |

---

### Zentral Cloud Account

`zentral_cloud_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Zentral Machine

`zentral_machine` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cpuBrand` | `string` |  |  |
| `cpuLogicalCores` | `number` |  |  |
| `cpuPhysicalCores` | `number` |  |  |
| `cpuSubtype` | `string` |  |  |
| `cpuType` | `string` |  |  |
| `physicalMemory` | `string` |  |  |
| `physicalMemoryInBytes` | `number` |  |  |

---

### Zentral Macos App

`zentral_macos_app` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `bundleDisplayName` | `string` |  |  |
| 
`bundleId` \*

 | `string` |  |  |
| 

`bundleVersion` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Zentral Principal User

`zentral_principal_user` inherits from [User](/data-model/schemas/User.md)

---

### Zentral Profile

`zentral_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `hasRemovalPasscode` | `boolean` |  |  |
| 
`identifier` \*

 | `string` |  |  |
| `installedOn` | `number` |  |  |
| `isEncrypted` | `boolean` |  |  |
| 

`isVerified` \*

 | `boolean` |  |  |
| 

`removalDisallowed` \*

 | `boolean` |  |  |
| 

`uuid` \*

 | `string` |  |  |

---

## Release Notes

-   **2025-07-08** — Improved macOS application version accuracy in Zentral by using the full bundle version string when available.

---

Source: /integrations/directory/zoom

# Zoom

Visualize Zoom users, settings, roles, and groups, map them to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will first need to create an app within Zoom, and provide the API credentials associated with that app to JupiterOne.

### Configuration in Zoom

1.  In the Zoom App Marketplace, go to the Develop dropdown menu in the top-right corner and select [Build App](https://marketplace.zoom.us/develop/create).
2.  In the Choose Your App window, click **Create** under the Server-to-Server OAuth type. If you do not see this OAuth type, contact your Zoom administrator to be given permission for the Server-to-Server OAuth type.
3.  Enter an app name and app type to begin creation. Your app configuration page opens for the new app.
4.  Take note of your `Account ID`, `Client ID`, and `Client secret` for use later in JupiterOne.
5.  Enter the required information for the app credentials, information, feature, scopes sections and so on. Zoom prompts you if any required fields are omitted.
6.  In the **Scopes** section, add the following:

-   `group:read:admin`
    
-   `role:read:admin`
    
-   `user:read:admin`
    
-   `account:read:admin`
    
    > **NOTE**
    > 
    > If you cannot, or choose not to, provide all the listed scopes, the information will not be accessed by the JupiterOne integration.
    

7.  On the final screen, after you have provided all the required information, click`Activate your app` to complete the app creation.

After completing this configuration within Zoom, you are ready to go to JupiterOne to finalize the integration.

### Configuration in JupiterOne

To install the Zendesk integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Zoom. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Zoom account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The Zoom **Account ID**, **Client ID**, **Client Secret**, and desired **Scopes**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `zoom_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Group | `zoom_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Role | `zoom_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| User | `zoom_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `zoom_account` | **HAS** | `zoom_user` |
| `zoom_account` | **HAS** | `zoom_group` |
| `zoom_account` | **HAS** | `zoom_role` |
| `zoom_group` | **HAS** | `zoom_user` |
| `zoom_user` | **ASSIGNED** | `zoom_role` |

### Zoom User

`zoom_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `audioConferencingTollFreeAndFeeBasedTollCallAllowWebinarAttendeesDial` | `boolean` |  |  |
| `audioConferencingTollFreeAndFeeBasedTollCallEnable` | `boolean` |  |  |
| `createdAt` | `string` |  |  |
| `dept` | `string` |  |  |
| `emailNotificationAlternativeHostReminder` | `boolean` |  |  |
| `emailNotificationCancelMeetingReminder` | `boolean` |  |  |
| `emailNotificationCloudRecordingAvailableReminder` | `boolean` |  |  |
| `emailNotificationJbhReminder` | `boolean` |  |  |
| `emailNotificationScheduleForReminder` | `boolean` |  |  |
| `featureCnMeeting` | `boolean` |  |  |
| `featureConcurrentMeeting` | `string` |  |  |
| `featureInMeeting` | `boolean` |  |  |
| `featureLargeMeeting` | `boolean` |  |  |
| `featureLargeMeetingCapacity` | `integer` |  |  |
| `featureMeetingCapacity` | `integer` |  |  |
| `featureWebinar` | `boolean` |  |  |
| `featureWebinarCapacity` | `integer` |  |  |
| `featureZoomEvents` | `boolean` |  |  |
| `featureZoomEventsCapacity` | `integer` |  |  |
| `featureZoomPhone` | `boolean` |  |  |
| `groupIds` | `array` of `string`s |  |  |
| `hostKey` | `string` |  |  |
| `inMeetingAllowLiveStreaming` | `boolean` |  |  |
| `inMeetingAllowParticipantsChatWith` | `integer` |  |  |
| `inMeetingAllowParticipantsToRename` | `boolean` |  |  |
| `inMeetingAllowUsersSaveChats` | `integer` |  |  |
| `inMeetingAnnotation` | `boolean` |  |  |
| `inMeetingAttendeeOnHold` | `boolean` |  |  |
| `inMeetingAutoSavingChat` | `boolean` |  |  |
| `inMeetingBreakoutRoom` | `boolean` |  |  |
| `inMeetingBreakoutRoomSchedule` | `boolean` |  |  |
| `inMeetingChat` | `boolean` |  |  |
| `inMeetingClosedCaption` | `boolean` |  |  |
| `inMeetingCoHost` | `boolean` |  |  |
| `inMeetingCustomDataCenterRegions` | `boolean` |  |  |
| `inMeetingCustomLiveStreamingService` | `boolean` |  |  |
| `inMeetingCustomServiceInstructions` | `string` |  |  |
| `inMeetingDataCenterRegions` | `array` of `string`s |  |  |
| `inMeetingE2eEncryption` | `boolean` |  |  |
| `inMeetingEntryExitChime` | `string` |  |  |
| `inMeetingFarEndCameraControl` | `boolean` |  |  |
| `inMeetingFeedbacl` | `boolean` |  |  |
| `inMeetingFileTransfer` | `boolean` |  |  |
| `inMeetingGroupHd` | `boolean` |  |  |
| `inMeetingJoinFromDesktop` | `boolean` |  |  |
| `inMeetingJoinFromMobile` | `boolean` |  |  |
| `inMeetingLiveStreamingFacebook` | `boolean` |  |  |
| `inMeetingLiveStreamingYoutube` | `boolean` |  |  |
| `inMeetingMeetingReactions` | `boolean` |  |  |
| `inMeetingNonVerbalFeedback` | `boolean` |  |  |
| `inMeetingPolling` | `boolean` |  |  |
| `inMeetingPrivateChat` | `boolean` |  |  |
| `inMeetingRecordPlayVoice` | `boolean` |  |  |
| `inMeetingRemoteControl` | `boolean` |  |  |
| `inMeetingRemoteSupport` | `boolean` |  |  |
| `inMeetingRequestPermissionToUnmute` | `boolean` |  |  |
| `inMeetingRequestPermissionToUnmuteParticipants` | `boolean` |  |  |
| `inMeetingScreenSharing` | `boolean` |  |  |
| `inMeetingShareDualCamera` | `boolean` |  |  |
| `inMeetingShowAJoinFromYourBrowserLink` | `boolean` |  |  |
| `inMeetingShowMeetingControlToolbar` | `boolean` |  |  |
| `inMeetingVirtualBackground` | `boolean` |  |  |
| `inMeetingVirtualBackgroundSettingsAllowUploadCustom` | `boolean` |  |  |
| `inMeetingVirtualBackgroundSettingsAllowVideos` | `boolean` |  |  |
| `inMeetingVirtualBackgroundSettingsEnable` | `boolean` |  |  |
| `inMeetingWaitingRoom` | `boolean` |  |  |
| `inMeetingWebinarChatAllowAttendeesChatWith` | `integer` |  |  |
| `inMeetingWebinarChatAllowAutoSaveLocalChatFile` | `boolean` |  |  |
| `inMeetingWebinarChatAllowPanelistsChatWith` | `integer` |  |  |
| `inMeetingWebinarChatAllowPanelistsSendDirectMessage` | `boolean` |  |  |
| `inMeetingWebinarChatAllowUsersSaveChats` | `integer` |  |  |
| `inMeetingWebinarChatDefaultAttendeesChatWith` | `integer` |  |  |
| `inMeetingWebinarChatEnable` | `boolean` |  |  |
| `inMeetingWebinarLiveStreamingCustomServiceInstructions` | `string` |  |  |
| `inMeetingWebinarLiveStreamingEnable` | `boolean` |  |  |
| `inMeetingWebinarLiveStreamingLiveStreamingReminder` | `boolean` |  |  |
| `inMeetingWebinarLiveStreamingLiveStreamingService` | `array` of `string`s |  |  |
| `inMeetingWhoCanShareScreen` | `string` |  |  |
| `inMeetingWhoCanShareScreenWhenSomeoneIsSharing` | `string` |  |  |
| `inMeetingWorkplaceByFacebook` | `boolean` |  |  |
| `language` | `string` |  |  |
| `lastClientVersion` | `string` |  |  |
| `lastLoginTime` | `string` |  |  |
| `meetingAuthentication` | `boolean` |  |  |
| `meetingSecurityApprovedOrDeniedCountriesOrRegionsEnable` | `boolean` |  |  |
| `meetingSecurityAutoSecurity` | `boolean` |  |  |
| `meetingSecurityBlockUserDomain` | `boolean` |  |  |
| `meetingSecurityBlockUserDomainList` | `array` of `string`s |  |  |
| `meetingSecurityEmbedPasswordInJoinLink` | `boolean` |  |  |
| `meetingSecurityEncryptionType` | `string` |  |  |
| `meetingSecurityEndToEndEncryptedMeetings` | `boolean` |  |  |
| `meetingSecurityMeetingPassword` | `boolean` |  |  |
| `meetingSecurityMeetingPasswordRequirementConsecutiveCharactersLength` | `integer` |  |  |
| `meetingSecurityMeetingPasswordRequirementHaveLetter` | `boolean` |  |  |
| `meetingSecurityMeetingPasswordRequirementHaveNumber` | `boolean` |  |  |
| `meetingSecurityMeetingPasswordRequirementHaveSpecialCharacter` | `boolean` |  |  |
| `meetingSecurityMeetingPasswordRequirementHaveUpperAndLowerCharacters` | `boolean` |  |  |
| `meetingSecurityMeetingPasswordRequirementLength` | `integer` |  |  |
| `meetingSecurityMeetingPasswordRequirementOnlyAllowNumeric` | `boolean` |  |  |
| `meetingSecurityMeetingPasswordRequirementWeakEnhanceDetection` | `boolean` |  |  |
| `meetingSecurityPasswordForPmi` | `string` |  |  |
| `meetingSecurityPhonePassword` | `boolean` |  |  |
| `meetingSecurityPmiPassword` | `boolean` |  |  |
| `meetingSecurityRequirePasswordForScheduledMeeting` | `boolean` |  |  |
| `meetingSecurityRequirePasswordForScheduledWebinar` | `boolean` |  |  |
| `meetingSecurityWaitingRoom` | `boolean` |  |  |
| `meetingSecurityWaitingRoomSettingsParticipantsToPlaceInWaitingRoom` | `integer` |  |  |
| `meetingSecurityWaitingRoomSettingsUsersWhoCanAdmitParticipantsFromWaitingRoom` | `integer` |  |  |
| `meetingSecurityWaitingRoomSettingsWhitelistedDomainsForWaitingRoom` | `string` |  |  |
| `meetingSecurityWebinarPassword` | `boolean` |  |  |
| `phoneNumber` | `string` |  |  |
| `picUrl` | `string` |  |  |
| `pmi` | `integer` |  |  |
| `profileRecordingStorageLocationAllowedValues` | `array` of `string`s |  |  |
| `profileRecordingStorageLocationValue` | `string` |  |  |
| `recordingAskHostToConfirmDisclaimer` | `boolean` |  |  |
| `recordingAskParticipantsToConsentDisclaimer` | `boolean` |  |  |
| `recordingAuthentication` | `boolean` |  |  |
| `recordingAutoDeleteCmr` | `boolean` |  |  |
| `recordingAutoDeleteCmrData` | `integer` |  |  |
| `recordingAutoRecording` | `string` |  |  |
| `recordingCloudRecording` | `boolean` |  |  |
| `recordingHostDeleteCloudRecording` | `boolean` |  |  |
| `recordingHostPauseStopRecording` | `boolean` |  |  |
| `recordingIpAddressAccessControlEnable` | `boolean` |  |  |
| `recordingIpAddressAccessControlIpAddressesOrRanges` | `string` |  |  |
| `recordingLocalRecording` | `boolean` |  |  |
| `recordingRecordAudioFile` | `boolean` |  |  |
| `recordingRecordGalleryView` | `boolean` |  |  |
| `recordingRecordingAudioTranscript` | `boolean` |  |  |
| `recordingRecordingDisclaimer` | `boolean` |  |  |
| `recordingRecordingPasswordRequirementHaveLetter` | `boolean` |  |  |
| `recordingRecordingPasswordRequirementHaveNumber` | `boolean` |  |  |
| `recordingRecordingPasswordRequirementHaveSpecialCharacter` | `boolean` |  |  |
| `recordingRecordingPasswordRequirementLength` | `integer` |  |  |
| `recordingRecordingPasswordRequirementOnlyAllowNumeric` | `boolean` |  |  |
| `recordingRecordSpeakerView` | `boolean` |  |  |
| `recordingRequirePasswordForSharedCloudRecordings` | `boolean` |  |  |
| `recordingSaveChatText` | `boolean` |  |  |
| `recordingShowTimestamp` | `boolean` |  |  |
| `roleId` | `string` |  |  |
| `scheduleMeetingAudioType` | `string` |  |  |
| `scheduleMeetingDefaultPasswordForScheduledMeetings` | `string` |  |  |
| `scheduleMeetingEmbedPasswordInJoinLink` | `boolean` |  |  |
| `scheduleMeetingForcePmiJbhPassword` | `boolean` |  |  |
| `scheduleMeetingHostVideo` | `boolean` |  |  |
| `scheduleMeetingJoinBeforeHost` | `boolean` |  |  |
| `scheduleMeetingMeetingPasswordRequirementConsecutiveCharactersLength` | `integer` |  |  |
| `scheduleMeetingMeetingPasswordRequirementHaveLetter` | `boolean` |  |  |
| `scheduleMeetingMeetingPasswordRequirementHaveNumber` | `boolean` |  |  |
| `scheduleMeetingMeetingPasswordRequirementHaveSpecialCharacter` | `boolean` |  |  |
| `scheduleMeetingMeetingPasswordRequirementHaveUpperAndLowerCharacters` | `boolean` |  |  |
| `scheduleMeetingMeetingPasswordRequirementLength` | `integer` |  |  |
| `scheduleMeetingMeetingPasswordRequirementOnlyAllowNumeric` | `boolean` |  |  |
| `scheduleMeetingMeetingPasswordRequirementWeakEnhanceDetection` | `boolean` |  |  |
| `scheduleMeetingMuteUponEntry` | `boolean` |  |  |
| `scheduleMeetingParticipantsVideo` | `boolean` |  |  |
| `scheduleMeetingPersonalMeeting` | `boolean` |  |  |
| `scheduleMeetingPmiPassword` | `string` |  |  |
| `scheduleMeetingPstnPasswordProtected` | `boolean` |  |  |
| `scheduleMeetingRequirePasswordForInstantMeetings` | `boolean` |  |  |
| `scheduleMeetingRequirePasswordForPmiMeetings` | `string` |  |  |
| `scheduleMeetingRequirePasswordForScheduledmeetings` | `boolean` |  |  |
| `scheduleMeetingRequirePasswordForSchedulingNewMeetings` | `boolean` |  |  |
| `scheduleMeetingUsePmiForInstantMeetings` | `boolean` |  |  |
| `scheduleMeetingUsePmiForScheduledMeetings` | `boolean` |  |  |
| `telephonyAudioConferenceInfo` | `string` |  |  |
| `telephonyShowInternationalNumbersLink` | `boolean` |  |  |
| `telephonyTelephonyRegionsAllowedValues` | `array` of `string`s |  |  |
| `telephonyTelephonyRegionsSelectionValue` | `string` |  |  |
| `telephonyThirdPartyAudio` | `boolean` |  |  |
| `timezone` | `string` |  |  |
| `tspCallOut` | `boolean` |  |  |
| `tspCallOutCountries` | `array` of `string`s |  |  |
| `tspShowInternationalNumbersLink` | `boolean` |  |  |
| `type` | `integer` |  |  |
| `verified` | `integer` |  |  |

---

---

Source: /integrations/directory/zscaler

# Zscaler

Visualize Zscaler Internet Access (ZIA) resources including accounts, users, roles, sites, applications, policies, and destinations. Monitor security policy configurations, track user access roles, and understand your Zscaler deployment through queries and alerts.

## Installation

The Zscaler integration supports two authentication methods. ZIdentity + OneAPI (OAuth2) is the recommended modern approach, while legacy session-based authentication remains available for backward compatibility.

### Configuring the Integration in JupiterOne

To install the Zscaler integration in JupiterOne, navigate to the **Integrations** tab and select Zscaler. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Zscaler account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   An **authentication method** (see below).
    

Click **Create** once all values are provided to finalize the integration.

#### ZIdentity + OneAPI (OAuth2) — Recommended

This method uses OAuth2 Client Credentials via ZIdentity. It requires:

-   **Client ID**: The OAuth2 Client ID from your ZIdentity API client.
-   **Client Secret**: The OAuth2 Client Secret from your ZIdentity API client.
-   **Vanity Domain**: Your Zscaler tenant vanity domain (e.g., `mycompany` for `mycompany.zslogin.net`).
-   **Zscaler Cloud** (optional): The Zscaler cloud environment (e.g., `zscaler`, `zscalerone`, `zscalertwo`). Leave blank for the default cloud.

To create OAuth2 credentials:

1.  Log in to the ZIdentity Admin Portal.
2.  Create an API client with the **Client Credentials** grant type.
3.  Note the **Client ID** and **Client Secret**.
4.  Note your **Vanity Domain** — this is the subdomain portion of your `zslogin.net` URL.

#### Legacy Authentication (API Key + Session)

This method uses an API key, username, and password to create a session-based connection to the Zscaler ZIA API. It requires:

-   **API Key**: The API key used to authenticate with Zscaler.
-   **Username**: The API user email address.
-   **Password**: The API user password.
-   **Cloud Name**: Your Zscaler cloud instance (e.g., `zscaler`, `zscalerone`, `zscalertwo`, `zscalerthree`, `zscloud`, `zscalerbeta`).

To create legacy API credentials:

1.  Log in to your Zscaler Admin Portal.
2.  Navigate to **Administration > API Key Management**.
3.  Generate or retrieve your API key.
4.  Note the cloud name from your Zscaler URL (the subdomain before `.net`).

> **INFO**
> 
> See the [Zscaler API documentation](https://help.zscaler.com/zia/getting-started-zia-api) for more information on generating API keys.

## AppTotal Configuration (Optional)

To ingest third-party SaaS app inventory and SSPM posture findings from Zscaler AppTotal, provide the following additional credentials when creating your integration instance. These fields are optional — leaving them blank disables AppTotal data collection without affecting the core ZIA integration.

| Field | Description |
| --- | --- |
| **AppTotal API Key** | API key for the Zscaler AppTotal service. When provided, the integration ingests the SaaS app inventory and posture findings linked to the specified App View. |
| **AppTotal App View ID** | UUID of the AppTotal App View whose apps should be ingested. Required when an AppTotal API Key is provided. |

To obtain these credentials:

1.  Log in to the [AppTotal portal](https://apptotal.zscaler.com).
2.  Navigate to **Settings** to generate or copy your API key.
3.  Go to **App Views**, select the view you want to ingest, and copy its UUID.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `zscaler_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `zscaler_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Application Category | `zscaler_application_category` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AppTotal App | `zscaler_apptotal_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AppTotal Posture Finding | `zscaler_apptotal_posture_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Destination | `zscaler_destination` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Policy | `zscaler_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Policy Control | `zscaler_policy_control` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Role | `zscaler_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Site | `zscaler_site` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| User | `zscaler_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `zscaler_account` | **HAS** | `zscaler_role` |
| `zscaler_account` | **HAS** | `zscaler_site` |
| `zscaler_account` | **HAS** | `zscaler_application_category` |
| `zscaler_account` | **HAS** | `zscaler_application` |
| `zscaler_account` | **HAS** | `zscaler_destination` |
| `zscaler_account` | **HAS** | `zscaler_policy` |
| `zscaler_account` | **HAS** | `zscaler_user` |
| `zscaler_account` | **HAS** | `zscaler_apptotal_app` |
| `zscaler_account` | **HAS** | `zscaler_apptotal_posture_finding` |
| `zscaler_policy` | **HAS** | `zscaler_policy_control` |
| `zscaler_user` | **ASSIGNED** | `zscaler_role` |

### Zscaler Account

`zscaler_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `companyId` | `number` |  |  |
| `webLink` | `string` |  |  |

---

### Zscaler Application

`zscaler_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`appTags` \*

 | `null` **|** `array` | Tags associated with the application (named `appTags` to avoid the reserved `tag.*` property map). |  |
| 

`category` \*

 | `null` **|** `string` | Application category from the Shadow IT report (e.g. Collaboration). |  |
| 

`isSanctioned` \*

 | `null` **|** `boolean` | True when the application status is sanctioned. |  |
| 

`potentialIntegrations` \*

 | `null` **|** `number` | Number of potential 3rd-party integrations the application has with corporate SaaS platforms (populated by Zscaler 3rd-Party App Governance). |  |
| 

`riskIndex` \*

 | `null` **|** `number` | Zscaler-computed risk index, 1 (lowest risk) to 5 (highest risk). |  |
| 

`sanctionedState` \*

 | `null` **|** `string` | Whether the application is sanctioned or unsanctioned. |  |

---

### Zscaler Application Category

`zscaler_application_category` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`categoryType` \*

 | `null` **|** `string` |  |  |
| 

`configuredName` \*

 | `null` **|** `string` |  |  |
| 

`customCategory` \*

 | `null` **|** `boolean` |  |  |
| 

`superCategory` \*

 | `null` **|** `string` |  |  |

---

### Zscaler Apptotal App

`zscaler_apptotal_app` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`appTags` \*

 | `null` **|** `array` | Tags supplied by AppTotal (e.g. OAuth, 3rd Party). Named `appTags` to avoid collision with the inherited `tags` map. |  |
| 

`appViewId` \*

 | `string` | UUID of the AppTotal App View that this app was retrieved from. |  |
| 

`categories` \*

 | `array` of `string`s | AppTotal categories (e.g. Games, Productivity). |  |
| 

`category` \*

 | `null` **|** `string` | First category from `categories[]`, for J1QL convenience scalar. |  |
| 

`clientId` \*

 | `null` **|** `string` | Primary OAuth client identifier (the preferred `_key` source). |  |
| 

`clientType` \*

 | `null` **|** `string` | OAuth client type (e.g. Web Client). |  |
| 

`compliance` \*

 | `null` **|** `array` | Compliance attestations claimed by the vendor (e.g. GDPR, CCPA). |  |
| 

`consentScreenshotUrl` \*

 | `null` **|** `string` | URL of the captured OAuth consent screen. |  |
| 

`dataRetention` \*

 | `null` **|** `string` | Free-text retention policy from the vendor. |  |
| 

`developerEmail` \*

 | `null` **|** `string` | Vendor contact email for remediation. |  |
| 

`externalIds` \*

 | `array` of `string`s | All OAuth/UUID identifiers from `externalIds[].id`, parallel-indexed with `externalIdTypes`. |  |
| 

`externalIdTypes` \*

 | `null` **|** `array` | Per-identifier type values from `externalIds[].type` (e.g. clientId). Parallel-indexed with `externalIds`. |  |
| 

`extractedApiCalls` \*

 | `null` **|** `array` | API calls observed in app source (Premium Only). |  |
| 

`extractedUrls` \*

 | `null` **|** `array` | URLs extracted from app source (Premium Only). |  |
| 

`instanceClassifications` \*

 | `null` **|** `array` | Per-tenant classification from `instances[].classification` (Sanctioned/Unsanctioned/Unclassified/Reviewing). |  |
| 

`instanceStatuses` \*

 | `null` **|** `array` | Per-tenant install status from `instances[].status` (Enabled/Disabled/Deleted/Not Installed). |  |
| 

`isCanonicVerified` \*

 | `null` **|** `boolean` | True if AppTotal's verification flag is set. |  |
| 

`isPlatformVerified` \*

 | `null` **|** `boolean` | True if the publisher is verified by the SaaS platform (critical TPR signal). |  |
| 

`marketplaceDownloads` \*

 | `null` **|** `number` | Vendor trust signal: marketplace download count. |  |
| 

`marketplaceReviews` \*

 | `null` **|** `number` | Vendor trust signal: marketplace review count. |  |
| 

`marketplaceStars` \*

 | `null` **|** `number` | Vendor trust signal: marketplace star rating. |  |
| 

`permissionAccessTypes` \*

 | `null` **|** `array` | Per-scope access category from `permissions[].accessType`. |  |
| 

`permissionLevel` \*

 | `number` | Numeric score quantifying OAuth scope breadth. Critical risk metric. |  |
| 

`permissionLevels` \*

 | `null` **|** `array` | Per-scope risk band from `permissions[].level` (LOW/MEDIUM/HIGH). |  |
| 

`permissions` \*

 | `null` **|** `array` | OAuth scopes flattened from `permissions[].scope`. Critical TPR signal. |  |
| 

`permissionServices` \*

 | `null` **|** `array` | Per-scope service from `permissions[].service`. |  |
| 

`platform` \*

 | `string` | The SaaS platform the app integrates with (e.g. google\_workspace, microsoft\_365). |  |
| 

`privacyPolicyUrl` \*

 | `null` **|** `string` | Vendor privacy policy URL. |  |
| 

`redirectUrls` \*

 | `null` **|** `array` | OAuth redirect URIs registered for this app (forensic / token-theft IOC). |  |
| 

`riskCategories` \*

 | `null` **|** `array` | AppTotal per-app risk categories from `risks[].category` (Premium Only). |  |
| 

`riskLevel` \*

 | `string` | Categorical risk band (LOW/MEDIUM/HIGH). Renamed from the API field `risk` to avoid collision with the inherited Application.risk numeric 1-10. |  |
| 

`riskScore` \*

 | `null` **|** `number` | AppTotal numeric risk score (raw, typically 0-10). |  |
| 

`riskSeverities` \*

 | `null` **|** `array` | Per-risk severity from `risks[].severity` (LOW/MEDIUM/HIGH) (Premium Only). |  |
| 

`termsOfServiceUrl` \*

 | `null` **|** `string` | Vendor terms-of-service URL. |  |
| 

`totalEnabledUsers` \*

 | `null` **|** `number` | Number of internal users currently authorized to use the app (blast radius proxy). |  |
| 

`vendor` \*

 | `null` **|** `string` | The publisher / vendor name (from publisher.name). |  |
| 

`vendorDescription` \*

 | `null` **|** `string` | Publisher self-description (from publisher.description). |  |
| 

`vendorLogoUrl` \*

 | `null` **|** `string` | Publisher logo URL (from publisher.logoUrl). |  |
| 

`vendorUrl` \*

 | `null` **|** `string` | Publisher web site URL (from publisher.siteUrl). |  |
| 

`vulnerabilityCveIds` \*

 | `null` **|** `array` | CVEs found in third-party libraries from `vulnerabilities[].cveId` (Premium Only). |  |
| 

`websiteUrls` \*

 | `null` **|** `array` | App-controlled URLs (informational). |  |

---

### Zscaler Apptotal Posture Finding

`zscaler_apptotal_posture_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`appViewId` \*

 | `null` **|** `string` | AppTotal App View UUID carried through from configuration so J1QL can correlate findings to apps. |  |
| 

`categoryIds` \*

 | `null` **|** `array` | Stable category UUIDs. |  |
| 

`categoryNames` \*

 | `null` **|** `array` | Human-readable categories (e.g. authentication, encryption). |  |
| 

`complexity` \*

 | `null` **|** `string` | Remediation effort estimate (LOW/MEDIUM/HIGH). |  |
| 

`complianceCategories` \*

 | `null` **|** `array` | Per-framework category labels from `compliance[].controlCategory`. |  |
| 

`complianceControlNumbers` \*

 | `null` **|** `array` | Framework-specific control numbers from `compliance[].controlNumber` (e.g. CIS-1.2.3). Auto-correlated by the JupiterOne compliance layer when the strings match. |  |
| 

`complianceFrameworks` \*

 | `null` **|** `array` | Compliance framework names from `compliance[].name` (e.g. CIS, SOC2). |  |
| 

`complianceIds` \*

 | `null` **|** `array` | Compliance framework UUIDs from `compliance[].id`. |  |
| 

`controlId` \*

 | `string` | Stable rule identifier (UUID) for this posture control. |  |
| 

`controlName` \*

 | `string` | Human-readable name of the posture control. |  |
| 

`failedAssetsCount` \*

 | `null` **|** `number` | Count of assets currently failing this control (blast-radius proxy). |  |
| 

`mitreTacticId` \*

 | `null` **|** `string` | MITRE ATT&CK tactic ID (from `mitreTactic.id`). |  |
| 

`mitreTacticName` \*

 | `null` **|** `string` | MITRE ATT&CK tactic name (e.g. Initial Access). |  |
| 

`mitreTacticUrl` \*

 | `null` **|** `string` | Direct link to the MITRE tactic. |  |
| 

`mitreTechniqueIds` \*

 | `null` **|** `array` | MITRE technique IDs flattened from `mitreTechniques[].id` (e.g. T1078). |  |
| 

`mitreTechniqueNames` \*

 | `null` **|** `array` | MITRE technique names from `mitreTechniques[].name`. |  |
| 

`mitreTechniqueUrls` \*

 | `null` **|** `array` | Direct links from `mitreTechniques[].url`. |  |
| 

`platformId` \*

 | `null` **|** `string` | UUID of the SaaS platform this control evaluates (e.g. google\_workspace). |  |
| 

`policyStatus` \*

 | `null` **|** `string` | Policy compliance state (PARTIAL / COMPLIANT / NON\_COMPLIANT). Drives the inherited `open` flag. |  |
| 

`remediationThreat` \*

 | `null` **|** `string` | Risk-of-not-fixing description from AppTotal. Populates the inherited `recommendation`. |  |
| 

`tenantId` \*

 | `null` **|** `string` | Multi-tenant identifier (UUID) of the evaluated tenant. |  |
| 

`tenantName` \*

 | `null` **|** `string` | Customer-facing tenant label. |  |
| 

`violationDescription` \*

 | `null` **|** `string` | Raw violation description from AppTotal. Populates the inherited `description`. |  |

---

### Zscaler Destination

`zscaler_destination` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`addresses` \*

 | `null` **|** `array` |  |  |
| 

`countries` \*

 | `null` **|** `array` |  |  |
| 

`destinationType` \*

 | `null` **|** `string` |  |  |
| 

`ipAddresses` \*

 | `null` **|** `array` |  |  |
| 

`urls` \*

 | `null` **|** `array` |  |  |

---

### Zscaler Policy

`zscaler_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `null` **|** `string` |  |  |
| 

`lastModifiedBy` \*

 | `null` **|** `string` |  |  |
| 

`lastModifiedOn` \*

 | `null` **|** `number` |  |  |
| 

`order` \*

 | `null` **|** `number` |  |  |
| 

`policyType` \*

 | `null` **|** `string` |  |  |
| 

`protocols` \*

 | `null` **|** `array` |  |  |
| 

`rank` \*

 | `null` **|** `number` |  |  |
| 

`state` \*

 | `null` **|** `string` |  |  |

---

### Zscaler Policy Control

`zscaler_policy_control` inherits from [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `null` **|** `string` |  |  |
| 

`controlType` \*

 | `null` **|** `string` |  |  |
| 

`enabled` \*

 | `null` **|** `boolean` |  |  |
| 

`enforcement` \*

 | `null` **|** `string` |  |  |
| 

`policyId` \*

 | `null` **|** `number` |  |  |

---

### Zscaler Role

`zscaler_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`functionalScope` \*

 | `null` **|** `array` |  |  |
| 

`permissions` \*

 | `null` **|** `array` |  |  |
| 

`policyAccess` \*

 | `null` **|** `string` |  |  |
| 

`rank` \*

 | `null` **|** `number` |  |  |
| 

`roleType` \*

 | `null` **|** `string` |  |  |

---

### Zscaler Site

`zscaler_site` inherits from [Site](/data-model/schemas/Site.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`authRequired` \*

 | `null` **|** `boolean` |  |  |
| 

`city` \*

 | `null` **|** `string` |  |  |
| 

`country` \*

 | `null` **|** `string` |  |  |
| 

`ipAddresses` \*

 | `null` **|** `array` |  |  |
| 

`language` \*

 | `null` **|** `string` |  |  |
| 

`ports` \*

 | `null` **|** `array` |  |  |
| 

`profile` \*

 | `null` **|** `string` |  |  |
| 

`sslScanEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`state` \*

 | `null` **|** `string` |  |  |
| 

`surrogateIP` \*

 | `null` **|** `string` |  |  |

---

### Zscaler User

`zscaler_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`adminScopeType` \*

 | `null` **|** `string` |  |  |
| 

`disabled` \*

 | `null` **|** `boolean` |  |  |
| 

`firstName` \*

 | `null` **|** `string` |  |  |
| 

`isPasswordLoginAllowed` \*

 | `null` **|** `boolean` |  |  |
| 

`lastLoginTime` \*

 | `null` **|** `number` |  |  |
| 

`lastName` \*

 | `null` **|** `string` |  |  |
| 

`loginName` \*

 | `null` **|** `string` |  |  |
| 

`passwordExpiryTime` \*

 | `null` **|** `number` |  |  |
| 

`twoFactorAuthEnabled` \*

 | `null` **|** `boolean` |  |  |

---

## Release Notes

-   **2026-04-15** — Added ZIdentity + OneAPI (OAuth2) as a second authentication method alongside legacy session-based auth.
-   **2026-01-12** — Added support for ingesting Zscaler Internet Access data including applications, application categories, destinations, policies, roles, sites, and users.

---

Source: /integrations/instance-management

# Instance management

Once configured, integration instances can be accessed from the **Integrations** tab in JupiterOne. From the Integrations tab, select the integration for which you would like to view an instance(s).

Within that integration's page, a table containing all existing instances of that integration are displayed. The table contains the following information for each instance:

-   The **Instance name**: name assigned to the instance.
-   The **\# of Entities**: the total number of entities, or assets, that are ingested by JupiterOne via the instance.
-   **Most recent job status**: the status of the integrations recent job status.
-   **Most recent job date**: displays the date for which the instance has most recently completed running.
-   The **Schedule**: shows the instance's polling interval frequency.

#### Calculate the number of instance entities

Within the **\# of Entities** column, you can quickly calculate the number of data entities that are tied to a particular instance by selecting **Calculate**.

To view those entities via J1QL query, select the "link out" icon to be redirected to a J1QL query and results page outlining your integration instance's entities (comprised of `entity._type`, and `count(entity)`).

### View instance summary and jobs

By clicking on an instance's name from within the table, you can view a more detailed set of instance-specific information.

#### Instance summary

The instance summary provides additional details of the instance itself and the data associated to it. In the Summary, you can find:

-   The instance **Id**: which is used to associate the instance with the data it ingests into JupiterOne
-   The instance **Account name**, **Description**, and **Polling interval** as defined during creation.
-   Specific **Scopes** if applicable to the integration.
-   Any **Tags** associated to the instance.

#### Instance jobs

Integration instance jobs are run according to the instance's determined polling interval. For example, if an instance has a weekly polling interval, the job will trigger on a weekly basis for which ever day and time have been configured (e.g., every Monday at 12:00AM).

To review instance jobs, navigate to the integration instance for which you would like to examine (**Integrations > Integration > Integration instance**), and select **Instance Jobs**.

You will find a table outlining all known jobs for that instance. The table displays the following information:

-   **Job ID**: The unique identifier for the job instance.
-   **Job Status**: Indicates the status of the job and highlights if there were any issues.
-   **Start Date** and **End Date**: The date and time the job began and completed
-   **Execution time**: The amount of time the job took to complete.

#### Instance job logs

Additionally, you can view a log of each instance job by clicking the instance **Job ID** from the Instance Jobs table.

> **INFO**
> 
> If there were any issues with the job, the log can provide additional context for where the issue may have occurred while the job was trying to run.

#### Instance job statues

The `status` and `errorsOccurred` properties indicate the result of the job.

##### job.status

| Status | Definition |
| --- | --- |
| IN\_PROGRESS | The job is currently ingesting and processing the data retrieved from the source. |
| CONFIGURATION\_FAILURE | The job was unable to begin ingestion due to invalid configuration or credentials. **Please update your integration configuration and/or credentials to resolve this issue.** |
| COMPLETED | The job completed ingestion and processing without any known errors. |
| COMPLETED\_WITH\_WARNINGS | The job completed ingestion and processing with missing data due to ingestion limits or missing provider permissions. |
| COMPLETED\_WITH\_ERRORS | The job completed ingestion and processing with unexpected errors. The successfully collected data will be available in JupiterOne. |
| FAILED | The job failed to ingest and/or process the data. No changes were made to the data within JupiterOne. |

#### job.errorsOccurred

During the execution of a job, if an error level job event is logged, the `errorsOccurred` boolean is set to true. A job with status `FAILED` or `COMPLETED_WITH_ERRORS` will always have `errorsOccurred` set to true.

### Run an integration instance

In addition to instances running regularly on a determined polling interval, you have the ability to manually initiate an integration instance for ad-hoc results.

> **NOTE**
> 
> This is a great way to test your integration configuration to ensure it is operating as it should immediately after creation.

You can run an integration instance at any time by navigating to that particular instance (**Integrations > Integration > Integration instance**), and selecting **Run integration**.

This will initiate an instance job to run, and you will be able to review the instance job and logs once the job has completed.

### Edit an instance

You can change your [instance settings](/integrations/settings.md), while viewing an integration instance by clicking **Edit**. Doing so allows you to adjust any of the information used during the creation of the integration.

### Remove an instance

To remove an integration instance, simply navigate to that particular instance from within the Integrations tab: **Integrations > Integration name > Integration instance to be deleted**.

Select the **Instance Name** of the instance you wish to delete, and click **Delete**.

> **WARNING**
> 
> This will delete all existing data within JupiterOne that is tied to the integration instance.

---

Source: /integrations/integrations-directory

# here it is

---

Source: /integrations/jupiterone-mcp-server

# JupiterOne AI Integration (MCP Server)

The JupiterOne Model Context Protocol (MCP) Server enables AI assistants like Claude (on claude.ai and Claude Desktop), Claude Code, Cursor, and Amazon Kiro to interact directly with your JupiterOne account using natural language.

## Prerequisites

-   Active JupiterOne account with API access
-   JupiterOne API key and account ID
-   Node.js version 20 or higher (for local server only)
-   AI assistant with MCP support (Claude on claude.ai, Claude Desktop, Claude Code, Cursor IDE, ChatGPT, GitHub Copilot, Continue.dev, Cline, Devin Desktop (formerly Windsurf), Amazon Kiro, etc.)

## Installation Methods

### Install from the Claude connector directory (easiest)

JupiterOne is published in the Claude connector directory. If you use Claude, this is the fastest path — there is no JSON to edit and no URL to construct.

1.  Open **[claude.ai/directory/jupiterone](https://claude.ai/directory/jupiterone)**.
2.  Click **Connect** and choose your JupiterOne region.
3.  Sign in to JupiterOne, then approve the consent screen — it lists what the connector will be allowed to do before anything is granted.

The directory connector uses JupiterOne's hosted remote server, so it requires no local installation and stays on the current release automatically.

> **TIP**
> 
> The directory connector is not tied to one account. If your sign-in can reach more than one, ask Claude to _"list my JupiterOne accounts"_ — every tool acts on one account per call, and `list-accounts` returns each account you can use along with its `accountId`.

### Have an AI set this up for you

If you'd rather not edit JSON by hand, copy the prompt below and paste it into your AI assistant. It will ask for the credentials it needs and walk you through the install.

Preview the prompt

> Help me install the JupiterOne MCP server in this client. The setup docs are at [https://docs.jupiterone.io/integrations/jupiterone-mcp-server](https://docs.jupiterone.io/integrations/jupiterone-mcp-server).
> 
> 1.  Ask whether I want the remote (OAuth, recommended) or local (API key) deployment.
> 2.  If local, ask me for my JupiterOne API key and account ID. My account ID can be found at [https://docs.jupiterone.io/features/admin/admin-settings#account-management](https://docs.jupiterone.io/features/admin/admin-settings#account-management) — this is the account ID, not the vanity domain.
> 3.  Show me the JSON to add to your MCP config file. If a config already exists, preserve existing servers and merge mine in.
> 4.  Tell me how to restart and verify the server is connected.

### Manual setup

The JupiterOne MCP Server can be configured in two ways:

#### Option 1: Remote HTTP Server (Recommended)

Use JupiterOne's hosted MCP server without local installation:

-   **URL Format**: `https://your-account-id-here.mcp.<REGION>.jupiterone.io/mcp`
-   **Example**: `https://j1dev.mcp.us.jupiterone.io/mcp`
-   **Authentication**: OAuth-based authentication with JupiterOne login

Replace `<REGION>` with `us` or `eu` based on your JupiterOne instance. The examples in this guide use `us`.

> **INFO**
> 
> The remote HTTP server option:
> 
> -   Requires no local installation
> -   Handles authentication through JupiterOne's OAuth flow
> -   Automatically stays up-to-date with the latest features
> -   Works across different machines without setup

#### Option 2: Local Server (stdio)

Install and run the MCP server locally using npx:

```bash
npx @jupiterone/jupiterone-mcp
```

Or install globally for repeated use:

```bash
npm install -g @jupiterone/jupiterone-mcp
```

## Configuration

### Get Your Credentials

#### For Remote Server (Option 1)

-   **Account ID**: Found in [Account Management](/features/admin/admin-settings.md#account-management)
-   **Region**: Your JupiterOne instance region (e.g., `us`, `eu`)

#### For Local Server (Option 2)

1.  **API Key**: Navigate to **Settings** → **User API Tokens** in JupiterOne and create a new API key
2.  **Account ID**: Found in [Account Management](/features/admin/admin-settings.md#account-management) or by running: `find jupiterone_account as x return x.accountId`

> **INFO**
> 
> -   **Local Server**: Uses API key authentication and runs within the context of the user, respecting RBAC configuration
> -   **Remote Server**: Uses OAuth authentication through JupiterOne login, automatically applying your user permissions

### AI Platform Setup

**Configuration file location:**

-   **macOS**: `~/Library/Application Support/Claude/claude_desktop_config.json`
-   **Windows**: `%APPDATA%\Claude\claude_desktop_config.json`

##### Local server

Edit the configuration file above and add:

**Local Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here"
      }
    }
  }
}
```

Restart Claude Desktop.

##### Remote server

In the Claude Desktop App:

1.  Navigate to **Settings** → **Connectors**.
2.  Click **Add custom connector** at the bottom of the section.
3.  Set the title to `JupiterOne` and the URL to `https://your-account-id-here.mcp.us.jupiterone.io/mcp`.
4.  Click **Add** and complete the OAuth sign-in.

Claude Code supports MCP via CLI command or config file.

##### Option A — CLI (recommended)

For the local server:

```bash
claude mcp add jupiterone -- npx -y @jupiterone/jupiterone-mcp \
  --env JUPITERONE_API_KEY=your-api-key-here \
  --env JUPITERONE_ACCOUNT_ID=your-account-id-here
```

For the remote server:

```bash
claude mcp add --transport http jupiterone https://your-account-id-here.mcp.us.jupiterone.io/mcp
```

##### Option B — Config file

Edit `~/.claude.json` (user-level) or create `.mcp.json` in your project root (project-level, can be checked into source control):

**Local Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here"
      }
    }
  }
}
```

**Remote Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "url": "https://your-account-id-here.mcp.us.jupiterone.io/mcp"
    }
  }
}
```

Replace `us` with `eu` if your JupiterOne instance is in the EU region.

Run `/mcp` inside Claude Code to verify the server is connected.

1.  Open Cursor Settings (⌘+, on Mac, Ctrl+, on Windows).
2.  Navigate to **Features** → **Model Context Protocol**.
3.  Add configuration based on your chosen method:

**Local Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here"
      }
    }
  }
}
```

**Remote Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "url": "https://your-account-id-here.mcp.us.jupiterone.io/mcp"
    }
  }
}
```

Replace `us` with `eu` if your JupiterOne instance is in the EU region.

4.  Restart Cursor.

> **INFO**
> 
> If you've previously connected to JupiterOne or need to switch accounts:
> 
> 1.  In Cursor Settings, navigate to **Features** → **Model Context Protocol**.
> 2.  Expand the **Tools enabled** section for the JupiterOne MCP server.
> 3.  Click the **Logout** button at the top.
> 4.  Restart Cursor to reauthenticate with your JupiterOne account.

> **INFO**
> 
> GitHub Copilot MCP support is generally available in Visual Studio Code, JetBrains, Eclipse, and Xcode. The **MCP servers in Copilot** policy is disabled by default and must be enabled by an organization or enterprise administrator before Copilot can connect to JupiterOne.

1.  Create `.vscode/mcp.json` in your project root.
2.  Add configuration based on your chosen method.

**Local Server Configuration:**

```json
{
  "servers": {
    "jupiterone": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here"
      }
    }
  }
}
```

**Remote Server Configuration:**

```json
{
  "servers": {
    "jupiterone": {
      "type": "http",
      "url": "https://your-account-id-here.mcp.us.jupiterone.io/mcp"
    }
  }
}
```

3.  Click **Start** in the gutter of `.vscode/mcp.json` to launch the server.
4.  Open Copilot Chat, select **Agent** mode, and click the tools icon to confirm JupiterOne tools are listed.

For details, see the [GitHub Copilot MCP documentation](https://docs.github.com/en/copilot/customizing-copilot/extending-copilot-chat-with-mcp).

1.  Open Continue.dev settings.
2.  Navigate to MCP configuration.
3.  Add configuration based on your chosen method:

**Local Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here"
      }
    }
  }
}
```

**Remote Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "url": "https://your-account-id-here.mcp.us.jupiterone.io/mcp"
    }
  }
}
```

Replace `us` with `eu` if your JupiterOne instance is in the EU region.

1.  Install the Cline extension from the VS Code marketplace.
2.  Open VS Code settings (⌘+, on Mac, Ctrl+, on Windows).
3.  Search for "Cline MCP".
4.  Add configuration based on your chosen method:

**Local Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here"
      }
    }
  }
}
```

**Remote Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "url": "https://your-account-id-here.mcp.us.jupiterone.io/mcp"
    }
  }
}
```

Replace `us` with `eu` if your JupiterOne instance is in the EU region.

> **INFO**
> 
> Windsurf was rebranded as Devin Desktop by Cognition in June 2026. Existing installs received the change as an over-the-air update, and the configuration file path still uses the original `windsurf` directory name.

1.  Open **Devin Settings** → **Cascade** → **MCP Servers**, or click the **MCPs** icon in the top-right menu of the Cascade panel.
2.  Open the raw configuration file, `~/.codeium/windsurf/mcp_config.json`.
3.  Add configuration based on your chosen method:

**Local Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here"
      }
    }
  }
}
```

**Remote Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "url": "https://your-account-id-here.mcp.us.jupiterone.io/mcp"
    }
  }
}
```

Replace `us` with `eu` if your JupiterOne instance is in the EU region.

4.  Restart Devin Desktop.

1.  Locate or create your Kiro MCP configuration file:
    
    -   **Workspace (project-specific)**: `.kiro/settings/mcp.json` in your project root
    -   **User (global)**: `~/.kiro/settings/mcp.json`
    
    Workspace settings override user settings when both define the same server.
    
2.  Add configuration based on your chosen method.
    

**Local Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}
```

**Remote Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "url": "https://your-account-id-here.mcp.us.jupiterone.io/mcp",
      "disabled": false,
      "autoApprove": []
    }
  }
}
```

3.  Save the file. Kiro applies `autoApprove` and `disabledTools` changes immediately, but you must restart Kiro to register a newly added server.
    
4.  Verify the connection by opening Kiro's Output panel and selecting **Kiro - MCP Logs**.
    

> **INFO**
> 
> Kiro supports stdio and HTTP transports natively but does not currently support SSE.

### Verify Installation

Once configured, test the connection by asking your AI assistant:

> "List my JupiterOne integrations"

A successful response confirms the MCP server is connected and authenticated. If you receive an error or no response, see [Troubleshooting](#troubleshooting).

## What You Can Do

The MCP server provides 29 tools spanning query execution, alert monitoring, rules management, dashboard management, integration monitoring, and account discovery. Ask your AI assistant questions in natural language — it selects the right tool and, when a query is needed, writes the [J1QL](/j1ql.md) for you.

### Prompt Templates by Use Case

Copy any prompt below and paste it into your AI assistant. Where a prompt produces a J1QL query, the query is shown so you can learn the syntax or adapt it.

| Prompt | J1QL the AI generates |
| --- | --- |
| "How many cloud instances do I have, broken down by provider?" | `Find Host with _integrationType != undefined as h return h._integrationType as Provider, count(h) as Total` |
| "List all data stores that are not encrypted" | `Find DataStore with encrypted != true` |
| "Show me all resources without a data classification tag" | `Find (Host|DataStore) with classification = undefined` |
| "Which S3 buckets are publicly accessible?" | `Find aws_s3_bucket with classification = 'Public' OR bucketPolicy.public = true` |
| "Find all hosts that have not been scanned in the last 30 days" | `Find Host that !has Assessment with _createdOn > date.now-30days` |

| Prompt | J1QL the AI generates |
| --- | --- |
| "Who has admin access across all providers?" | `Find AccessRole with admin = true as role that assigned User as user return user.displayName, role.displayName, role._integrationType` |
| "Find users with MFA disabled" | `Find User with mfaEnabled != true` |
| "Which service accounts have not been rotated in 90 days?" | `Find AccessKey with createdOn < date.now-90days as key return key.displayName, key._integrationType, key.createdOn` |
| "List new hires from the last 12 months" | `Find employee with _createdOn > date.now-12months` |
| "Find all users who can assume a role in a production account" | `Find User that assigned AccessRole that assigned Account with tag.Production = true` |

| Prompt | J1QL the AI generates |
| --- | --- |
| "Show me all critical vulnerabilities from the last 7 days" | `Find Finding with severity = 'critical' and _createdOn > date.now-7days as f return f.displayName, f.severity, f.numericSeverity` |
| "Which applications have open vulnerabilities?" | `Find Application as app that has Vulnerability as vuln return app.displayName, vuln.displayName, vuln.severity` |
| "Are there any hosts with both public exposure and critical vulnerabilities?" | `Find Host with publicIpAddress != undefined that has Finding with severity = 'critical'` |
| "Find vulnerabilities that have been open for more than 30 days" | `Find Vulnerability with _createdOn < date.now-30days and open = true` |
| "Count open findings by severity" | `Find Finding with open = true as f return f.severity as Severity, count(f) as total` |

| Prompt | J1QL the AI generates |
| --- | --- |
| "Get all active alerts" | Uses `get-active-alerts` tool directly |
| "List all my alert rules" | Uses `list-rules` tool directly |
| "Create a rule that fires when a new critical vulnerability is found" | Uses `create-inline-question-rule` tool with a Finding query |
| "Show my dashboards" | Uses `get-dashboards` tool directly |
| "Create a dashboard tracking my biggest security risks" | Uses `create-dashboard` + `create-dashboard-widget` tools |

| Prompt | J1QL the AI generates |
| --- | --- |
| "List my JupiterOne integrations" | Uses `get-integration-instances` tool directly |
| "Which integrations failed their last run?" | Uses `get-integration-jobs` tool with `status` filter |
| "Show me the event log for the latest AWS integration job" | Uses `get-integration-jobs` then `get-integration-events` tools |
| "What integration types are available?" | Uses `get-integration-definitions` tool directly |
| "Is my CrowdStrike integration healthy?" | Uses `get-integration-instances` then `get-integration-jobs` tools |

For the full J1QL language reference, including traversals, aggregations, and filtering, see the [J1QL documentation](/j1ql.md).

### Available Tools

The MCP server exposes the following tools. Your AI assistant selects the right tool automatically based on your question.

Query Execution

| Tool | Description |
| --- | --- |
| `execute-j1ql-query` | Execute any [J1QL query](/j1ql.md). Supports variables, cursor-based pagination, deleted entity inclusion, scope filters, and query flags. |
| `get-query-results` | Retrieve results of a long-running query. Use when `execute-j1ql-query` returns `status: "IN_PROGRESS"` with a `resultsUrl`. |

Alert Monitoring

| Tool | Description |
| --- | --- |
| `get-active-alerts` | List currently active alerts, with optional limit (1–1000). |

Rules Management

| Tool | Description |
| --- | --- |
| `list-rules` | List all rules in the account, with optional limit. |
| `get-rule-details` | Get full details of a specific rule by ID. |
| `create-inline-question-rule` | Create a new inline question-based rule with queries, operations, and actions. |
| `update-inline-question-rule` | Update an existing inline question rule. |
| `delete-rule` | Delete an alert rule. Irreversible, and it does not dismiss alerts the rule already raised. |
| `evaluate-rule` | Trigger on-demand evaluation of a specific rule. |
| `list-rule-evaluations` | Get historical evaluation data for a rule, with optional time range filtering. |
| `get-rule-evaluation-details` | Get detailed evaluation results including query output, condition results, and action results. |
| `get-raw-data-download-url` | Get a download URL for raw evaluation data. |
| `get-rule-evaluation-query-results` | Get the actual query results from a rule evaluation. |

Dashboard Management

| Tool | Description |
| --- | --- |
| `get-dashboards` | List all dashboards in your account. |
| `create-dashboard` | Create a new dashboard. |
| `get-dashboard-details` | Get full dashboard information including widgets and layouts. |
| `update-dashboard` | Update an existing dashboard's layout. |
| `create-dashboard-widget` | Add a widget to a dashboard. |
| `update-dashboard-widget` | Update an existing widget's query, title, or chart type. |
| `delete-dashboard` | Delete an entire dashboard and all its widgets. |
| `delete-dashboard-widget` | Delete a single widget from a dashboard. |

Integration Management

| Tool | Description |
| --- | --- |
| `get-integration-definitions` | List available integration types, optionally including configuration fields. |
| `get-integration-instances` | List configured integration instances, optionally filtered by definition. |
| `get-integration-jobs` | List integration jobs filtered by status, instance, or definition. |
| `get-integration-job` | Get details for a specific integration job. |
| `get-integration-events` | Get events for a specific integration job, with pagination. |

Account Management

| Tool | Description |
| --- | --- |
| `test-connection` | Test connectivity and return account information and permissions. |
| `list-accounts` | List JupiterOne accounts the authenticated user can access, each with its `accountId`, display name, and `mcpUrl` — the connector URL that pins that account. Use it to find the right account when a connector points at one you cannot reach. |
| `list-entity-types` | Discover all entity classes and types available in your account. |

## Known Limitations

> **WARNING**
> 
> -   **Deletes cover rules and dashboards only**: `delete-rule`, `delete-dashboard`, and `delete-dashboard-widget` are the only delete operations. Integrations, entities, and other resources cannot be deleted through the MCP server. Write and delete tools are annotated (`readOnlyHint`/`destructiveHint`) so MCP clients can prompt for approval before running them.
> -   **Deleting a rule does not dismiss its alerts**: alerts the rule already raised stay active after the rule is gone, and the rule's configuration cannot be recovered. To stop a rule firing while keeping its configuration and evaluation history, ask for its polling interval to be set to `DISABLED` instead of deleting it.

> **WARNING**
> 
> The MCP server consumes your JupiterOne API rate limit quota. Each operation counts against your [API rate limits](/api/rate-limiting.md). Monitor your usage to avoid hitting limits during critical operations.

## Troubleshooting

### URL uses your vanity domain instead of your account ID

The remote server URL must use your **account ID**, not your vanity domain (the custom subdomain like `acme.app.us.jupiterone.io`). If you see authentication or "account not found" errors with the remote server, double-check the URL.

Find your account ID in [Account Management](/features/admin/admin-settings.md#account-management) — it is listed separately from the Vanity URL.

### Server does not appear in your client

1.  Confirm your JSON config is valid (a single trailing comma will cause silent failure).
2.  Restart your AI client. Most clients only load MCP config on startup.
3.  Check the client's MCP log:
    -   **Claude Desktop**: `~/Library/Logs/Claude/mcp*.log` (macOS) or `%APPDATA%\Claude\logs\mcp*.log` (Windows)
    -   **Cursor**: Output panel → "Cursor MCP"
    -   **VS Code (Copilot/Cline)**: Output panel → relevant extension
    -   **Kiro**: Output panel → "Kiro - MCP Logs"
    -   **Claude Code**: run `/mcp` inside the session

### `npx` or `command not found` errors

The local server requires Node.js 20+ on your `PATH`. Run `node --version` in the same shell your client uses. On macOS, GUI apps may not inherit your shell's `PATH`; use an absolute path to `npx` (find it with `which npx`) in the config.

### OAuth flow fails for the remote server

Sign out of your JupiterOne account in your browser, then retry the OAuth handshake.

### A query comes back as `status: "IN_PROGRESS"`

This is not an error. Heavy graph traversals can outlive a single tool call, so the query keeps running on the server and the response carries a `resultsUrl` handle. Your assistant should call `get-query-results` with that handle to collect the results — it does not need to run the query again.

-   Queries that succeed almost always finish within about **4 minutes**.
-   Past roughly **13 minutes** a query will not complete. Narrow it — indexed `WITH` filters, a smaller `LIMIT`, fewer traversals — and run it again.
-   The handle expires about **an hour** after the query started. Re-running an identical query within about 5 minutes re-attaches to the same execution instead of starting over.

If your assistant keeps re-issuing `execute-j1ql-query` instead of using the handle, it restarts the query from scratch each time. Tell it to call `get-query-results` with the `resultsUrl` it was given.

### A valid query is rejected as a syntax error (local server)

The local server checks J1QL against a copy of the platform's query grammar that is bundled when the package is published, so syntax mistakes come back instantly instead of costing a round-trip. A significantly out-of-date install can therefore reject syntax that a newer query service would accept.

Update the package first: `npx` picks up the newest version on each run, and a global install updates with `npm install -g @jupiterone/jupiterone-mcp`. If you need to bypass the local check in the meantime, set `JUPITERONE_SKIP_QUERY_VALIDATION` to `1` in your MCP client config — the backend still validates every query.

```json
{
  "mcpServers": {
    "jupiterone": {
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here",
        "JUPITERONE_SKIP_QUERY_VALIDATION": "1"
      }
    }
  }
}
```

This applies to the local server only. The remote server always runs the current release, so its grammar cannot fall behind.

### Hitting API rate limits

Each MCP query consumes JupiterOne API quota. See [API rate limiting](/api/rate-limiting.md) for limits and recommendations.

## FAQ

### Data Residency & Processing

The JupiterOne MCP Server is available in two deployment modes. The **local server** runs on your machine and uses your API key to fetch data on demand from JupiterOne's cloud — data never passes through any centralized JupiterOne MCP host. The **remote HTTP server** is hosted by JupiterOne in the same region as your account and authenticates via OAuth; data residency follows the same regional principles as standard JupiterOne API access. In both modes, retrieved data is forwarded to your AI assistant's LLM provider (e.g., Anthropic, OpenAI) per your client's configuration.

### LLM Compatibility & Data Handling

The MCP Server integrates with any AI assistant that supports the Model Context Protocol (MCP), including Claude on claude.ai, Claude Desktop, Claude Code, Cursor IDE, ChatGPT, GitHub Copilot, Continue.dev, Cline, Devin Desktop (formerly Windsurf), and Amazon Kiro. Once the server is running and configured, your assistant can use natural language to request security data, which is fetched from JupiterOne and passed to the LLM for interpretation. This means data such as asset inventories, vulnerability reports, or alert summaries can be included in AI prompts, depending on what you query. It's important to treat this as a form of third-party data sharing—ensure your selected assistant has appropriate enterprise security practices in place.

### Privacy, Logging & Data Sharing

Your API key (local server) or OAuth session (remote server) governs all access, and data is only transmitted in response to your assistant's specific queries. JupiterOne does not store the results of your queries, your query parameters, or action payloads.

For operational monitoring, the remote server records sanitized, non-sensitive usage telemetry — such as which tool ran and whether it succeeded — with query content redacted. The local server keeps this telemetry on your own machine and sends nothing to JupiterOne.

Separately, your AI assistant may log conversations or prompts on its own platform, just as it would during typical usage. To manage exposure, review your LLM provider's data retention and privacy terms, and consider using enterprise or self-hosted models for sensitive environments.

For JupiterOne's formal data-handling commitments — including data collection, retention, storage, and third-party processors — see the [Privacy Policy](https://www.jupiterone.com/privacy-policy), [Data Processing Addendum](https://www.jupiterone.com/legal-and-security/data-processing-addendum), and [Subprocessors](https://www.jupiterone.com/legal-and-security/subprocessors) in the [Legal & Security Hub](https://www.jupiterone.com/legal-and-security-hub). For privacy questions, contact [privacy@jupiterone.com](mailto:privacy@jupiterone.com).

### Access Control & Security Enforcement

Data access through the MCP Server is governed entirely by the credentials you provide. The local server inherits all access controls from the user role attached to the API key; the remote server inherits them from the OAuth-authenticated user. AI assistants can only retrieve what your account has permission to access. You can further restrict access by scoping the API key, adjusting user roles, or disabling individual MCP tools. You retain full control over when the server runs and what it can access — turning off the server or removing its configuration from your assistant completely disables AI access.

### Rate Limits & Quotas

Every request made through the MCP Server counts against your JupiterOne API rate limit. This includes queries for asset data, alerts, dashboards, or integrations. Frequent use through an AI assistant could impact your rate quota if not monitored. We recommend reviewing your API usage regularly—especially when enabling assistants for broad or high-frequency queries—to avoid service slowdowns.

### Deployment, Support & Customer Control

The JupiterOne MCP Server can be deployed either locally on your machine or accessed through JupiterOne's hosted remote server. The local server runs entirely in your environment with no persistent connections; the remote server connects securely through OAuth authentication and is hosted in the same region as your account. You can disable either at any time by stopping the local process or removing your AI assistant's MCP configuration. For assistance or onboarding, reach out to your CSM or email [support@jupiterone.com](mailto:support@jupiterone.com).

## Release notes

-   [What's new in MCP 2.0](/integrations/mcp-2-0.md) — the 2026-07-28 protocol revision, a cacheable tool list, accurate query result schemas, and the Node.js 20 requirement for the local server
-   [What's new in MCP 1.0](/integrations/mcp-1-0.md) — the first generally available release: 24 tools, hardened OAuth on the remote server, structured output, and the 1.x point releases that took it to 28 tools

## Support

For technical support or questions, email [support@jupiterone.com](mailto:support@jupiterone.com). Existing customers can also reach their Customer Success Manager or use their standard JupiterOne support channels.

---

Source: /integrations/mcp-1-0

# MCP 1.0 Release Notes

**Release date: June 2026**

MCP 1.0 is the first generally available release of the JupiterOne MCP Server. It turns JupiterOne into something your AI assistant can operate directly: ask a question in plain language and the assistant picks the right tool, writes the [J1QL](/j1ql.md) when a query is needed, and works with your graph, alerts, rules, dashboards, and integrations on your behalf.

The 0.x previews proved the idea. 1.0 is the release that makes it safe to hand to a security team — every tool declares what it does and what it returns, failures explain themselves instead of surfacing raw API errors, and the hosted remote server runs a fully hardened OAuth 2.1 flow with a consent screen you see before anything is granted.

## What is new in MCP 1.0

| Feature | What it means for you |
| --- | --- |
| **24 tools across six domains** | Query execution, alert monitoring, rules management, dashboard management, integration monitoring, and account discovery — all reachable in natural language |
| **Hardened OAuth for the remote server** | Per-client registration, enforced PKCE, exact-match redirect validation, and a JupiterOne-branded consent screen that tells you what a connector is asking for before you approve it |
| **Multi-account access** | `list-accounts` shows every JupiterOne account your sign-in can reach, with the connector URL for each one |
| **Structured output** | Every tool publishes a schema for what it returns, so assistants read results reliably instead of re-parsing prose |
| **Tool annotations** | Read, write, and destructive tools are labelled, so your MCP client can ask for approval before anything changes |
| **Honest failure messages** | Permission and authentication problems come back as "access denied, here is what to do" rather than an opaque error, with credentials and internal detail stripped out |
| **Working deep links** | Results link back to the right place in the JupiterOne app, so you can open a rule, query, or dashboard the assistant just referenced |
| **Listed in the Claude connector directory** | One-click install from [claude.ai/directory/jupiterone](https://claude.ai/directory/jupiterone), plus the protocol-level self-description — name, icon, readable tool titles — that the listing required |

## 24 tools across six domains

MCP 1.0 ships 24 tools. Your assistant chooses among them automatically — you ask a question, it decides whether that means running a query, listing rules, or checking an integration job.

| Domain | Tools |
| --- | --- |
| Query execution | `execute-j1ql-query` |
| Alert monitoring | `get-active-alerts` |
| Rules management | `list-rules`, `get-rule-details`, `create-inline-question-rule`, `update-inline-question-rule`, `evaluate-rule`, `list-rule-evaluations`, `get-rule-evaluation-details`, `get-rule-evaluation-query-results`, `get-raw-data-download-url` |
| Dashboard management | `get-dashboards`, `get-dashboard-details`, `create-dashboard`, `create-dashboard-widget`, `update-dashboard` |
| Integration monitoring | `get-integration-definitions`, `get-integration-instances`, `get-integration-jobs`, `get-integration-job`, `get-integration-events` |
| Account | `test-connection`, `list-accounts`, `list-entity-types` |

Query results support cursor-based pagination, and integration listings now return a reliable stop signal, so an assistant paging through a large result set knows when it has reached the end instead of looping.

> **NOTE**
> 
> The 1.x line grew this to 28 tools. See [The 1.x point releases](#the-1x-point-releases) below.

## Hardened OAuth for the remote server

The hosted remote server — the option most customers use, connected from claude.ai, Claude Desktop, Cursor, and other MCP clients — received a full authorization rework for 1.0.

-   **Per-client registration.** Each connector that registers gets its own client identity with its own persisted redirect URIs, rather than sharing one. Registrations expire after 90 days; an active connector re-registers transparently, so you never notice.
-   **Exact-match redirect validation.** A connector can only be sent back to a redirect URI it registered, matched exactly. Prefix and wildcard matches are rejected.
-   **PKCE enforced.** Proof Key for Code Exchange is required at both the authorization and token steps, so an intercepted authorization code is useless on its own.
-   **Authorization code flow only.** `/authorize` accepts nothing else.
-   **A consent screen you actually read.** Before you are handed to sign-in, a JupiterOne-branded interstitial names the connector requesting access, summarises the permissions it will receive, and links to the relevant policies. Nothing is granted until you approve it there.
-   **Sanitized errors.** OAuth failures return standards-compliant error codes without leaking secrets or internal detail, and secrets are never written to logs.

Your existing permissions still govern everything: the remote server acts as the signed-in user, and the local server acts as the owner of the API key you configure. MCP grants no access your account does not already have.

### Session expiry your client can act on

When a token expires, the remote server now returns a standards-compliant `401` with a `WWW-Authenticate` challenge that distinguishes **expired** (your client should refresh silently) from **invalid** (you need to re-authorize), and points at the protected-resource metadata document so the client knows where to go. In practice this means an expiring session refreshes in the background instead of leaving a connector that appears connected but answers nothing.

Requests are also bounded. A connector that disconnects mid-call, or a call that exceeds the server's deadline, is cleanly aborted rather than left hanging — so a stuck request returns an error your assistant can act on instead of stalling the conversation.

## Listed in the Claude connector directory

JupiterOne is published in the Claude connector directory at **[claude.ai/directory/jupiterone](https://claude.ai/directory/jupiterone)**. For Claude users this is the shortest path in: click **Connect**, choose your region, sign in — no JSON to edit and no URL to construct. The directory connector runs on the hosted remote server, so it stays on the current release automatically.

Getting listed was a real part of 1.0. Directory review checks how a server describes _itself_ over the protocol, not just that its tools work, so the release added:

-   **Server identity.** The server advertises the title `JupiterOne`, its website, and the JupiterOne mark as an icon. The icon travels over the protocol as a data URI rather than a hosted asset, so it resolves identically for the remote and local servers with nothing to fetch.
-   **Readable tool titles.** Every tool carries a human-readable title alongside its machine name, so clients can show _Execute J1QL Query_ rather than `execute-j1ql-query`.
-   **Fully typed parameters.** Every tool parameter declares a schema type — a directory requirement, and a correctness win for any assistant reasoning about what to pass.
-   **Behaviour annotations on every tool.** `readOnlyHint` and `destructiveHint` are required for listing, which is what lets a client tell a read from a write _before_ running it.

## Multi-account access

If your sign-in can reach more than one JupiterOne account, `list-accounts` returns all of them — resolved from your verified token, not guessed — along with the connector URL for each. When a tool call is rejected because it targeted an account you are not a member of, the error names the accounts you _can_ reach and gives you their URLs, so you can repoint the connector instead of retrying a sign-in that will never help.

## Structured output and tool annotations

Every tool declares an output schema and returns structured content alongside its human-readable text. Assistants read the structured form directly rather than re-parsing prose, which makes chained work — query, then build a widget from the result — far more reliable.

Tools are also annotated with their behaviour. Read-only tools are marked read-only; tools that create, change, or delete are marked accordingly. MCP clients use these hints to decide when to pause and ask you for approval, so a dashboard is never modified without your say-so.

## Honest failures

Two changes make failures useful rather than alarming:

-   **Access denied means access denied.** Upstream 401 and 403 responses are reframed as an access-denied result explaining which permission is missing and what to do about it. Previously these surfaced as raw errors that assistants tended to answer by looping on re-authentication. (1.1.0 extended this to the authorization failures JupiterOne's API delivers inside a 200 response, which had been slipping through as apparent success.)
-   **Errors are sanitized.** Error text never carries credentials, tokens, or internal request detail.

Recovery guidance stays inside the assistant's reach: narrow the query, aggregate, paginate, or re-check permissions. You are never told to go do it in the UI instead.

## Privacy and telemetry

The remote server records sanitized operational telemetry — which tool ran, whether it succeeded, how long it took — with query content redacted. Query results, query parameters, and action payloads are never stored. **The local server sends nothing to JupiterOne**; its telemetry stays on your own machine.

For the full data-handling position, see the [FAQ on the MCP Server overview page](/integrations/jupiterone-mcp-server.md#faq).

## The 1.x point releases

Six point releases followed 1.0 through July 2026, adding four tools and closing the gaps that showed up in real use.

| Version | Released | Highlights |
| --- | --- | --- |
| **1.0.1** | July 2026 | Dashboard tool hardening, tolerant query output schema with an explicit `hasMore` signal, corrected layout and pagination guidance |
| **1.1.0** | July 2026 | Dashboard CRUD completed — `update-dashboard-widget`, `delete-dashboard`, `delete-dashboard-widget` — plus automatic dashboard layout and access-denied framing for authorization failures returned as HTTP 200 |
| **1.1.1** | July 2026 | Rewritten J1QL error messages for the mistakes assistants actually make |
| **1.2.0** | July 2026 | Instant J1QL syntax validation using the platform's own parser |
| **1.3.0** | July 2026 | Resumable long-running queries via `get-query-results` |
| **1.4.0** | July 2026 | `test-connection` reports who you are and what you can do |

### Dashboard CRUD (1.1.0)

1.0 could create dashboards and widgets but not fully manage them. 1.1.0 closed the loop with `update-dashboard-widget`, `delete-dashboard`, and `delete-dashboard-widget`, taking the tool count to 27. `update-dashboard` also gained automatic layout: ask for a dashboard and the widgets are placed sensibly instead of stacking on top of each other.

Delete operations are annotated as destructive, so your client prompts before running them.

### Instant J1QL validation (1.2.0)

The MCP Server now bundles the same query-language parser the JupiterOne query service runs, and validates every query locally before sending it. A syntax error comes back immediately with the specific problem and a suggested fix — no round-trip, no waiting on a query that was never going to run. Because it is the platform's own grammar, what the server accepts locally matches what the backend accepts.

`LIMIT` is pre-checked against its real 1–250 range, with the corrected approach (page with the cursor, or use `count()` for totals) supplied in the error.

> **NOTE**
> 
> The bundled grammar is frozen when the package is published, so a much older local install could in principle reject syntax a newer query service accepts. Setting `JUPITERONE_SKIP_QUERY_VALIDATION=1` in your MCP client config bypasses the local check entirely; the backend still validates every query. Upgrading the package is the better fix.

Query timeout guidance was rewritten in the same release to preserve what you were actually asking for — suggesting indexed filters and tighter traversals rather than telling the assistant to ask a smaller question.

### Resumable long-running queries (1.3.0)

Heavy graph traversals can outlive a single tool call. Instead of failing, `execute-j1ql-query` now returns `status: "IN_PROGRESS"` with a `resultsUrl` handle, and the new `get-query-results` tool picks the query back up.

-   The query keeps running server-side, and its results stay retrievable for about an hour.
-   Each `get-query-results` call waits up to 40 seconds, and reports elapsed time so the assistant can judge whether to keep waiting.
-   Most queries that succeed finish within about four minutes; past roughly 13 minutes a query will not complete, and the guidance says so plainly rather than leaving the assistant to poll forever.

Your assistant does not have to sit and wait — it can do other work between checks. This brought the tool count to 28.

### Connection and permission visibility (1.4.0)

`test-connection` now answers three questions instead of one:

-   **Am I connected?** As before.
-   **Who am I?** The email your token resolves to — decisive when it is not clear which sign-in a connector is using.
-   **What am I allowed to do?** A per-area create/read/update/delete summary covering dashboards, rules, and integrations, plus a `hasBroadAccess` flag for full account admins.

Assistants use this to check before acting: if you lack dashboard-create permission, you get told that, instead of watching a create attempt fail. When a connection is pinned to one account and that account is inaccessible, the guidance names the binding and lists the accounts you _can_ reach — so you fix the connector rather than re-authenticating in a loop.

## Getting started

**If you already use the MCP Server:**

-   **Remote server** — nothing to do. The hosted server always runs the current release.
-   **Local server** — `npx @jupiterone/jupiterone-mcp` picks up the latest version on each run. If you installed globally, run `npm install -g @jupiterone/jupiterone-mcp` to update.

**If you are new to the MCP Server:**

1.  **Using Claude?** Install straight from [claude.ai/directory/jupiterone](https://claude.ai/directory/jupiterone). For any other assistant, follow the setup on the [MCP Server overview page](/integrations/jupiterone-mcp-server.md) — the remote server is recommended and requires no local install.
2.  Ask your assistant _"test my JupiterOne connection"_ to confirm it is connected and see what your sign-in can do.
3.  Try _"List my JupiterOne integrations"_ or one of the [prompt templates](/integrations/jupiterone-mcp-server.md#prompt-templates-by-use-case) to see the tools in action.

For the full setup guide, tool reference, and FAQ, see [JupiterOne AI Integration (MCP Server)](/integrations/jupiterone-mcp-server.md). For what came next, see [What's new in MCP 2.0](/integrations/mcp-2-0.md).

---

Source: /integrations/mcp-2-0

# MCP 2.0 Release Notes

**Release date: July 2026**

MCP 2.0 brings the JupiterOne MCP Server onto the **2026-07-28 revision of the Model Context Protocol** — and onto version 2 of the official MCP TypeScript SDK — without breaking a single existing client.

This is a compatibility and correctness release, not a feature release. The tool surface was unchanged from 1.4.0: the same 28 tools, the same names, the same parameters. (2.1.0 later added a 29th — see [The 2.x point releases](#the-2x-point-releases).) What changes is how well the server describes itself to the client on the other side, and which clients can talk to it at all. Newer clients get the current protocol with cache hints and honest result schemas. Older clients get exactly the wire they got before.

> **INFO**
> 
> **Remote server users: no.** The hosted server always runs the current release, and both protocol eras are served from the same URL.
> 
> **Local server users: check your Node version.** MCP 2.0 requires **Node.js 20 or later**, up from 18. This is the only breaking change in the release. See [Upgrading the local server](#upgrading-the-local-server).

## What is new in MCP 2.0

| Feature | What it means for you |
| --- | --- |
| **2026-07-28 protocol support** | The server speaks the current MCP revision to clients that ask for it, so newer assistants get the newer capabilities |
| **Both protocol eras, one endpoint** | Older clients are served exactly as before on the same URL — nothing to reconfigure, nothing to migrate |
| **Cacheable tool list** | Clients can cache the tool list for an hour instead of re-fetching it on every connection, cutting startup overhead |
| **Accurate query result schema** | `execute-j1ql-query` and `get-query-results` now advertise their real two-shape contract — completed results _or_ an in-progress handle — instead of a lowest-common-denominator approximation |
| **RFC 9207 authorization responses** | The remote server returns its issuer identifier on authorization responses, so clients can verify which server answered — a defence against mix-up attacks |
| **Client identity in diagnostics** | Support can see which client and version made a call, which makes client-specific problems far faster to diagnose |
| **Node.js 20 floor** _(breaking, local only)_ | The local server now requires Node 20 or later |
| **Open output schemas** _(2.0.2)_ | Strict-validating MCP clients no longer reject responses from `get-rule-details`, `get-dashboard-details`, and 22 other tools |

## Both protocol eras from one endpoint

MCP is a versioned protocol, and the 2026-07-28 revision changed how a connection is opened. Rather than force every client to move at once — or run a second endpoint — the server decides per connection:

-   A client opening with the **2026-07-28** handshake gets the modern protocol, including the cache hints and schema improvements below.
-   A client opening with the **legacy** handshake gets byte-for-byte the wire it got from MCP 1.x.

This holds for both deployment modes: the hosted remote server and the local stdio server. There is no configuration, no separate URL, and no migration step. If your assistant worked against MCP 1.x, it works against 2.0 unchanged.

This is not a theoretical concern. Claude — including the [connector directory listing](https://claude.ai/directory/jupiterone) — and ChatGPT both still open connections on the 2025-era handshake. Serving both eras is what let us adopt the new protocol revision without waiting on those clients or breaking the directory connector that most customers install through.

## Cacheable tool list

The server now tells 2026-era clients that its tool list is cacheable for an hour, so a client does not need to re-enumerate 28 tools on every connection. The hint is marked private to the connection, because the list genuinely differs between a multi-tenant connection and one pinned to a single account — a shared cache would serve the wrong list.

Legacy clients are unaffected: the hint is only emitted on 2026-era responses.

## An accurate schema for query results

Since [MCP 1.3.0](/integrations/mcp-1-0.md#resumable-long-running-queries-130), `execute-j1ql-query` can return one of two genuinely different things: a completed result envelope, or an in-progress handle with a `resultsUrl` to resume from. The older protocol could only describe a single object shape, so the server advertised every field as optional — technically permissive, but it told clients almost nothing.

2.0 advertises the real contract: a union of the two shapes, with the in-progress handle strictly typed so `status` and `resultsUrl` are required and a malformed handle cannot pass as a result set. Assistants get an accurate picture of what to expect, and can branch on it properly rather than guessing.

Clients that only understand a single object shape at the root keep working — the schema still presents as an object there.

## RFC 9207 authorization responses

The remote server now includes its issuer identifier (`iss`) on authorization responses, per [RFC 9207](https://www.rfc-editor.org/rfc/rfc9207.html). This lets a client confirm that the response it received came from the authorization server it actually started the flow with, closing off a class of mix-up attack in which a malicious server tries to have a code redeemed at the wrong place.

This is transparent — no connector reconfiguration, no change to how you sign in. It layers on top of the per-client registration, PKCE enforcement, and exact-match redirect validation delivered in [MCP 1.0](/integrations/mcp-1-0.md#hardened-oauth-for-the-remote-server).

## Client identity in diagnostics

Operational telemetry now records the client name, client version, user agent, and protocol version that made each call, alongside the tool name and outcome already captured. Query content stays redacted, and results, parameters, and action payloads are still never stored.

The practical benefit is support turnaround. Client-specific problems — a particular IDE mishandling a response, one client version failing where another succeeds — used to be invisible; they are now identifiable from the first report.

## Upgrading the local server

**MCP 2.0 requires Node.js 20 or later.** This comes from the MCP SDK v2 requirement and is the release's only breaking change. It applies **only to the local (stdio) server** — remote server users are unaffected, since the runtime is ours.

Check your version in the same shell your AI client uses:

```bash
node --version
```

If it reports v18 or lower, install Node 20 or later, then restart your AI client. Note that on macOS, GUI applications do not always inherit your shell's `PATH` — if your client still fails after upgrading, point it at an absolute path to `npx` (find it with `which npx`).

If you run the local server with `npx @jupiterone/jupiterone-mcp`, you pick up the latest version automatically on each run. For a global install, update it with:

```bash
npm install -g @jupiterone/jupiterone-mcp
```

## The 2.x point releases

| Version | Released | Highlights |
| --- | --- | --- |
| **2.0.1** | August 2026 | Updated the bundled J1QL parser, so local syntax validation matches the current query service grammar |
| **2.0.2** | August 2026 | Opened tool output schemas so strict-validating clients accept real responses |
| **2.1.0** | August 2026 | Added `delete-rule`, taking the tool count to 29 |

### Opened output schemas (2.0.2)

Most tools return more data than their published schema documents — `get-rule-details` documents 8 fields and returns 28; `get-dashboard-details` documents 5 and returns 19. The published schemas nevertheless declared themselves _closed_, meaning no additional fields allowed. The two statements contradicted each other.

Clients that ignore the advertised schema never noticed. Clients that **validate** structured output against it — including Amazon Kiro and anything built on the official MCP client SDK — rejected the response outright with an "additional properties" error, making those tools unusable on those clients.

2.0.2 opens the schemas across all 24 affected tools, so the documented fields remain the contract while the full payload passes validation. Nothing about the data returned changed; only the schema that describes it. A regression test now asserts that no tool advertises a closed shape anywhere in its output schema.

This was never a 2.0 regression — the schemas had been closed since structured output shipped in [MCP 1.0](/integrations/mcp-1-0.md#structured-output-and-tool-annotations). If a strict-validating client rejected JupiterOne tool responses for you before August 2026, 2.0.2 fixes it.

### Rule deletion (2.1.0)

`delete-rule` closes the last gap in rule management. Until 2.1.0 an assistant could create and update rules but never remove one, so a rule created with a name or tag that collided with an existing one left no way to clean up — by far the most common failure in rule creation.

The tool is annotated as destructive, so your MCP client prompts before it runs. Two things to know:

-   **It is irreversible.** The rule's configuration cannot be recovered.
-   **It does not dismiss alerts the rule already raised.** Those stay active. If you want a rule to stop firing but keep its configuration and evaluation history, ask for its polling interval to be set to `DISABLED` instead — that is a reversible change, and deletion is not.

## Getting started

**Remote server:** nothing to do. Your connector already runs 2.0 — including the connector installed from [claude.ai/directory/jupiterone](https://claude.ai/directory/jupiterone).

**Local server:** confirm Node 20 or later, then restart your AI client. `npx` picks up the new version automatically.

**Verify the upgrade.** Ask your assistant:

> "Test my JupiterOne connection"

`test-connection` reports the package version alongside your identity and permissions, so you can confirm which release you are on.

For the full setup guide, tool reference, and FAQ, see [JupiterOne AI Integration (MCP Server)](/integrations/jupiterone-mcp-server.md). For the 1.x line, see [What's new in MCP 1.0](/integrations/mcp-1-0.md).

---

Source: /integrations/outbound-directory/jira

# Jira

# Setup Guide

## Overview

The application facilitates seamless integration with JupiterOne and Jira, enhancing the ability to manage and respond to cybersecurity alerts. This integration empowers users to automatically generate Jira tickets from JupiterOne alerts and create alerts within the system, ensuring that critical vulnerabilities are promptly addressed. The application fetches data from JupiterOne, maps fields to Jira issues, and allows for customization of these mappings. With automated alert creation, ticket generation, and updates, the application streamlines workflows and improves the efficiency of incident response processes. The user-friendly setup and real-time synchronization between JupiterOne and Jira ensure that cybersecurity efforts are both comprehensive and up-to-date, ultimately strengthening your organization’s security posture.

## Prerequisites

Ensure the JupiterOne account must have the following permissions:

-   **Full Admin Privileges**
-   **API Key Management (Read and Write)**
-   **Alerts (Read and Write)**

Ensure the Jira account must have the following permission:

-   **Admin Privileges**

## Configuration in JupiterOne

### Generating JupiterOne API Token

1.  **Log in** to the JupiterOne portal using your Administrator privileges.
2.  Go to **Settings > API Tokens**
3.  Click on **New Token**
4.  Provide the following details
    -   **Token Name** Assign a name to the token.
    -   **Days before Expiration** Set the token's expiry date.
5.  Copy the **API Token** and save it securely as it can only be viewed once.

### Get JupiterOne Account ID

1.  **Log in** to the JupiterOne portal using your Administrator privileges.
2.  Go to **Settings > Account Management**
3.  Copy the **Account ID**

## Configuration in Jira

Before beginning the configuration, ensure that you have a JIRA project created

1.  Go to your project and click on the **Project Settings**. Navigate to Issues, open any issue type, click on **Go to Custom fields** at bottom right, and click on the **Create Custom Field** button
    
    ![Create Custom Field](/assets/images/jira_custom_field-7d42735b6891b7fd0410f1ba26123cd7.png)
    
2.  Select required field type
    
    -   To map specific field types, create custom fields in Jira as follows:
        -   **Number Field:** For mapping number-type fields.
        -   **Labels:** For mapping array-type fields.
        -   **Datetime Picker:** For mapping datetime-type fields.
    
    ![Jira Custom Fields](/assets/images/jira_custom_field_types-8d78bb8946fbcd7563a40b103dbfd9fd.png)
    
3.  Enter the field name, description and click on the **Create** button.
    
    ![Create](/assets/images/jira_create_field-086b987e1902769efbbb49545d62f036.png)
    
4.  Go to your project and click on the **Project Settings**
    
    ![Project Settings](/assets/images/jira_project_settings-cfba784fc23ca8627b5a321608d22277.png)
    
5.  Go to Issue Types, select an issue, and search for the required custom fields
    
    ![Select](/assets/images/jira_custom_fields_addition-836f321072491fb5b9ba57f3c3135f97.png)
    
6.  The custom fields will be visible under the Description fields tab. Once you have added all the custom fields, click on the **Save changes** button.
    
    ![Save Changes](/assets/images/jira_custom_fields_save-d4a20b668b636fabb873a29eebe752ab.png)
    

## Using the Application

The integration enables you to use the following functionalities within the JIRA dashboard

-   You can create JupiterOne alerts.
-   You can map JIRA fields with JupiterOne fields to create Issues for vulnerabilities.

### Creating Alerts

1.  Go to your project > Project Settings > Apps and select the **JupiterOne-Jira Integration Application**
    
    ![Application](/assets/images/jira_app_navigation-8f2d36f58df39445526a31892a5348b7.png)
    
2.  Go to the JupiterOne Configuration tab.
    
3.  The application will prompt you to enter the following details
    
    -   **JupiterOne account ID**
    -   **JupiterOne API Key**
    -   **JupiterOne instance region**
    -   **Name of the Alert**
    -   **Alert query**
    -   **Evaluation Interval**
4.  After entering the details, click on the **test connection** button. This will authenticate your credentials and create the alert. After successful authentication and alert creation, **Status** will be shown
    
    ![Status](/assets/images/jira_jupiterone_alert_creation-7505ceee57ef79e155190b8576ffa3c7.png)
    

### Mapping JIRA fields with JupiterOne fields

1.  Go to the **JIRA ticketing configuration** tab
    
2.  Select Issue type
    
3.  Select the JIRA field and JupiterOne field that you want to map and click on the **Add Mapping** button
    
    -   **Summary** and **Description** JIRA fields are required to be mapped.
    -   **Boolean** or **DateTime** fields coming from JupiterOne cannot be selected as Primary Key
    
    ![Add Mapping](/assets/images/jira_jupiterone_field_mapping-52632c626ab6c41ed2d3647c63a951f0.png)
    
4.  Your mappings will be shown under the **JupiterOne to Jira Fields Mapping** table. You can remove a mapping by clicking on the **Remove** button under **Actions**.
    
5.  Click on the **lock icon** next to the mapping you want to select as the **primary key**.
    
    ![Primary Key](/assets/images/jira_jupiterone_primary_key-b1036b85c9d103ab685e8932716aed36.png)
    
6.  After adding the mappings, click on the **Save Mappings** button to save the mappings. Upon successful completion, a status box indicating “Mappings saved successfully” will be shown
    
    ![Save Mapping](/assets/images/jira_jupiterone_save_mappings-c90c15ff50fa43e77ad14caf1589dcab.png)
    

### Updating Alerts

1.  Go to the JupiterOne Configuration tab.
    
2.  The application will prompt you with the configured page where JupiterOne account ID, JupiterOne API Key, the JupiterOne instance region fields and Test connection button will be disabled.
    
3.  Modify Alert Name, alert query, and the evaluation interval of the alert as per requirement.
    
4.  After entering the data, click on the **Update Alert** button. This will authenticate your credentials and update the alert. After successful authentication and alert creation, Status will be shown
    
    ![Update Alert](/assets/images/jira_jupiterone_alert_updation-15028c9aee1f57f4019ee27fee784a6f.png)
    

##### Note:

After Alert Updation, the fields of JupiterOne Fields dropdown will also be updated according to the change in query and mappings can be done accordingly

### Deleting Alerts

1.  Go to the JupiterOne Configuration tab.
    
2.  The application will prompt you with the configured page where JupiterOne account ID, JupiterOne API Key, the JupiterOne instance region fields and Test connection button will be disabled.
    
3.  Click on the **Delete Alert** button. This will authenticate your credentials and update the alert. After successful authentication and alert creation, Status will be shown
    
    ![Delete Alert](/assets/images/jira_jupiterone_alert_deletion-bf39b961b94b192f250bbe8cbee2c705.png)
    

## Limitations

### Duplicate issues

In Jira duplication of issues arises when the primary key value of the data is empty or the string acting as primary key has some special characters.

-   The supported special characters are @, #, $, %, &, and -

### Numeric data

When few math operations are used on return properties of custom query Numeric data may come as undefined.

-   Supported Math Operations for custom query are +, -, \*. Math Operations can be used as mentioned in the below example.
    
    > FIND jupiterone\_compliance\_gap with totalNumberOfAffectedEntities > 1 as i return i.displayName, i.description, i.ref, **i.totalNumberOfAffectedEntities+5**, i.framework
    
-   For other Math operations alias should be used as mentioned in the below example
    
    > FIND jupiterone\_compliance\_gap with totalNumberOfAffectedEntities > 1 as i return i.displayName, i.description, i.ref, **i.totalNumberOfAffectedEntities/5 as gapAffected**, i.framework
    

## Troubleshooting

This section aims to guide users about the possible problems they might encounter while using the app. Please follow the instructions if you come across any of the following scenarios

### Alert creation failure

2.  The alert name should be unique.
3.  Make sure your account has the required permissions to create alerts.

### JIRA field names not visible

If the JIRA field names are not appearing in the "Choose a JIRA Ticket Field" dropdown, please refresh the page.

## Debugging

If you encounter issues while using the app, you can use your browser's developer console to help diagnose problems. Follow these steps:

-   Open the Browser Console:
-   Press F12 or Ctrl+Shift+I (Windows/Linux) or Cmd+Option+I (Mac) to open the developer tools.
-   Navigate to the "Console" tab to view logs, errors, and warnings.

## Conclusion

In conclusion, this document has provided a detailed guide to using the JupiterOne and Jira integration app. By integrating these platforms, users can enhance their workflow efficiency and vulnerability management capabilities. The app facilitates the automatic creation of alerts and seamless synchronization of vulnerability data, ensuring that critical issues are tracked and resolved in Jira. Additionally, users can leverage this integration to gain real-time insights and maintain a comprehensive view of their security posture within the Jira environment.

# Privacy Policy

**Updated: January 2025**

JupiterOne ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, products, or services.

## Information We Collect

When you interact with our services, we may collect various types of personal data, including but not limited to:

### Account Information

We may collect JupiterOne Account identifiable information, such as your Account ID, Region, and API key of the account. We may keep a record of your communications with us and other information you share during the course of the communications.

### Usage Data

We may collect information about how you interact with JupiterOne's website, products, or services.

## Purpose of Processing

We may use your information for the following purposes:

-   **Personalize User Experience**: To personalize user experience and provide requested services.
-   **Service Provision**: To provide and maintain our services, process transactions, and fulfill your requests.
-   **Analytics**: To analyze user behavior, improve our offerings, and enhance the user experience. To enhance existing user profiles, verify and update information, and enrich the understanding of user preferences and behaviors.
-   **Security**: To protect against unauthorized access, detect and prevent fraudulent activities.

We process your Account data based on one or more of the following legal grounds:

-   **Consent**: When you provide explicit consent for specific processing activities, such as opting out of our marketing communications.
-   **Contractual Necessity**: When processing is necessary for the performance of a contract with you.
-   **Legal Obligations**: When processing is required to comply with legal obligations.
-   **Legitimate Interests**: When processing is based on our legitimate interests and does not override your rights and freedoms.
-   **Other Purposes**: We will process your personal information for other purposes about which we notify you in advance, or for which we receive your consent. In general, we collect and process personal information about you as necessary to provide the products you use, operate our sites and business, meet our contractual and legal obligations, protect the security of our systems and our customers, or fulfill other legitimate interests as described in this Privacy Policy and in our notices to you.

## Information Sharing

We do not sell, trade, or rent your personal information to third parties. However, we may share your information with trusted third parties who assist us in operating our website, conducting our business, or servicing you.

## Cookies and Similar Technologies

We may use cookies and similar technologies to collect information and enhance your experience.

## Security

We implement reasonable security measures to protect your information from unauthorized access, disclosure, alteration, or destruction.

## Changes to This Privacy Policy

We may modify or update this Privacy Policy from time to time to reflect changes in our business and practices. Please review this page periodically. Any changes to this Privacy Policy will be indicated by updating the 'Last Updated' date above. For significant modifications, we will provide additional notice or obtain consent as required by applicable law.

## Contact Us

If you have questions about this Privacy Policy, please contact us at [privacy@jupiterone.com](mailto:privacy@jupiterone.com).

# Terms and Conditions

**Effective Date: 13/01/2025**

These Customer Terms of Service (“Terms”) govern the use of the JupiterOne Jira Integration application ("App") provided by JupiterOne ("we", "our", or "us") on the Atlassian Marketplace for integration with Jira. By installing, accessing, or using the App, you agree to be bound by these Terms. If you do not agree to these Terms, you may not use the App.

## 1\. License Grant

### 1.1 License

We grant you a non-exclusive, non-transferable, revocable license to install and use the App solely for internal business purposes within your organization, subject to the terms of this agreement.

### 1.2 Usage Restrictions

You shall not:

-   Sublicense, lease, distribute, transfer, or assign the App.
-   Reverse-engineer, decompile, or disassemble the App.
-   Use the App in any manner that violates applicable laws or regulations.

## 2\. Pricing and Payments

### 2.1 Pricing

The pricing for the App is as stated on the Atlassian Marketplace listing. Pricing may vary depending on the number of users or features selected.

### 2.2 Payment

Payments for the App are processed via the Atlassian Marketplace, and you agree to pay the applicable subscription fees in accordance with Atlassian’s payment terms.

### 2.3 Subscription Term and Renewal

Subscriptions may be charged on a monthly or annual basis, as selected at the time of purchase. Subscriptions automatically renew unless canceled prior to the renewal date.

### 2.4 Refund Policy

Unless required by law, we do not offer refunds for subscription fees, except in cases where the App is found to be non-functional or fails to meet the agreed-upon specifications.

## 3\. Trial Period

### 3.1 Trial Period

If a trial period is offered, you may use the App free of charge for the trial duration specified in the Marketplace listing. After the trial period ends, you will be charged according to the pricing plan selected unless you cancel the subscription before the trial expires.

## 4\. Support and Maintenance

### 4.1 Support

We provide support for the App as specified in the Atlassian Marketplace listing. Support requests can be made by sending an email to [support@jupiterone.com](mailto:support@jupiterone.com), and we will respond to such requests within a reasonable timeframe.

### 4.2 Updates

We may provide updates, bug fixes, or new versions of the App. You are responsible for keeping the App up to date, and updates will be made available to you as part of your subscription.

## 5\. Data Privacy and Security

### 5.1 Data Collection

The App may collect certain data, including but not limited to usage statistics, error logs, and other information necessary for support and improvement purposes. We will handle all customer data in accordance with our Privacy Policy.

### 5.2 Data Security

We implement reasonable security measures to protect your data. However, we do not guarantee that your data will be completely secure.

### 5.3 Data Usage

We will not sell or rent your personal data to third parties. We may use aggregated, non-personally identifiable data to improve the App and provide better services.

## 6\. Intellectual Property

### 6.1 Ownership

We retain all rights, titles, and interest in and to the App, including all intellectual property rights. You do not acquire any ownership rights in the App, other than the limited rights expressly granted in these Terms.

### 6.2 User Content

You retain ownership of any content you input into the App but grant us a license to use such content to provide the services described in these Terms.

## 7\. Termination

### 7.1 Termination by You

You may terminate your subscription at any time by canceling through the Atlassian Marketplace. Your access to the App will continue until the end of your current billing cycle.

### 7.2 Termination by Us

We may terminate or suspend your access to the App at any time if you breach these Terms, fail to make payment, or otherwise engage in conduct that we deem inappropriate.

### 7.3 Effect of Termination

Upon termination of this agreement, you must cease using the App and remove it from your Jira instance. Any fees paid up to the date of termination are non-refundable.

## 8\. Limitation of Liability

### 8.1 No Warranty

The App is provided "as-is" without warranty of any kind, either express or implied, including but not limited to implied warranties of merchantability or fitness for a particular purpose.

### 8.2 Limitation of Liability

To the maximum extent permitted by law, we are not liable for any indirect, incidental, special, consequential, or punitive damages, or loss of profits, data, or goodwill, arising from or related to your use of the App.

## 9\. Governing Law and Dispute Resolution

### 9.1 Governing Law

These Terms shall be governed by and construed in accordance with the laws of \[Your Jurisdiction\].

### 9.2 Dispute Resolution

Any disputes arising out of or in connection with these Terms shall be resolved through \[arbitration/mediation\] in \[Location\], in accordance with the rules of \[Arbitration Organization\].

## 10\. Changes to These Terms

### 10.1 Amendments

We may update these Terms from time to time by posting a new version on the Atlassian Marketplace. You will be notified of significant changes through the App or via email.

### 10.2 Effective Date

Any updates to these Terms will become effective on the date they are posted.

## 11\. Miscellaneous

### 11.1 Entire Agreement

These Terms constitute the entire agreement between you and us with respect to the App and supersede all prior agreements, whether written or oral.

### 11.2 Severability

If any provision of these Terms is found to be unenforceable, the remaining provisions shall remain in full effect.

# Security and Compliance Policy

**Updated: January 2025**

## Overview

This document outlines the security and compliance policies for the JupiterOne-Jira Integration Application, ensuring that all customer data and system operations are protected and meet standard compliance requirements.

## Security Governance

We maintain a robust security governance framework that includes regular risk assessments, monitoring, and continuous improvement efforts to mitigate threats to the JupiterOne-Jira Integration Application.

## Access Control

-   **User Authentication**: Access to the Jira JupiterOne Application is done via the JIRA Authentication.
-   **Role-Based Access Control (RBAC)**: All users with Jira admin access to the project are granted access to the application based on their roles.
-   **Session Management**: By default, session timeout is the same as Jira session timeout

## Data Protection

-   **Data Encryption**: All sensitive data is encrypted using in-built methods of [JIRA Storage](https://developer.atlassian.com/platform/forge/runtime-reference/storage-api-secret/)
-   **Data Minimization**: We adhere to the data minimization principle, collecting only the necessary information required for Jira integration and compliance monitoring.
-   **Backup and Recovery**: Customers are responsible for backing up state data on the JupiterOne-Jira Integration Application Platform. The Application provides a reflection of Customer Data from Jupiterone and should not serve as the system of record for any novel Customer Data.

## Continuous Improvement

We are committed to continuous improvement and the adaptation of new security measures in line with evolving industry best practices. Periodic security reviews and internal audits are conducted to ensure compliance with current standards.

## Data Subject Rights

**Data Access**: Customers can request a copy of all data stored within the Jira JupiterOne Application at any time. Since the app is hosted in JIRA Server itself, this data can be obtained with the collaboration of JIRA Support

## Training and Awareness

We conduct regular security and compliance training for all employees and contractors involved in the development, deployment, and maintenance of the Jira JupiterOne Application. Security best practices and compliance obligations are embedded into the onboarding and ongoing training programs.

## Review and Updates

This policy is reviewed annually or whenever there are significant changes in regulations, technology, or organizational structure. Updates to the policy will be communicated to all users.

## Contact Us

If you have questions about this Policy, please contact us at [support@jupiterone.com](mailto:support@jupiterone.com).

---

Source: /integrations/outbound-directory/jira/privacy-policy

# Privacy Policy

**Updated: January 2025**

JupiterOne ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, products, or services.

## Information We Collect

When you interact with our services, we may collect various types of personal data, including but not limited to:

### Account Information

We may collect JupiterOne Account identifiable information, such as your Account ID, Region, and API key of the account. We may keep a record of your communications with us and other information you share during the course of the communications.

### Usage Data

We may collect information about how you interact with JupiterOne's website, products, or services.

## Purpose of Processing

We may use your information for the following purposes:

-   **Personalize User Experience**: To personalize user experience and provide requested services.
-   **Service Provision**: To provide and maintain our services, process transactions, and fulfill your requests.
-   **Analytics**: To analyze user behavior, improve our offerings, and enhance the user experience. To enhance existing user profiles, verify and update information, and enrich the understanding of user preferences and behaviors.
-   **Security**: To protect against unauthorized access, detect and prevent fraudulent activities.

We process your Account data based on one or more of the following legal grounds:

-   **Consent**: When you provide explicit consent for specific processing activities, such as opting out of our marketing communications.
-   **Contractual Necessity**: When processing is necessary for the performance of a contract with you.
-   **Legal Obligations**: When processing is required to comply with legal obligations.
-   **Legitimate Interests**: When processing is based on our legitimate interests and does not override your rights and freedoms.
-   **Other Purposes**: We will process your personal information for other purposes about which we notify you in advance, or for which we receive your consent. In general, we collect and process personal information about you as necessary to provide the products you use, operate our sites and business, meet our contractual and legal obligations, protect the security of our systems and our customers, or fulfill other legitimate interests as described in this Privacy Policy and in our notices to you.

## Information Sharing

We do not sell, trade, or rent your personal information to third parties. However, we may share your information with trusted third parties who assist us in operating our website, conducting our business, or servicing you.

## Cookies and Similar Technologies

We may use cookies and similar technologies to collect information and enhance your experience.

## Security

We implement reasonable security measures to protect your information from unauthorized access, disclosure, alteration, or destruction.

## Changes to This Privacy Policy

We may modify or update this Privacy Policy from time to time to reflect changes in our business and practices. Please review this page periodically. Any changes to this Privacy Policy will be indicated by updating the 'Last Updated' date above. For significant modifications, we will provide additional notice or obtain consent as required by applicable law.

## Contact Us

If you have questions about this Privacy Policy, please contact us at [privacy@jupiterone.com](mailto:privacy@jupiterone.com).

---

Source: /integrations/outbound-directory/jira/security-policy

# Security and Compliance Policy

**Updated: January 2025**

## Overview

This document outlines the security and compliance policies for the JupiterOne-Jira Integration Application, ensuring that all customer data and system operations are protected and meet standard compliance requirements.

## Security Governance

We maintain a robust security governance framework that includes regular risk assessments, monitoring, and continuous improvement efforts to mitigate threats to the JupiterOne-Jira Integration Application.

## Access Control

-   **User Authentication**: Access to the Jira JupiterOne Application is done via the JIRA Authentication.
-   **Role-Based Access Control (RBAC)**: All users with Jira admin access to the project are granted access to the application based on their roles.
-   **Session Management**: By default, session timeout is the same as Jira session timeout

## Data Protection

-   **Data Encryption**: All sensitive data is encrypted using in-built methods of [JIRA Storage](https://developer.atlassian.com/platform/forge/runtime-reference/storage-api-secret/)
-   **Data Minimization**: We adhere to the data minimization principle, collecting only the necessary information required for Jira integration and compliance monitoring.
-   **Backup and Recovery**: Customers are responsible for backing up state data on the JupiterOne-Jira Integration Application Platform. The Application provides a reflection of Customer Data from Jupiterone and should not serve as the system of record for any novel Customer Data.

## Continuous Improvement

We are committed to continuous improvement and the adaptation of new security measures in line with evolving industry best practices. Periodic security reviews and internal audits are conducted to ensure compliance with current standards.

## Data Subject Rights

**Data Access**: Customers can request a copy of all data stored within the Jira JupiterOne Application at any time. Since the app is hosted in JIRA Server itself, this data can be obtained with the collaboration of JIRA Support

## Training and Awareness

We conduct regular security and compliance training for all employees and contractors involved in the development, deployment, and maintenance of the Jira JupiterOne Application. Security best practices and compliance obligations are embedded into the onboarding and ongoing training programs.

## Review and Updates

This policy is reviewed annually or whenever there are significant changes in regulations, technology, or organizational structure. Updates to the policy will be communicated to all users.

## Contact Us

If you have questions about this Policy, please contact us at [support@jupiterone.com](mailto:support@jupiterone.com).

---

Source: /integrations/outbound-directory/jira/setup

# Setup Guide

## Overview

The application facilitates seamless integration with JupiterOne and Jira, enhancing the ability to manage and respond to cybersecurity alerts. This integration empowers users to automatically generate Jira tickets from JupiterOne alerts and create alerts within the system, ensuring that critical vulnerabilities are promptly addressed. The application fetches data from JupiterOne, maps fields to Jira issues, and allows for customization of these mappings. With automated alert creation, ticket generation, and updates, the application streamlines workflows and improves the efficiency of incident response processes. The user-friendly setup and real-time synchronization between JupiterOne and Jira ensure that cybersecurity efforts are both comprehensive and up-to-date, ultimately strengthening your organization’s security posture.

## Prerequisites

Ensure the JupiterOne account must have the following permissions:

-   **Full Admin Privileges**
-   **API Key Management (Read and Write)**
-   **Alerts (Read and Write)**

Ensure the Jira account must have the following permission:

-   **Admin Privileges**

## Configuration in JupiterOne

### Generating JupiterOne API Token

1.  **Log in** to the JupiterOne portal using your Administrator privileges.
2.  Go to **Settings > API Tokens**
3.  Click on **New Token**
4.  Provide the following details
    -   **Token Name** Assign a name to the token.
    -   **Days before Expiration** Set the token's expiry date.
5.  Copy the **API Token** and save it securely as it can only be viewed once.

### Get JupiterOne Account ID

1.  **Log in** to the JupiterOne portal using your Administrator privileges.
2.  Go to **Settings > Account Management**
3.  Copy the **Account ID**

## Configuration in Jira

Before beginning the configuration, ensure that you have a JIRA project created

1.  Go to your project and click on the **Project Settings**. Navigate to Issues, open any issue type, click on **Go to Custom fields** at bottom right, and click on the **Create Custom Field** button
    
    ![Create Custom Field](/assets/images/jira_custom_field-7d42735b6891b7fd0410f1ba26123cd7.png)
    
2.  Select required field type
    
    -   To map specific field types, create custom fields in Jira as follows:
        -   **Number Field:** For mapping number-type fields.
        -   **Labels:** For mapping array-type fields.
        -   **Datetime Picker:** For mapping datetime-type fields.
    
    ![Jira Custom Fields](/assets/images/jira_custom_field_types-8d78bb8946fbcd7563a40b103dbfd9fd.png)
    
3.  Enter the field name, description and click on the **Create** button.
    
    ![Create](/assets/images/jira_create_field-086b987e1902769efbbb49545d62f036.png)
    
4.  Go to your project and click on the **Project Settings**
    
    ![Project Settings](/assets/images/jira_project_settings-cfba784fc23ca8627b5a321608d22277.png)
    
5.  Go to Issue Types, select an issue, and search for the required custom fields
    
    ![Select](/assets/images/jira_custom_fields_addition-836f321072491fb5b9ba57f3c3135f97.png)
    
6.  The custom fields will be visible under the Description fields tab. Once you have added all the custom fields, click on the **Save changes** button.
    
    ![Save Changes](/assets/images/jira_custom_fields_save-d4a20b668b636fabb873a29eebe752ab.png)
    

## Using the Application

The integration enables you to use the following functionalities within the JIRA dashboard

-   You can create JupiterOne alerts.
-   You can map JIRA fields with JupiterOne fields to create Issues for vulnerabilities.

### Creating Alerts

1.  Go to your project > Project Settings > Apps and select the **JupiterOne-Jira Integration Application**
    
    ![Application](/assets/images/jira_app_navigation-8f2d36f58df39445526a31892a5348b7.png)
    
2.  Go to the JupiterOne Configuration tab.
    
3.  The application will prompt you to enter the following details
    
    -   **JupiterOne account ID**
    -   **JupiterOne API Key**
    -   **JupiterOne instance region**
    -   **Name of the Alert**
    -   **Alert query**
    -   **Evaluation Interval**
4.  After entering the details, click on the **test connection** button. This will authenticate your credentials and create the alert. After successful authentication and alert creation, **Status** will be shown
    
    ![Status](/assets/images/jira_jupiterone_alert_creation-7505ceee57ef79e155190b8576ffa3c7.png)
    

### Mapping JIRA fields with JupiterOne fields

1.  Go to the **JIRA ticketing configuration** tab
    
2.  Select Issue type
    
3.  Select the JIRA field and JupiterOne field that you want to map and click on the **Add Mapping** button
    
    -   **Summary** and **Description** JIRA fields are required to be mapped.
    -   **Boolean** or **DateTime** fields coming from JupiterOne cannot be selected as Primary Key
    
    ![Add Mapping](/assets/images/jira_jupiterone_field_mapping-52632c626ab6c41ed2d3647c63a951f0.png)
    
4.  Your mappings will be shown under the **JupiterOne to Jira Fields Mapping** table. You can remove a mapping by clicking on the **Remove** button under **Actions**.
    
5.  Click on the **lock icon** next to the mapping you want to select as the **primary key**.
    
    ![Primary Key](/assets/images/jira_jupiterone_primary_key-b1036b85c9d103ab685e8932716aed36.png)
    
6.  After adding the mappings, click on the **Save Mappings** button to save the mappings. Upon successful completion, a status box indicating “Mappings saved successfully” will be shown
    
    ![Save Mapping](/assets/images/jira_jupiterone_save_mappings-c90c15ff50fa43e77ad14caf1589dcab.png)
    

### Updating Alerts

1.  Go to the JupiterOne Configuration tab.
    
2.  The application will prompt you with the configured page where JupiterOne account ID, JupiterOne API Key, the JupiterOne instance region fields and Test connection button will be disabled.
    
3.  Modify Alert Name, alert query, and the evaluation interval of the alert as per requirement.
    
4.  After entering the data, click on the **Update Alert** button. This will authenticate your credentials and update the alert. After successful authentication and alert creation, Status will be shown
    
    ![Update Alert](/assets/images/jira_jupiterone_alert_updation-15028c9aee1f57f4019ee27fee784a6f.png)
    

##### Note:

After Alert Updation, the fields of JupiterOne Fields dropdown will also be updated according to the change in query and mappings can be done accordingly

### Deleting Alerts

1.  Go to the JupiterOne Configuration tab.
    
2.  The application will prompt you with the configured page where JupiterOne account ID, JupiterOne API Key, the JupiterOne instance region fields and Test connection button will be disabled.
    
3.  Click on the **Delete Alert** button. This will authenticate your credentials and update the alert. After successful authentication and alert creation, Status will be shown
    
    ![Delete Alert](/assets/images/jira_jupiterone_alert_deletion-bf39b961b94b192f250bbe8cbee2c705.png)
    

## Limitations

### Duplicate issues

In Jira duplication of issues arises when the primary key value of the data is empty or the string acting as primary key has some special characters.

-   The supported special characters are @, #, $, %, &, and -

### Numeric data

When few math operations are used on return properties of custom query Numeric data may come as undefined.

-   Supported Math Operations for custom query are +, -, \*. Math Operations can be used as mentioned in the below example.
    
    > FIND jupiterone\_compliance\_gap with totalNumberOfAffectedEntities > 1 as i return i.displayName, i.description, i.ref, **i.totalNumberOfAffectedEntities+5**, i.framework
    
-   For other Math operations alias should be used as mentioned in the below example
    
    > FIND jupiterone\_compliance\_gap with totalNumberOfAffectedEntities > 1 as i return i.displayName, i.description, i.ref, **i.totalNumberOfAffectedEntities/5 as gapAffected**, i.framework
    

## Troubleshooting

This section aims to guide users about the possible problems they might encounter while using the app. Please follow the instructions if you come across any of the following scenarios

### Alert creation failure

2.  The alert name should be unique.
3.  Make sure your account has the required permissions to create alerts.

### JIRA field names not visible

If the JIRA field names are not appearing in the "Choose a JIRA Ticket Field" dropdown, please refresh the page.

## Debugging

If you encounter issues while using the app, you can use your browser's developer console to help diagnose problems. Follow these steps:

-   Open the Browser Console:
-   Press F12 or Ctrl+Shift+I (Windows/Linux) or Cmd+Option+I (Mac) to open the developer tools.
-   Navigate to the "Console" tab to view logs, errors, and warnings.

## Conclusion

In conclusion, this document has provided a detailed guide to using the JupiterOne and Jira integration app. By integrating these platforms, users can enhance their workflow efficiency and vulnerability management capabilities. The app facilitates the automatic creation of alerts and seamless synchronization of vulnerability data, ensuring that critical issues are tracked and resolved in Jira. Additionally, users can leverage this integration to gain real-time insights and maintain a comprehensive view of their security posture within the Jira environment.

---

Source: /integrations/outbound-directory/jira/terms-and-conditions

# Terms and Conditions

**Effective Date: 13/01/2025**

These Customer Terms of Service (“Terms”) govern the use of the JupiterOne Jira Integration application ("App") provided by JupiterOne ("we", "our", or "us") on the Atlassian Marketplace for integration with Jira. By installing, accessing, or using the App, you agree to be bound by these Terms. If you do not agree to these Terms, you may not use the App.

## 1\. License Grant

### 1.1 License

We grant you a non-exclusive, non-transferable, revocable license to install and use the App solely for internal business purposes within your organization, subject to the terms of this agreement.

### 1.2 Usage Restrictions

You shall not:

-   Sublicense, lease, distribute, transfer, or assign the App.
-   Reverse-engineer, decompile, or disassemble the App.
-   Use the App in any manner that violates applicable laws or regulations.

## 2\. Pricing and Payments

### 2.1 Pricing

The pricing for the App is as stated on the Atlassian Marketplace listing. Pricing may vary depending on the number of users or features selected.

### 2.2 Payment

Payments for the App are processed via the Atlassian Marketplace, and you agree to pay the applicable subscription fees in accordance with Atlassian’s payment terms.

### 2.3 Subscription Term and Renewal

Subscriptions may be charged on a monthly or annual basis, as selected at the time of purchase. Subscriptions automatically renew unless canceled prior to the renewal date.

### 2.4 Refund Policy

Unless required by law, we do not offer refunds for subscription fees, except in cases where the App is found to be non-functional or fails to meet the agreed-upon specifications.

## 3\. Trial Period

### 3.1 Trial Period

If a trial period is offered, you may use the App free of charge for the trial duration specified in the Marketplace listing. After the trial period ends, you will be charged according to the pricing plan selected unless you cancel the subscription before the trial expires.

## 4\. Support and Maintenance

### 4.1 Support

We provide support for the App as specified in the Atlassian Marketplace listing. Support requests can be made by sending an email to [support@jupiterone.com](mailto:support@jupiterone.com), and we will respond to such requests within a reasonable timeframe.

### 4.2 Updates

We may provide updates, bug fixes, or new versions of the App. You are responsible for keeping the App up to date, and updates will be made available to you as part of your subscription.

## 5\. Data Privacy and Security

### 5.1 Data Collection

The App may collect certain data, including but not limited to usage statistics, error logs, and other information necessary for support and improvement purposes. We will handle all customer data in accordance with our Privacy Policy.

### 5.2 Data Security

We implement reasonable security measures to protect your data. However, we do not guarantee that your data will be completely secure.

### 5.3 Data Usage

We will not sell or rent your personal data to third parties. We may use aggregated, non-personally identifiable data to improve the App and provide better services.

## 6\. Intellectual Property

### 6.1 Ownership

We retain all rights, titles, and interest in and to the App, including all intellectual property rights. You do not acquire any ownership rights in the App, other than the limited rights expressly granted in these Terms.

### 6.2 User Content

You retain ownership of any content you input into the App but grant us a license to use such content to provide the services described in these Terms.

## 7\. Termination

### 7.1 Termination by You

You may terminate your subscription at any time by canceling through the Atlassian Marketplace. Your access to the App will continue until the end of your current billing cycle.

### 7.2 Termination by Us

We may terminate or suspend your access to the App at any time if you breach these Terms, fail to make payment, or otherwise engage in conduct that we deem inappropriate.

### 7.3 Effect of Termination

Upon termination of this agreement, you must cease using the App and remove it from your Jira instance. Any fees paid up to the date of termination are non-refundable.

## 8\. Limitation of Liability

### 8.1 No Warranty

The App is provided "as-is" without warranty of any kind, either express or implied, including but not limited to implied warranties of merchantability or fitness for a particular purpose.

### 8.2 Limitation of Liability

To the maximum extent permitted by law, we are not liable for any indirect, incidental, special, consequential, or punitive damages, or loss of profits, data, or goodwill, arising from or related to your use of the App.

## 9\. Governing Law and Dispute Resolution

### 9.1 Governing Law

These Terms shall be governed by and construed in accordance with the laws of \[Your Jurisdiction\].

### 9.2 Dispute Resolution

Any disputes arising out of or in connection with these Terms shall be resolved through \[arbitration/mediation\] in \[Location\], in accordance with the rules of \[Arbitration Organization\].

## 10\. Changes to These Terms

### 10.1 Amendments

We may update these Terms from time to time by posting a new version on the Atlassian Marketplace. You will be notified of significant changes through the App or via email.

### 10.2 Effective Date

Any updates to these Terms will become effective on the date they are posted.

## 11\. Miscellaneous

### 11.1 Entire Agreement

These Terms constitute the entire agreement between you and us with respect to the App and supersede all prior agreements, whether written or oral.

### 11.2 Severability

If any provision of these Terms is found to be unenforceable, the remaining provisions shall remain in full effect.

---

Source: /integrations/outbound-directory/n8n-community-node

# n8n Community Node

## Overview

JupiterOne provides an n8n node for collecting JupiterOne data as part of your n8n workflows. Currently two nodes are supported; Query and Webhook.

Use the JupiterOne n8n nodes for building automation workflows based of data or events in JupiterOne!

## Installation

### Self Hosted n8n

If you are running your own n8n instance it is possible to install the JupiterOne node using the following steps:

1.  Navigate in n8n to Settings > Community Nodes
2.  Enter the node name `n8n-nodes-jupiterone`
3.  Click `install` and the node should be installed

### n8n Cloud

> **INFO**
> 
> The JupiterOne n8n node is currently pending acceptance into the n8n Community Node ecosystem. It is only possible to install the JupiterOne node in self managed n8n instances today.

## Using the Nodes

### Credentials

To use the n8n query node it is necessary to configure credentials to access the JupiterOne API.

To configure credentials in n8n:

1.  Go to Create Credentials and choose `JupiterOne API`
2.  Provide an account ID
3.  Provide an API Key
4.  If necessary modify the API endpoint to use; the default endpoint is for the US region.
5.  Click Save

The credentials are automatically validated against JupiterOne, and if valid will be successfully saved.

For details on creating JupiterOne API access keys see the documentation [here](/api/authentication.md#creating-api-keys-within-the-dashboard).

### Query Node

To use the JupiterOne query node you first add the node to your workflow. You then configure the following parameters:

-   Select or create the credentials needed for your account
-   Enter the JupiterOne query you wish to run
-   Select a LIMIT on the number of results returned (max: 10,000)

You can preview the results returned using the "Execute Step" button

![n8n Configuration Page](/assets/images/n8n-node-config-08b79890dbda7fede04d36881afe57bc.png)

#### LIMIT Parameter

The n8n node supports returning between 1-10,000 results. This limit is managed outside of the J1QL query itself and you should not include `LIMIT` parameters in the query directly. The `LIMIT` has a maximum value of `10,000` in n8n workflows to prevent brining too many results into your workflow.

### Webhook Node

The webhook node can be used to trigger n8n workflows based on the webhook output from a JupiterOne rule. To ensure that your n8n workflow is only triggered from authorised sources it is strongly recommended to provide an additional header in your JupiterOne rule.

To use the webhook node from a JupiterOne rule:

1.  Add the JupiterOne Webhook node to your workflow
2.  Set a webhook header token for authentication (recommended)

In JupiterOne configure the webhook action for your alert and ensure that, if required in n8n, the webhook authentication header is also set.

---

Source: /integrations/settings

# Integration Settings

Integrations configured from the JupiterOne Integration application have various configuration settings that are described in this document. Some of these configuration settings have a direct impact on the integration execution lifecycle and other settings have a direct impact on the graph objects that are ingested into the JupiterOne graph.

## Account Name

The "Account Name" configuration field is a required field that is used as a "display name" for the integration instance. The Account Name value is not unique to an account, but it is recommended to keep the Account Name value unique for organization.

Sample values:

-   Production
-   the-production-account

## Description

The "Description" field is an optional field that exists only to supply JupiterOne users with additional details about the specific integration instance.

Sample values:

-   "AWS Production account in us-east-1"

## Polling Intervals

Integration polling intervals represent the frequency that the JupiterOne managed integration platform executes each integration. For example, if an integration is configured on a `ONE_DAY` polling interval, the integration will run once every 24 hours. Additionally, each customer integration is scheduled to run at roughly the same respective time every day. If your integration's first scheduled execution happens at 12:00pm, your next scheduled integration execution should also happen roughly at 12:00pm.

**Supported polling intervals**:

| Polling Interval | Description |
| --- | --- |
| `DISABLED` | This integration will never be scheduled by the managed JupiterOne integration platform. However, the integration may be manually executed via the UI or API. |
| `ONE_WEEK` | Executed once per week |
| `ONE_DAY` | Executed once per day |
| `TWELVE_HOURS` | Executed once every twelve hours |
| `EIGHT_HOURS` | Executed once every eight hours |
| `FOUR_HOURS` | Executed once every four hours |
| `ONE_HOUR` | Executed once every hour |

## Data Sources

An instance can be configured to enable or disable specific data sources within an integration. This is useful for integrations that have multiple data sources, but you only want to enable a subset of them. For example, the AWS integration has a data source for `CloudTrail` and `CloudWatch`. If you only want to ingest data from `CloudTrail`, you can disable the `CloudWatch` data source.

For more information, check out [Data Sources](/integrations/data-sources.md).

The Data Sources settings is available for many integrations. It can be found in the "Advanced Options" section when creating or editing an integration instance. ![Data Sources Example](/assets/images/data-sources-1-14c4b498c5fe4a3ab4b3204654cb56f5.png)

Adjusting data sources is easily done by moving the items left or right in the list. ![Data Sources Example](/assets/images/data-sources-2-12a5b0536855d1aa4e300905506bfda6.png)

## Tags

Tags can be configured along with integrations. Each tag key and value will be automatically propagated onto entities that are produced by the integration where the respective entity tag property names are prefixed with `tag.` (e.g. `tag.AccountName`). The JupiterOne Integration application has a few recommended tags that can be automatically enabled/disabled via toggle. Additionally, JupiterOne users may create custom tags of their own.

Recommended default tags for JupiterOne Integrations:

| Tag Name | Tag Description | Data Type | Value |
| --- | --- | --- | --- |
| `AccountName` | The vendor account that this integration is associated with. The value is automatically inherited from the integration "Account Name" field. | `string` | `{{Integration Account Name}}` |
| `Production` | Whether the integration's vendor account represents a _production_ account or not. | `boolean` | `true` |

### Custom Tags

Custom tags can be defined when creating or editing an integration instance. For custom tags a static key and value can be used on a per-integration instance basis, for example to tag which business unit owns a particular account or service. Load the custom tags option by opening the `Advanced Options` section when editing an integration instance (see image below).

> **INFO**
> 
> If you don't see the "Custom Tags" option please check that you are editing/creating the integration instance and not just viewing it

![Highlight Custom Tags Config](/assets/images/integration-custom-tags-70418b5a1c7bce6a0ddf173b0cd899b4.png)

---

Source: /j1ql

# J1QL Overview

The JupiterOne Query Language (J1QL) is a powerful natural query language designed for querying and analyzing data in the JupiterOne platform. It provides a flexible and intuitive way to retrieve information from the graph database and perform complex data operations.

With J1QL, you can search for specific assets, filter results based on various criteria, traverse relationships, perform mathematical calculations, and more. It offers a comprehensive set of features and functions to facilitate data exploration, analysis, and reporting within the JupiterOne ecosystem.

## Getting started with J1QL

J1QL is inspired by SQL and Cypher and aspires to be as close to natural language as possible. The execution of a J1QL query seamlessly queries a full-text search, asset-relationship graph, and any other future data stores, as needed.

Depending on your familiarity with querying languages and J1QL specifically, here are some useful places to learn the basics of J1QL, dive into querying with J1QL, or explore example queries and common questions.

> **INFO**
> 
> JupiterOne AI supports natural language querying — ask questions in plain English and get J1QL queries generated automatically. [Learn more →](/features/jupiterone-ai/ai-capabilities.md#natural-language-search)

[

![](/icons/illustrations/orbit.svg)![](/icons/illustrations/orbit.svg)

Learn J1QL

Dive into the basics of J1QL and gain functional and conceptual knowledge of how to effectively query your data in JupiterOne.





](/j1ql/basic-keywords.md)[

![](/icons/illustrations/puzzle.svg)![](/icons/illustrations/puzzle.svg)

Get Started

Jump into querying in your JupiterOne workspace and gain practical experience executing queries and exploring their results.





](/j1ql/basic-keywords.md)[

![](/icons/illustrations/tree.svg)![](/icons/illustrations/tree.svg)

Basic Queries

Explore basic J1QL example queries by use case.





](/j1ql/basic-queries.md)[

![](/icons/illustrations/shuttle.svg)![](/icons/illustrations/shuttle.svg)

Question Library

View the comprehensive J1QL query library featuring a wide range of queries relating to integrations and use cases.





](http://ask.us.jupiterone.io/)

---

Source: /j1ql/aggregate-functions

# Aggregate functions

J1QL offers powerful aggregate functions that allow you to perform calculations on groups of entities and derive meaningful insights from your data. These functions include SUM, AVG, MIN, MAX, and COUNT, which can be applied to numerical or date properties. By using these aggregate functions in your queries, you can efficiently summarize data, calculate totals or averages, identify minimum and maximum values, and determine the count of entities that meet specific criteria.

Supported aggregating functions (not case sensitive) in J1QL are:

-   `COUNT(selector)`
-   `COUNT(selector.field)`
-   `MIN(selector.field)`
-   `MAX(selector.field)`
-   `AVG(selector.field)`
-   `SUM(selector.field)`

Below are a few example queries implementing an aggregate function:

```j1ql
FIND bitbucket_team AS team
  THAT RELATES TO bitbucket_user AS user
RETURN team.name, COUNT(user)
```

```j1ql
FIND bitbucket_team AS team
  THAT RELATES TO bitbucket_user AS user
RETURN COUNT(user), AVG(user.age)
```

### Aggregation application

There are three different ways for aggregations to be applied:

-   On the customer's subgraph (determined by the traversal that is run).
-   On a portion of the customer's subgraph relative to a set of entities (groupings).
-   On data for a single entity.

The way aggregations happen is determined by what is requested via the query language's `RETURN` clause.

### Aggregations relative to a subgraph

If all selectors are aggregations, then all aggregations will be scoped to the entire traversal that the user has requested and not tied to individual entities.

Example: RETURN COUNT(acct), COUNT(user)

```md
FIND Account AS acct
  THAT HAS User AS user
RETURN COUNT(acct), COUNT(user)
```

### Aggregations relative to a grouping by entity attribute

If selectors are provided that do not use an aggregation function, they will be used as a _grouping key_. This key will be used to apply the aggregations relative to the data chosen.

Example: RETURN acct.\_type, COUNT(user)

```md
FIND Account AS acct
  THAT HAS User AS user
RETURN acct._type, COUNT(user)
```

### Aggregations relative to a grouping by multiple attributes

If multiple attributes of a selector are included the return function, the last one before the aggregation will be used as the _grouping key_.

Example: return acct.\_type, acct.displayName, COUNT(user)

```md
FIND Account AS acct
  THAT HAS User AS user
RETURN acct._type, acct.displayName, COUNT(user)
```

## Additional examples

`COUNT` always returns the number of distinct entities or attributes requested. We'll illustrate an example below with the following data:

| id | class | name | lead |
| --- | --- | --- | --- |
| 1 | bitbucket\_team | team1 | alice |
| 2 | bitbucket\_team | team2 | bob |
| 3 | bitbucket\_team | team3 | alice |

Example query

```md
FIND bitbucket_team AS team
RETURN COUNT(team.lead)
```

Our results would look like this:

Response

```json
{
  "type": "table",
  "data": [
    { "COUNT(team.lead)": 2 }
  ]
}
```

#### Single grouping key

For example, with the following query,

```md
FIND bitbucket_team AS team
  THAT RELATES TO bitbucket_user AS user
RETURN team.name, COUNT(user)
```

the result will be:

Response

```json
{
  "type": "table",
  "data": [
    { "team.name": "team1", "COUNT(user)": 25 },
    { "team.name": "team2", "COUNT(user)": 5 }
  ]
}
```

In this case, the `team.name` acts as the key that groups aggregations together. So `COUNT(user)` finds the count of users relative to each team.

#### Multiple grouping keys

When there are return selectors that are not aggregating functions, the aggregating functions will be performed relative to the identifier that it is closer to in the traversal.

Example query

```md
FIND bitbucket_project AS project
  THAT RELATES TO bitbucket_team AS team
  THAT RELATES TO bitbucket_user AS user
RETURN project.name, team.name, COUNT(user)
```

The `COUNT(user)` aggregation will be performed relative to the team, because the `team` traversal is closer to the `user` traversal in the query.

Response

```json
{
  "type": "table",
  "data": [
    { "project.name": "JupiterOne", "team.name": "team1", "COUNT(user)": 25 },
    { "project.name": "JupiterOne", "team.name": "team2", "COUNT(user)": 5 },
    { "project.name": "Windbreaker", "team.name": "team2", "COUNT(user)": 5 }
  ]
}
```

If the `RETURN` statement is changed to this:

Example query

```md
RETURN project.name, COUNT(user)
```

The `COUNT(user)` aggregation will be performed relative to the project.

```json
{
  "type": "table",
  "data": [
    { "project.name": "JupiterOne", "COUNT(user)": 50 },
    { "project.name": "Windbreaker", "COUNT(user)": 5 }
  ]
}
```

#### Example relative to a single entity

If a selector is specified and an aggregating function is applied to that selector's source identifier in some way, aggregations will happen locally to the element.

Example:

Example query

```md
FIND bitbucket_project AS project
  THAT RELATES TO bitbucket_team AS team
  THAT RELATES TO bitbucket_user AS user
RETURN project.name, COUNT(project.aliases), team.name, COUNT(user)
```

Example result:

Response

```json
{
  "type": "table",
  "data": [
    {
      "project.name": "JupiterOne",
      "COUNT(project.aliases)": 1,
      "team.name": "team1",
      "COUNT(user)": 25
    },
    {
      "project.name": "JupiterOne",
      "COUNT(project.aliases)": 1,
      "team.name": "team2",
      "COUNT(user)": 5
    },
    {
      "project.name": "Windbreaker",
      "COUNT(project.aliases)": 5,
      "team.name": "team2",
      "COUNT(user)": 5
    }
  ]
}
```

---

Source: /j1ql/basic-keywords

# J1QL: Basic Keywords

In this article, we'll cover the basic commands of J1QL, a query language used for data exploration and retrieval in JupiterOne. By understanding these fundamental commands, you'll gain the necessary skills to query specific entities, filter data, and sort information effectively. Whether you're a beginner or have prior experience in programming languages, this guide will equip you with the essential knowledge to navigate and extract valuable insights from your data using J1QL.

> **NOTE**
> 
> J1QL keywords are not case-sensitive

## FIND

FIND simplifies the search process for assets or entities by allowing users to specify either the `_class` or `_type` value. By making the value case-sensitive, the command automatically determines whether the search should be based on `class` or `type`, eliminating the need for explicit input.

An asset `class` is stored in `TitleCase` while `_type` is stored in `snake_case`. A wildcard `*` can be used to find any asset. For example:

-   `FIND` User is equivalent to `FIND * WITH _class = "User"`
-   `FIND aws_iam_user` is equivalent to `FIND * WITH _type = "aws_iam_user"`

## WITH

`WITH` offers valuable filtering capabilities by allowing users to specify property names and values to narrow down asset results. `WITH` is followed by **property names and values to filter entities**. The `WITH` command empowers users to precisely filter and retrieve the desired entities, enhancing the efficiency and accuracy of data exploration and retrieval in J1QL.

> **INFO**
> 
> For a list of all compatible comparison operators, see our dedicated guide covering [J1QL comparisons](/j1ql/comparisons.md).

There are several considerations to note when working with `WITH`:

-   The property names are always case-sensitive, property values are also case-sensitive except when using regex in case insensitive mode.
-   **String** values must be wrapped in either single or double quotes (preferred) - `"value"` or `'value'`.
-   **Boolean**, **Number**, and **Date** values must not be wrapped in quotes.
-   The `undefined` keyword can be used to filter on the absence of a property. For example: `FIND DataStore WITH encrypted = undefined`.
-   If a property name contains special characters (e.g. `-` or `:`), you can wrap the property name in `[]`. For example: `[tag.special-name] = "something"`.

## AND / OR

Using `AND` / `OR` in J1QL provides powerful capabilities for comparing multiple properties in asset filtering. By supporting logical operators like `AND` and `OR`, users can construct complex property comparisons to precisely retrieve entities that meet specific criteria. J1QL's shorthand filtering further enhances efficiency by allowing filtering of a single property against multiple values, similar to the `IN` clause in SQL. With a clear order of operations and intuitive syntax, `AND` / `OR` enables advanced filtering operations and extracts targeted data with ease and precision.

Here are some examples illustrating how to utilize `AND` and `OR` within a query:

AND example

```md
FIND DataStore WITH encrypted = false AND (tag.Production = true AND classification = "critical")
```

OR example

```md
FIND user_endpoint WITH platform = "darwin" OR platform = "linux"
```

Additionally, you can filter multiple property values like this (similar to `IN` in SQL):

```j1ql
FIND user_endpoint WITH platform = ("darwin" OR "linux")

FIND Host WITH tag.Environment = ("A" OR "B" OR "C")

FIND DataStore WITH classification != ("critical" OR "restricted")
```

> **NOTE**
> 
> Note that property filters are evaluated according to the following order of operations: Parenthesis first, comparisons (`=`, `>=`, `<=`, `!=`) after, `AND`, and then `OR`.

### Shorthand filtering

Filtering multiple property values is often called "shorthand" filtering because it allows you to filter a single property by multiple values. Below is a table to help illustrate how "shorthand" filters are evaluated:

| `_type` | `_type = "fruit"` | `_type = "nut-filled"` | `_type = ("fruit" AND "nut-filled")` | `_type = ("fruit" OR "nut-filled")` |
| --- | --- | --- | --- | --- |
| "fruit" | true | false | false | true |
| "nut-filled" | false | true | false | true |
| "fruit", "nut-filled" | true | true | true | true |
| "non-fruit" | false | false | false | false |
| "non-fruit", "plain" | false | false | false | false |
| undefined | false | false | false | false |

When using a _negated_ "shorthand" filter, such as with the `!=` comparison, you can expect J1QL to evaluate values in the following manner:

| `_type` | `_type != "fruit"` | `type != "nut-filled"` | `_type != ("fruit" AND "nut-filled")` | `_type != ("fruit" OR "nut-filled")` |
| --- | --- | --- | --- | --- |
| "fruit" | false | true | true | false |
| "nut-filled" | true | false | true | false |
| "fruit", "nut-filled" | false | false | false | false |
| "non-fruit" | true | true | true | true |
| "non-fruit", "plain" | true | true | true | true |
| undefined | true | true | true | true |

## THAT

The `THAT` command in J1QL provides a versatile way to specify relationship verbs and filter entities based on their connected relationships. By allowing users to define relationship verbs in `ALLCAPS`, J1QL simplifies the process of finding relationships between different asset nodes. This enables mixing asset `class` and `type` values together, and bidirectional relationship verbs are supported by default, ensuring flexibility in querying relationships. Additionally, J1QL provides options to specify relationship direction using double arrows (`<<` or `>>`) and allows negation of relationships for querying entities without specific relationships. The inclusion of the `AS` command allows users to define aliased selectors for convenient use in `WHERE` or `RETURN` sections of queries.

> **NOTE**
> 
> Using the wildcard at the beginning of the query without any pre-traversal filtering–that is, `FIND * THAT ...` without `WITH` may result in a long query execution time.

Example query using `THAT`:

```j1ql
FIND Service
  THAT RELATES TO Account
```

You can use ( `|` ) when performing a `THAT` query to select entities or relationships of different classes and types. For example, `FIND (Host|Device) WITH ipAddress='XX.XX.X.XX'` is equivalent to (and much simpler) than the following:

```j1ql
FIND * WITH (_class='Host' OR _class='Device') AND ipAddress='XX.XX.X.XX'
```

### THAT asset class types and relationships

Asset class and type values can be used together while using `THAT`:

```j1ql
FIND (Database|aws_s3_bucket)
```

It can also be used on Relationship verbs:

```j1ql
FIND HostAgent
  THAT (MONITORS|PROTECTS) Host
```

And even allows both Assets and Relationships:

```j1ql
FIND *
  THAT (ALLOWS|PERMITS) (Internet|Everyone)
```

### Relationship verbs

By default Relationship verbs are bi-directional. For example, the following queries would yield the same results:

```j1ql
FIND User
  THAT HAS Device
```

```j1ql
FIND Device
  THAT HAS User
```

#### Relationship direction operators

Aside from operating bi-directionally, a Relationship’s direction can be specified using double arrows after the verb:

Finds assets with a HAS relationship from User to Device:

```md
FIND User
  THAT HAS >> Device
```

```j1ql
FIND Device
  THAT HAS << User
```

Finds assets with a HAS relationship from Device to User:

```md
FIND User
  THAT HAS << Device
```

```j1ql
FIND Device
  THAT HAS >> User
```

In the above examples, each query can leverage a directional relationship based on the desired target (i.e., User or Device).

#### Negating relationships

You can also determine if an asset does not have a relationship with another by negating the relationship. This can be achieved by prefixing a relationship with an exclamation point (`!`).

1\. Example of using a negation:

```md
FIND User
  THAT !IS Person
```

2\. Applying a negation to relationships:

```md
FIND User
  THAT !RELATES TO Person
```

> **WARNING**
> 
> It is not valid to alias the result of a negated relationship. Whilst this may produce results the behaviour is undefined.
> 
> The following will produce undefined behaviour:
> 
> ```j1ql
> FIND User
>   THAT !RELATES TO Person AS p
> RETURN p
> ```

##### Negating a relationship use case

This finds EBS volumes that are not in use. The query finds relationships regardless of the edge direction, therefore the `!USES` in the below query translates more directly as "is not used by".

```j1ql
FIND aws_ebs_volume
  THAT !USES aws_instance
```

It is important to note that the above query returns `aws_ebs_volume` entities. If the query were constructed the other way around, it would return a list of `aws_instances`, if it does not have an EBS volume attached:

```j1ql
FIND aws_instance
  THAT !USES aws_ebs_volume
```

## AS

The `AS` command in J1QL allows users to define aliased selectors, providing flexibility in specifying assets or relationships to be used in the `WHERE` or `RETURN` sections of a query. By using aliases, you can assign meaningful names to selected entities or relationships, enhancing query readability and making it easier to reference them later in the query.

**For example:**

Without selectors

```j1ql
FIND Firewall
  THAT ALLOWS *
```

With selectors

```j1ql
FIND Firewall AS fw
  THAT ALLOWS * AS n
```

**Additionally, selectors can also be defined on a relationship:**

```j1ql
FIND Firewall AS fw
  THAT ALLOWS AS rule * AS n
```

## WHERE

Using `WHERE` facilitates post-traversal filtering by allowing you to apply additional conditions to narrow down the results of a query. By leveraging the selector defined in the query, you can specify filtering criteria based on various properties or relationships. `WHERE` allows for ease of refinement of queries to retrieve only the results that meet specific conditions, enabling precise data extraction and analysis.

For example:

```j1ql
FIND Firewall AS fw
  THAT ALLOWS AS rule * AS n
WHERE rule.ingress=true AND (rule.fromPort=22 OR rule.toPort=22)
```

## RETURN

`RETURN` allows you to specify the assets, relationships, or properties you want to retrieve from the query results. By using the `RETURN` clause, you can selectively choose the desired information to be included in the output, enhancing data relevance and reducing unnecessary data retrieval. The `RETURN` command provides flexibility in querying and enables targeting specific assets or properties of interest, optimizing data analysis and facilitating efficient information extraction.

By default, the assets and their properties found from the start of the traversal are returned in a query. For example, `Find User that IS Person`returns all matching `User` assets and their properties, but not the related `Person` entities. To return properties from both the `User` and `Person` entities, define a selector for each and use them in the `RETURN` clause like so:

Defining a selector

```md
FIND User AS u
  THAT IS Person AS p
RETURN u.username, p.firstName, p.lastName, p.email
```

This means that a `Person` having multiple `IS` relationships to `User` entities will have their `p.firstName`, `p.lastName`, and `p.email` values returned in each path through the graph that leads to that `User`:

User with multple paths

```md
| u.username | p.firstName | p.lastName | p.email                        |
|------------|-------------|------------|--------------------------------|
| spiderman  | Peter       | Parker     | not.spiderman@example.com      |
| batman     | Bruce       | Wayne      | totally.not.batman@example.com |
| bwayne     | Bruce       | Wayne      | totally.not.batman@example.com |
```

> **NOTE**
> 
> When the `RETURN` statement is used with specified properties, the J1QL engine will pick out the properties from each path traversed. Sometimes, the path to the end of the query can fork since there are multiple ways assets can relate to each other. This means that a Person having multiple `IS` relationships to User entities will have their `p.firstName`, `p.lastName`, and `p.email` values returned in each path through the graph that leads to a User.

#### Using RETURN with special characters

If a property name contains special characters (e.g. `-` or `:`), you can wrap the property name in `[]`.

```j1ql
FIND User AS u
  THAT IS Person AS p
RETURN u.username, p.firstName, p.lastName, p.email, p.[special-name]
```

Results from the query will contain the relevant `p.[special-name]` entities per `User`:

```text
| u.username | p.firstName | p.lastName | p.email                        | p.special-name |
|------------|-------------|------------|--------------------------------|----------------|
| spiderman  | Peter       | Parker     | not.spiderman@example.com      | Spiderman      |
| batman     | Bruce       | Wayne      | totally.not.batman@example.com | Batman         |
| bwayne     | Bruce       | Wayne      | totally.not.batman@example.com | Batman         |
```

#### Using RETURN with a wildcard

Wildcard can be used to return all properties for multiple assets in a flattened table. For example:

RETURN query with wildcard

```j1ql
FIND User AS u
  THAT IS Person AS p
RETURN u.*, p.*
```

Using a wildcard to return **all** properties also returns **all** metadata properties associated with the selected assets. This feature is useful when you want to perform an analysis that involves metadata.

#### Asset and Relationship reference

Using the RETURN clause, the J1QL query engine returns back only the requested information.

Results would typically be returned like this via the API:

```json
{
  "type": "table",
  "data": [
    { "User._type": "jupiterone_user", "Person.name": "Mochi" }
  ]
}
```

When executing queries via the application, additional metadata is returned back for each row with references to the assets and relationships traversed via the paths. This resides under a `_meta` property that is attached to each row in the query:

```json
{
  "type": "table",
  "data": [
    {
      "User._type": "jupiterone_user",
      "Person.name": "Mochi",
      "_meta": {
        "byAlias": {
          "User": {
            "id": "f4b7cfbb-8532-dbcb-b244-e2864423fccd",
            "entity": {
              "_id": "4147b2bc-3b65-42a8-be50-164a45c4864d"
            }
          },
          "Person": {
            "id": "952f0d8c-19dc-4dde-a3bf-e6ce0cda85a7",
            "entity": {
              "_id": "cdbceb28-e066-4006-9456-225ddb358d16"
            }
          }
        }
      }
    }
  ]
}
```

> **NOTE**
> 
> Note that when row metadata is requested via API, usage of the `UNIQUE` keyword or aggregations will cause the `_meta` property to be stripped from rows.

## HAVING

The `HAVING` clause in J1QL allows you to filter the results of a query based on aggregate values of the assets or relationships returned. It is used to specify conditions that must be met for a row to be included in the result set. The `HAVING` clause is often used in conjunction with aggregate functions in the `RETURN` clause to filter the results of aggregate functions.

Example query to find users with more than one email address:

HAVING query

```j1ql
FIND User AS u
  THAT IS Person AS p
RETURN u.username, p.firstName, p.lastName, p.email, COUNT(p.email) AS emailCount
HAVING emailCount > 1
```

Example query finding Hosts and Devices with an average finding score greater than 7:

HAVING query

```j1ql
FIND (Device|Host) AS h
  THAT HAS Finding AS f
RETURN h.displayName, h.fqdn, AVG(f.numericSeverity) AS avgSeverity
HAVING avgSeverity > 7
```

It is also possible to include multiple conditions in the `HAVING` clause using the `AND` and `OR` operators, and parentheses to group conditions.

HAVING query

```j1ql
FIND (Host|Device) AS h
  THAT RELATES TO Finding AS f
RETURN h.displayName, COUNT(f) AS findingCount, MAX(f.numericSeverity) AS maxSeverity
HAVING findingCount > 10 AND (maxSeverity > 7 OR maxSeverity = undefined)
```

## TO

The `TO` command in J1QL provides a natural language-like syntax for expressing relationships between entities. By using the `TO` keyword after a relationship verb, you can create queries that closely resemble human language, enhancing query readability and ease of use. While `TO` is considered a "filler" word that is ignored by the interpreter, its inclusion allows you to construct queries that align with their natural language understanding, making the query-writing process more intuitive.

The following are some example relationship verbs where `TO` could be used:

-   `DEPLOYED TO`
-   `CONTRIBUTES TO`
-   `CONNECTS TO`
-   `ASSIGNED TO`

The below queries are executed the same way and return the same results:

TO query comparison

```md
FIND User
  THAT CONTRIBUTES TO CodeRepo
```

```j1ql
FIND User
  THAT CONTRIBUTES CoreRepo
```

## Commenting

J1QL supports comenting in queries anywhere in JupiterOne using the following format: `/* {insert comment here} */`

This is useful for annotating queries across JupiterOne users in order to communicate intention on variables, findings, and other contextual information related to the query itself.

Using comments in a query

```md
FIND aws_security_group WITH displayName ~='elb' /*ELB Security Group*/
  OR displayName ~='lambda' /*Lambda Security Group*/
```

## Conclusion

In conclusion, understanding the basic J1QL commands is crucial for effective querying in JupiterOne's graph database. By mastering these common J1QL keywords, you can extract valuable insights and perform data analysis within the platform. This proficiency empowers users to uncover connections and make informed decisions in security and compliance efforts.

To build further proficiency in J1QL, continue on to learn more about J1QL’s filtering behavior and understand how to curate your query results by applying filtering.

---

Source: /j1ql/basic-queries

# Basic queries

These examples, and same with all packaged queries provided in the JupiterOne web apps, are constructed in a way to de-emphasize the query keywords (they are _case insensitive_) but rather to highlight the relationships—the operational context and significance of each query.

### Simple Examples

**Find any entity that is unencrypted**

```j1ql
FIND * WITH encrypted = false
```

**Find all entities of class DataStore that are unencrypted**

```j1ql
FIND DataStore WITH encrypted = false
```

**Find all entities of type aws\_ebs\_volume that are unencrypted**

```j1ql
FIND aws_ebs_volume WITH encrypted = false
```

### Query with relationships

**Return just the Firewall entities that protects public-facing hosts**

```j1ql
FIND Firewall
  THAT PROTECTS Host WITH public = true
```

**Return Firewall and Host entities that matched query**

```j1ql
FIND Firewall AS f
  THAT PROTECTS Host WITH public = true AS h
RETURN f, h
```

**Return all the entities and relationships that were traversed as a tree**

```j1ql
FIND Firewall
  THAT PROTECTS Host WITH public = true
RETURN tree
```

### Full-text search

**Find any and all entities with "127.0.0.1" in some property value**

```j1ql
FIND "127.0.0.1"
```

**The FIND keyword is optional**

```j1ql
"127.0.0.1"
```

**Find all hosts that have "127.0.0.1" in some property value**

```j1ql
FIND "127.0.0.1" WITH _class='Host'
```

### More complex queries

Find critical data stored outside of production environments.

This assumes you have the appropriate tags (Classification and Production) on your entities.

```j1ql
FIND DataStore WITH tag.Classification = "critical"
  THAT HAS * WITH tag.Production = "false"
```

Find all users and their devices without the required endpoint protection agent installed:

```j1ql
FIND Person
  THAT HAS Device
  THAT !PROTECTS HostAgent
```

Find incorrectly tagged resources in AWS:

```j1ql
FIND * AS r
  THAT RELATES TO Service
  THAT RELATES TO aws_account
WHERE r.tag.AccountName != r.tag.Environment
```

If your users sign on to AWS via single sign on, you can find out who has access to those AWS accounts via SSO:

```j1ql
FIND User AS u
  THAT ASSIGNED Application AS app
  THAT CONNECTS aws_account AS aws
RETURN u.displayName as User, app.tag.AccountName as IdP, app.displayName as ssoApplication,
  app.signOnMode as signOnMode, aws.name as awsAccount
```

---

Source: /j1ql/cidr-filtering

# CIDR Filtering

J1QL supports filtering entities by whether an IP address property falls within a CIDR (Classless Inter-Domain Routing) range. This is useful for security and networking queries such as finding all hosts within a specific network segment.

## Syntax

The `cidr()` function takes two arguments:

1.  The property containing an IP address
2.  A CIDR range string

```text
cidr(property, 'network/prefix')
```

The function can be negated with `!` to exclude matching entities:

```text
!cidr(property, 'network/prefix')
```

> **NOTE**
> 
> Only IPv4 addresses are supported.

## Using CIDR in WITH Clauses

Use `cidr()` in a `WITH` clause to filter entities during traversal:

```j1ql
FIND Host WITH cidr(ipAddress, '10.0.0.0/8')
```

This returns all `Host` entities whose `ipAddress` falls within the `10.0.0.0/8` range (10.0.0.0 - 10.255.255.255).

### Negation

Prefix with `!` to find entities outside a range:

```j1ql
FIND Host WITH !cidr(ipAddress, '10.0.0.0/8')
```

### Combining with Other Filters

`cidr()` can be combined with other property filters using `AND` and `OR`:

```j1ql
FIND Host WITH cidr(ipAddress, '10.0.0.0/8') AND active = true
```

```j1ql
FIND Host WITH cidr(ipAddress, '10.0.0.0/8') OR cidr(ipAddress, '172.16.0.0/12')
```

## Using CIDR in WHERE Clauses

Use `cidr()` in a `WHERE` clause for post-traversal filtering. The property must be referenced using a selector alias:

```j1ql
FIND Host AS h
  THAT CONNECTS TO Network AS n
WHERE cidr(h.ipAddress, '192.168.0.0/16')
```

Negation works the same way in `WHERE` clauses:

```j1ql
FIND Host AS h WHERE !cidr(h.ipAddress, '10.0.0.0/8')
```

## Common CIDR Ranges

The following table lists commonly used CIDR ranges for reference:

| CIDR Range | Description | Address Range |
| --- | --- | --- |
| `10.0.0.0/8` | Class A private network | 10.0.0.0 - 10.255.255.255 |
| `172.16.0.0/12` | Class B private network | 172.16.0.0 - 172.31.255.255 |
| `192.168.0.0/16` | Class C private network | 192.168.0.0 - 192.168.255.255 |
| `0.0.0.0/0` | All IPv4 addresses | 0.0.0.0 - 255.255.255.255 |
| `x.x.x.x/32` | Single host | Exact IP match |

## Behavior Details

### Null or Missing Properties

Entities where the property is `null` or `undefined` are excluded from results, even when using `/0` (match all).

### Multi-Value Properties

If the property contains multiple IP addresses (a list), the entity matches if **any** IP in the list falls within the CIDR range.

```j1ql
/* Matches if any IP in the ipAddress list is in the 10.x range */
FIND Host WITH cidr(ipAddress, '10.0.0.0/8')
```

### Non-Canonical CIDR

Non-canonical CIDR notation is accepted and normalized. For example, `cidr(ipAddress, '10.1.2.3/8')` is treated as `10.0.0.0/8`.

### Using `cidr` as a Property Name

The `cidr` keyword is only treated as a filter function when used in the function call syntax `cidr(...)`. You can still use `cidr` as a regular property name with standard comparison operators:

```j1ql
/* This filters on a property named "cidr" using normal equality */
FIND Network WITH cidr = '10.0.0.0/24'
```

## Example Queries

### Find all hosts in private networks

```j1ql
FIND Host WITH cidr(ipAddress, '10.0.0.0/8')
  OR cidr(ipAddress, '172.16.0.0/12')
  OR cidr(ipAddress, '192.168.0.0/16')
```

### Find hosts exposed on public IPs

```j1ql
FIND Host WITH !cidr(ipAddress, '10.0.0.0/8')
  AND !cidr(ipAddress, '172.16.0.0/12')
  AND !cidr(ipAddress, '192.168.0.0/16')
```

### Find hosts in a specific subnet

```j1ql
FIND Host WITH cidr(ipAddress, '10.50.0.0/16') AND tag.Production = true
```

### Cross-reference hosts with firewall rules

```j1ql
FIND Host AS h
  THAT PROTECTS Firewall AS fw
WHERE cidr(h.ipAddress, '10.0.0.0/8')
RETURN h.displayName, h.ipAddress, fw.displayName
```

---

Source: /j1ql/comparisons

# Comparisons

J1QL’s comparison capabilities accommodate effective filtering and analysis of data. String comparisons offer operators for evaluating specific substrings, prefixes, and suffixes—allowing precise filtering of string values. Regular expressions (regex) can also be applied to properties for more advanced filtering including case-insensitive matching. Date comparisons provide flexibility for filtering based on relative or static timestamps, and date boundary functions let you snap to calendar periods such as the start of the current month or the end of a quarter—empowering you to perform time-based analysis and gain valuable insights from your data.

## String comparisons

J1QL supports the use of the following operators for comparisons of strings stored either as a single string or multi-value field. In addition to `=` (equals) and `!=` (does not equal):

-   `~=` : Contains
    
-   `^=` : Starts with
    
-   `$=` : Ends with
    
-   `!~=` : Does not contain
    
-   `!^=` : Does not start with
    
-   `!$=` : Does not end with
    

> **NOTE**
> 
> These operators only work for comparisons of strings or multi-value fields.

#### Example queries using basic string comparisons

1.  The following query returns all entities of the `Person` class that have a `firstName` beginning with the character 'J':
    
    ```text
    FIND Person WITH firstName ^= "J"
    ```
    
2.  This query returns all assets of the `Person` class that have a `Person.email` of `'a@b.com'` or `['a@b.com', 'x@y.com']`:
    
    ```text
    FIND Person WITH email = "a@b.com"
    ```
    
3.  The following query checks if a substring matches for either a single string or a multi-value field:
    
    ```text
    FIND Person WITH email ~= ".com"
    ```
    
4.  Lastly, this query returns entities of the Host class with any of the following examples of `tag.AccountName`: `xyz_demo`, `demo_xyz`, `abc_demo_xyz`:
    
    ```text
    FIND Host WITH tag.AccountName ~= "demo"
    ```
    

> **NOTE**
> 
> These string evaluations are case-sensitive. So `'Demo'` and `'demo'` yield distinct sets of results.

#### Example queries using regex comparisons

1.  The following query returns all entities of the `Person` class that have a `firstName` containing the case-insensitive string 'james':
    
    ```text
    FIND Person WITH firstName = /james/i
    ```
    
2.  This query returns all assets of the `Host` class that have a tag `classification` with a value of `Highly Sensitive` or similar permutations such as `highly-sensitive` or `highlysensitive`:
    
    ```text
    FIND Host WITH tag.classification = /highly[ \-]?sensitive/i
    ```
    

> **NOTE**
> 
> Due to limitations in some of the data stores the regex search options are limited. For more informaiton please see [REGEX Implementation](/j1ql/regular-expressions.md).

## CIDR comparisons

J1QL supports filtering entities by whether an IP address property falls within a CIDR range using the `cidr()` function:

```j1ql
FIND Host WITH cidr(ipAddress, '10.0.0.0/8')
```

Use `!cidr()` to negate the filter and exclude matching entities:

```j1ql
FIND Host WITH !cidr(ipAddress, '10.0.0.0/8')
```

For more details and examples, see the dedicated [CIDR Filtering](/j1ql/cidr-filtering.md) guide.

## Date comparisons

The query language also supports both relative and static date comparisons on any timestamp property. The timestamp property used for date comparison must be stored as an epoch number in milliseconds.

To verify that the date value is stored in JupiterOne correctly, use the following query as an example way to find out:

Verifying the date value

```md
FIND {Entity class or type} AS x 
RETURN x.createdOn, x.createdOn AS storedValue
```

The results for this query should contain the following:

1.  The first column(`x.createdOn`) shows the datetime value formatted for the UI. If the value is returned following this syntax: `yyyy-mm-ddThh:mm:ss.sssZ`, then we know that the stored value is an epoch number.
    
2.  The second column (`storedValue`) will show the value as stored in the database. This value should be returned as a 13-digit number.
    

If either of the above conditions is not true, then the values uploaded to the JupiterOne platform should be updated to include the epoch number prior to executing date comparison queries.

### Relative date comparisons

Relative date comparison allows filtering based on the current datetime. For example:

Relative date comparison

```md
FIND DataStore WITH createdOn > DATE.now - 1 day
```

The following units are supported for relative date comparisons in J1QL:

-   `hour`, `hr`, `hours`, `hrs`
-   `day`, `days`
-   `month`, `mo`, `months`, `mos`
-   `year`, `yr`, `years`, `yrs`

### Static date comparisons

In contrast to relative date comparisons, static date comparison allow to filter based on a specified datetime. For example:

Static date comparison

```md
FIND DataStore WITH createdOn > DATE(2019-10-30)
```

The static date must be specified in ISO 8601 format:

-   `DATE(YYYY)`
-   `DATE(YYYY-MM)`
-   `DATE(YYYY-MM-DD)`
-   `DATE(YYYY-MM-DDThhTZD)`
-   `DATE(YYYY-MM-DDThh:mmTZD)`
-   `DATE(YYYY-MM-DDThh:mm:ssTZD)`
-   `DATE(YYYY-MM-DDThh:mm:ss.sTZD)`

### Date boundary functions

Date boundary functions snap a date to the start or end of a calendar period. They eliminate the need to hardcode dates in queries that reset on a monthly, weekly, quarterly, or yearly cadence—such as dashboard widgets designed to report on the current month's data.

Eight functions are available:

| Function | Returns |
| --- | --- |
| `startOfWeek(date)` | First moment of the week containing `date` (weeks start on Sunday) |
| `endOfWeek(date)` | Last moment of the week containing `date` |
| `startOfMonth(date)` | First moment of the month containing `date` |
| `endOfMonth(date)` | Last moment of the month containing `date` |
| `startOfQuarter(date)` | First moment of the calendar quarter containing `date` (Q1 = Jan–Mar) |
| `endOfQuarter(date)` | Last moment of the calendar quarter containing `date` |
| `startOfYear(date)` | First moment of the year containing `date` |
| `endOfYear(date)` | Last moment of the year containing `date` |

**Accepted arguments:** The argument must be a J1QL date value—either `DATE.now` or an explicit `DATE(...)` expression. Bare string literals such as `'2026-06-15'` are not accepted.

These functions compose with existing relative offsets, so you can express things like "the first day of last month" without any hardcoding:

Composing a boundary function with a relative offset

```j1ql
startOfMonth(DATE.now - 1 month)
```

Date boundary functions are usable in `WITH` filters and in `RETURN`.

#### Example queries

Critical vulnerabilities opened this month (auto-resets each month)

```j1ql
FIND Finding WITH severity = 'critical' AND open = true
  AND createdOn > startOfMonth(DATE.now)
```

All findings in last month, first day through last day

```j1ql
FIND Finding
  WITH createdOn >= startOfMonth(DATE.now - 1 month)
    AND createdOn <= endOfMonth(DATE.now - 1 month)
```

Year-to-date findings by severity (dashboard widget)

```j1ql
FIND Finding WITH createdOn > startOfYear(DATE.now)
  RETURN Finding.severity AS sev, count(Finding) AS n ORDER BY n DESC
```

Evidence collected in the quarter containing a fixed audit date

```j1ql
FIND Evidence
  WITH collectedOn >= startOfQuarter(DATE(2026-02-01))
    AND collectedOn <= endOfQuarter(DATE(2026-02-01))
```

Access keys created last week

```j1ql
FIND AccessKey
  WITH createdOn >= startOfWeek(DATE.now - 7 days)
    AND createdOn <= endOfWeek(DATE.now - 7 days)
```

---

Source: /j1ql/filtering-behavior

# Filtering behavior

JupiterOne aligns its query language with [De Morgan's Law](https://en.wikipedia.org/wiki/De_Morgan%27s_laws). This standard mathematical theory is two sets of rules or laws developed from Boolean expressions for `AND`, `OR`, and `NOT` gates, using two input variables, A and B. These two rules or theorems allow the input variables to be negated and converted from one form of a Boolean function into an opposite form. J1QL uses this law in filtering the results of queries.

When you use a `!=` followed by a set of arguments offset by parentheses, such as `!= (A or B or C)`, it is equivalent to the expression `!= A and != B and != C`. For example:

```j1ql
FIND jira_user WITH accountType != ("atlassian" OR "app" OR "customer")
```

This query above is equivalent to the following:

```j1ql
FIND jira_user WITH accountType != "atlassian" AND accountType != "app" AND accountType != "customer"
```

#S# Interpretation

In the above example, J1QL interprets the query to return all `jira_user` assets, excluding those that have an accountType value of `atlassian` or `app` or `customer`. The following tables show the resulting truth values of a complex statement that are all possible for a simple statement in both positive and negative states:

#### Truth table

| Entity | "fruit" | "nut-filled" | \=("fruit" AND "nut-filled") | \=("fruit" OR "nut-filled") |
| --- | --- | --- | --- | --- |
| "fruit" | true | false | false | true |
| "nut-filled" | false | true | false | true |
| "fruit", "nut-filled" | true | true | true | true |
| "non-fruit" | false | false | false | false |
| "non-fruit", "plain" | false | false | false | false |
| undefined | false | false | false | false |

#### Truth table with negated queries:

| Entity | "fruit" | "nut-filled" | !=("fruit" AND "nut-filled") | !=("fruit" OR "nut-filled") |
| --- | --- | --- | --- | --- |
| "fruit" | true | false | true | false |
| "nut-filled" | false | true | true | false |
| "fruit", "nut-filled" | true | true | false | false |
| "non-fruit" | false | false | true | true |
| "non-fruit", "plain" | false | false | true | true |
| undefined | false | false | true | true |

## Property filtering

In J1QL, property filtering allows you to filter entities based on multiple property values. This is achieved using parentheses to group values and the `OR` operator to include any of the specified values. Here are a few examples of filtering by property:

Filtering by property

```md
FIND user_endpoint WITH platform = ("darwin" OR "linux")

FIND Host WITH tag.Environment = ("A" or "B" or "C")

FIND DataStore WITH classification != ("critical" and "restricted")
```

When applying property filters, J1QL follows a specific order of operations: parentheses are evaluated first, followed by comparisons such as equals (`=`), greater than or equal to (`>=`), less than or equal to (`<=`), and not equals (`!=`). Finally, AND and OR operators are evaluated in that order. This ensures proper evaluation of complex property filters in your queries.

## Metadata filtering

Filtering on metadata can often be useful in performing security analysis. The example below is used to find network or host entities that did not get ingested by an integration instance. In other words, these are entities that are likely "external" or "foreign" to the environment.

```j1ql
FIND (Network|Host) WITH _IntegrationInstanceId = undefined
```

The following would find all brand new code repos created within the last 48 hours:

```j1ql
FIND CodeRepo WITH _beginOn > DATE.now - 24 hours AND _version = 1
```

By leveraging metadata properties, such as integration instance IDs or creation timestamps, it becomes possible to filter and focus on specific subsets of assets based on their metadata characteristics.

For more details on metadata properties, see the JupiterOne [data model documentation](/data-model/jupiterone-data-model.md).

## Post-Aggregation Filtering

The `HAVING` clause in J1QL allows you to filter the results of a query based on aggregate values of the assets or relationships returned. It is used to specify conditions that must be met for a row to be included in the result set. The `HAVING` clause is often used in conjunction with aggregate functions in the `RETURN` clause to filter the results of aggregate functions.

Example query finding Hosts and Devices with an average finding score greater than 7:

HAVING query

```j1ql
FIND (Device|Host) AS h
  THAT HAS Finding AS f
RETURN h.displayName, h.fqdn, AVG(f.numericSeverity) AS avgSeverity
HAVING avgSeverity > 7
```

For more details on post-aggregation filtering, see the [HAVING](/j1ql/basic-keywords.md#having) clause.

---

Source: /j1ql/math-operations-expressions

# Math operations and expressions

J1QL provides robust mathematical capabilities for performing calculations and transformations on returned values, including standard operations like addition, subtraction, multiplication, and division. By leveraging parentheses, you have control over the order of operations to achieve precise results. Additionally, J1QL offers a range of mathematical expressions as functions, empowering advanced calculations and analysis to extract valuable insights from your data. These mathematical features enhance the flexibility and analytical power of J1QL in querying and manipulating numerical data.

## Math operations

J1QL provides support for fundamental mathematical operations on returned values, including addition (`+`), subtraction (`-`), division (`/`), multiplication (`*`), and the use of parentheses `()` to control the order of operations. The evaluation follows the standard order of operations: parentheses, multiplication or division, and then addition or subtraction.

> **NOTE**
> 
> These operations are designed for numerical values and do not work with strings or string representations of numbers.

Math operations example query

```md
FIND (aws_db_cluster_snapshot|aws_db_snapshot) AS snapshot
RETURN snapshot.displayName, snapshot.allocatedStorage * 0.02 AS Cost
```

You can also combine math operations with aggregate functions. You can [learn more about aggregate functions here](/j1ql/aggregate-functions.md).

Combining a math operation with an aggregate function

```md
FIND (aws_db_cluster_snapshot|aws_db_snapshot) AS snapshot
RETURN snapshot.tag.AccountName as Account, sum(snapshot.allocatedStorage) * 0.02 AS EstimatedCost
```

Calculations can also be made with date time fields. When calculating the difference between two dates in days, the date field will automatically be converted to the millisecond epoch. In order to return this difference in hours it will require dividing by 3600000 (number of milliseconds in an hour). In order to convert that hour into days, multiply by 24.

Calculations with date time fields

```md
FIND Finding AS f 
RETURN f.displayName, (f.closedOn - f.createdOn) / (3600000 * 24) AS differenceInDays
```

## Math expressions

Below is an outline of the supported mathematical expression within J1QL:

### Exponents

A quantity representing the power to which a given number or expression is to be raised, usually expressed as a raised symbol beside the number or expression (e.g. 3 in 23 = 2 × 2 × 2).

```j1ql
FIND Risk AS r
RETURN r.probability, r.probability ^ 2
```

### Absolute (ABS)

Absolute value, the magnitude of a real number without regard to its sign.

```j1ql
FIND Risk AS r
RETURN ABS(r.impact - 5) / r.probability
```

### Square Root (SQRT)

Square root, a number which produces a specified quantity when multiplied by itself.

```j1ql
FIND Risk AS r
RETURN r.displayName, SQRT((5 - r.impact) ^ 2 + (5 - r.probability) ^ 2) AS score
ORDER BY score ASC
```

### Ceiling (CEIL)

Round up to the next closest whole number.

```j1ql
FIND DataStore WITH allocatedStorage > 0 AS d
RETURN d.displayName, CEIL(d.allocatedStorage / 1000) AS allocatedMb
```

### Floor (FLOOR)

Round down to next closes whole number.

```j1ql
FIND Risk AS r
RETURN FLOOR(ABS(r.impact - 5) / r.probability)
```

### Round (ROUND)

Round up or down to the next closes whole number.

```j1ql
FIND DataStore WITH backupSizeBytes > 0 AS d
RETURN d.displayName, ROUND(d.backupSizeBytes / d.backupsCount) AS averageBackupSize
```

### Coalesce (COALESCE)

Use the first found value. Provide a list of values and the first value to not be undefined/null will be used.

```j1ql
FIND (aws_s3_bucket|aws_dynamodb_table) AS store
RETURN store._type, store.displayName, COALESCE(store.backupSizeBytes, store.bucketSizeBytes, 0) / 1000 AS kb
```

### Concatenate (CONCAT)

Concatenates field values into a single field, allows math expressions.

```j1ql
FIND (aws_s3_bucket|aws_dynamodb_table) AS store
RETURN store._type, store.displayName, CONCAT(COALESCE(store.backupSizeBytes, store.bucketSizeBytes, 0) / 1000, ' kb') AS size
```

### To Integer (TOINT)

Casts field values to an integer. Note, values that cannot be converted to an integer will return undefined.

```j1ql
FIND (aws_s3_bucket|aws_dynamodb_table) AS store
RETURN TOINT(COALESCE(store.backupSizeBytes, store.bucketSizeBytes, 0)) AS size
```

---

Source: /j1ql/optional-traversals

# Optional traversals

Optional traversals in J1QL allow for the inclusion of related assets in query results, marked by wrapping a portion of the query with `({query_portion})?`. This feature enables combining entities from graph traversals and applying additional constraints.

Optional traversal example:

```j1ql
FIND User
  (THAT IS Person)?
```

In the above example, we search for `User` entities and optionally traverse an `IS` relationship to a `Person` entity. If the relationship exists, the related `Person` entities are added to the list of results.

#### Relationships can still be chained within an optional traversal:

The query below will return a list of `Device` entities owned by a `Person` that is a `User` and `User` assets that do not have an indirect relationship to the `Device`.

```j1ql
FIND User
  (THAT IS Person
    THAT OWNS Device)?
```

#### Relationships that come after an optional traversal are processed on the combined results:

This query searches for `Users` or `UserGroups` that directly assigned an `AccessPolicy` granting admin permissions to certain resources, or via an `AccessRole` assigned to the `User`/`UserGroup`.

```j1ql
FIND (User|UserGroup)
  (THAT ASSIGNED AccessRole)?
  THAT ASSIGNED AccessPolicy
  THAT ALLOWS AS permission *
WHERE permission.admin = true
RETURN TREE
```

#### Optional traversals can also be chained:

The combined results from each previous optional traversal will be used in the next optional traversal. The below query will find `User` assets, `Person` assets that have an `IS` relationship to the `User` and `Device` assets that are owned by `Person` and `User` assets from the previous optional traversal.

```j1ql
FIND User
  (THAT IS Person)?
  (THAT OWNS Device)?
RETURN User, Person, Device
```

#### The optional traversals can also be aliased:

This allows entities to be used when returning results and when applying constraints. The following query illustrates aliasing an optional traversal.

```j1ql
FIND User
  (THAT IS Person AS p)?
  THAT OWNS Device AS d
WHERE p.email = "test@jupiterone.com"
RETURN p.displayName, d.displayName
```

Traversals performed within the `()?` function as normal graph traversals, so `WITH` filters can still be applied to assist with narrowing results:

```j1ql
FIND User
  (THAT IS Person WITH email = "test@jupiterone.com" AS p)?
  THAT OWNS Device AS d
RETURN p.displayName, d.displayName
```

> **WARNING**
> 
> Historically it has been possible to use optional traversal aliasing to alias a union of entities. This behaviour was poorly defined and is deprecated from Feburary 2024.
> 
> Example:
> 
> ```j1ql
> FIND User
>   (THAT IS Person)? AS personOrUser
> RETURN personOrUser.displayName, personOrUser._class
> ```

---

Source: /j1ql/pagination-and-sorting

# Pagination and sorting

Sorting and pagination commands in J1QL, such as `ORDER BY`, `SKIP`, and `LIMIT`, provide efficient ways to organize and navigate query results. By utilizing `ORDER BY`, you can sort entities based on specific fields, while `SKIP` allows you to skip a certain number of results, and `LIMIT` determines the maximum number of results to be returned. These commands enable fine-grained control over result presentation and facilitate targeted analysis of data.

> **NOTE**
> 
> That by default, queries will return up to 250 results if no `LIMIT` is specified.

In the example below, the query sorts users by their username and returns the 11th-15th users from the sorted list:

```j1ql
FIND Person WITH manager = undefined as u
  ORDER BY u.username SKIP 10 LIMIT 5
```

## Ascending and Descending Order

By default, `ORDER BY` sorts in ascending order (ASC). You can explicitly specify the sort direction using `ASC` or `DESC`.

### Ascending Order (Default)

The following query sorts AWS IAM users by creation date in ascending order (oldest to newest):

```j1ql
FIND aws_iam_user AS u
  ORDER BY u.createdOn
  LIMIT 10
```

### Explicit Ascending Order

You can explicitly specify ascending order:

```j1ql
FIND aws_iam_user AS u
  ORDER BY u.createdOn ASC
  LIMIT 10
```

### Descending Order

To sort in descending order (newest to oldest):

```j1ql
FIND aws_iam_user AS u
  ORDER BY u.createdOn DESC
  LIMIT 10
```

### Multiple Sort Fields

You can sort by multiple fields with different directions:

```j1ql
FIND User AS u
  ORDER BY u.active DESC, u.username ASC
  LIMIT 20
```

This query first sorts users by active status (active users first), then sorts by username alphabetically within each status group.

### Ordering by Aggregation Results

For aggregate queries, use the following pattern to sort results:

```j1ql
FIND User AS u 
  RETURN u.username, u.mfaEnabled
  ORDER BY u.mfaEnabled DESC 
  LIMIT 10
```

This returns users sorted by their MFA status (enabled users first), which is useful for compliance reports.

---

Source: /j1ql/path-finding

# Path Finding functions

The ability to find routes through the graph between interesting assets can be accomplished through Path Finding functions.

## SOMEHOW ALPHA

> **WARNING**
> 
> This feature is currently in ALPHA and breaking changes are planned. We are making it available now to all customers as it does solve some interesting problems, but do not rely on it for critical workflows at this time.

The `SOMEHOW` function is used to find paths through the graph between interesting assets, where you may not know the intermediate nodes or relationships.

> **IMPORTANT**
> 
> The "entry" and "exit" points of a SOMEHOW query must be small sets of assets, ideally a single asset. Broad targets will likely return no results.

Query Syntax:

```text
FIND <source entity>
  THAT SOMEHOW <depth> <relationship classes> <target entity>
RETURN TREE
```

-   `source entity` is the starting point of the path, and should ideally be a single asset
-   `relationship classes` is a collection of relationship classes to traverse, such as `RELATES TO`, `(HAS|IS)`, or `ALLOWS`
-   `depth` is the maximum number of intermediate nodes to traverse, defaulting to 5 with a maximum of 10
-   `target entity` is the ending point of the path, and should ideally be a single asset

### Example: Finding paths between Google Cloud Organizations and Google Cloud Projects via intermediate Google Cloud Folders

```j1ql
FIND google_cloud_organization
  THAT SOMEHOW HAS google_cloud_project
RETURN TREE
```

![SOMEHOW Example google org path finding](/assets/images/somehow-google-org-path-finding-ac7becaa923a84f4ba9c02feecef36ba.png)

This produces all the intermediate nodes between the Google Cloud Organization and Google Cloud Project, that use the `HAS` relationship class. It includes more than just the intermediate Google Cloud Folders, which is a limitation of the current implementation and will be addressed as part of the Alpha program.

### Example: Finding how Person entities may relate to the github\_account

```j1ql
FIND Person
  THAT SOMEHOW RELATES TO github_account
RETURN TREE
```

![SOMEHOW Example person to github account](/assets/images/somehow-person-to-github-account-acf40251efe7a5c39707218b9f1a2f12.png)

This gives a good summary of the potential relationships. It's likely that this query hit the internal limit of 250 intermediate nodes, but it still provides a good summary of the potential relationships. Again, this is a known limitation of the current implementation and will be addressed as part of the Alpha program.

There are some important limitations to be aware of at this time:

-   The `SOMEHOW` function has an internal limit of 250 intermediate nodes in a path. This is to prevent runaway queries. Currently the system cannot tell you if you have hit this limit. Getting no results does NOT mean there are no paths between the two assets.

---

Source: /j1ql/queries/apps-and-processes

# Apps and processes

### What certificates are installed/being used?

_Host level certificates details to be added later. You can query for ACM certificates in AWS._

```j1ql
Find Certificate
```

```j1ql
Find * that (HAS|USES) Certificate return tree
```

### What certificates are used for which service?

_Host level certificates details to be added later. You can query for ACM certificates in AWS._

Returns a graph of the resources that uses certificates

```j1ql
Find Certificate that relates to * return tree
```

Find certificates that are set to expire within 30 days

```j1ql
Find Certificate with expiresOn < date.now + 30days
```

### What versions of software / applications do I have running?

_Requires integrations that provide application information. For example, SAML SSO applications from Okta, or macOS apps from Jamf._

```j1ql
Find Application as app
return app._type, app.displayName, app.status
```

> **NOTE**
> 
> To keep the entity data structure less noisy, different versions of the same Application are **not** stored as separate entities. Rather, the `version` data is kept on the relationship between the host or endpoint device that has installed the application.\_

```j1ql
Find unique * that (USES|INSTALLED) as installation Application as app
return app._type, app.displayName, installation.version
```

### What software applications are not being used?

```j1ql
Find Application that !(ASSIGNED|USES) *
```

### When was the last time a service or server runtime was refreshed / updated / cycled?

Returns EC2 instances and the AMI images they are using, and the creation timestamp of the AMI:

```j1ql
Find Host as h that uses Image as i
  return
    h.tag.AccountName, h.displayName, h.instanceId,
    i.displayName, i.imageId, i.createdOn
  order by
    h.tag.AccountName
```

Returns Lambda functions and when they were last updated:

```j1ql
Find Function as f
  return f.tag.AccountName, f.displayName, f.updatedOn, f.lastModified
  order by f.tag.AccountName
```

---

Source: /j1ql/queries/aws-permissions

# AWS permissions and trusts

Below is a list of examples illustrating various ways in which you can effectively query you AWS-related data relating to both permissions and trusts.

> **NOTE**
> 
> If you have over 10,000 AWS resources in multiple AWS accounts, some query execution may take a long time or occasionally time out. Try limiting the query by adding `and tag.AccountName='account-name'` as part of the `WITH` entity property filter. Or use `LIMIT 100` at the end of the query for a smaller sample set of the results.

## IAM Policy Permissions

### Which policies allow access to production data?

```j1ql
find AccessPolicy as policy
  that allows as permission
    (aws_s3|aws_dynamodb|aws_rds|DataStore) with tag.Production=true as resource
return
  policy._type, policy.name,
  resource._type, resource.name, resource.tag.AccountName,
  permission.actions, permission.resources
```

### Who has admin access to production resources?

```j1ql
find (aws_iam_group|aws_iam_user|aws_iam_role) as principal
  that assigned AccessPolicy as policy
  that allows as permission
    * with tag.Production=true as resource
where permission.admin=true
  return
    principal._type, principal.name, principal.tag.AccountName,
    policy._type, policy.name,
    permission.actions, permission.resources,
    resource._type, resource.name, resource.tag.AccountName
```

## IAM Assume Role Trusts

### What are the cross-account trusts?

```j1ql
Find aws_iam_role as a
  that trusts (aws_account|aws_iam_role) as b
where a.tag.AccountName!=b.tag.AccountName
  return tree
```

### Are there assume role trusts to external entities?

```j1ql
Find aws_account as aws
  that HAS aws_iam
  that HAS aws_iam_role as role
  that TRUSTS (aws_iam_role|aws_iam_user|aws_iam_group|aws_account)
    with _source='system-mapper' as ext
  return
    aws.name, aws.accountId,
    role.roleName,
    ext.displayName, ext._type
```

### IAM Roles and Policies assigned to Okta SSO Users

```j1ql
Find okta_user as user
  that assigned aws_iam_role as role
  that assigned aws_iam_policy as policy
return
  role.name, policy.name, count(user) as userCount
order by userCount desc
```

### What IAM roles can active public facing EC2 instances assume?

```j1ql
find Internet
  that allows aws_security_group
  that protects aws_instance with active=true
  that uses aws_iam_role
  that assigned AccessPolicy
  return tree
```

##### _OR_

```j1ql
find (Network|Host) with _source='system-mapper'
  that allows aws_security_group
  that protects aws_instance with active=true
  that uses aws_iam_role
  that assigned AccessPolicy
  return tree
```

> **NOTE**
> 
> As seen above, the `(Network|Host) with _source='system-mapper'` portion of the query looks for `Network` or `Host` entities created by the `system-mapper` —- meaning those are networks and hosts **“external”** to your environment, not ingested by the integration.

## S3 Bucket permissions

### Are there non-public S3 buckets configured with public access to everyone?

```j1ql
Find aws_s3_bucket
  with classification!='public' or classification=undefined
  that ALLOWS everyone
```

### What are the cross account access to non-public S3 buckets?

```j1ql
Find aws_s3_bucket with classification != 'public' as a
  that allows * as b
where a.tag.AccountName != b.tag.AccountName
  return tree
```

### Who can read non-public S3 buckets in production?

```j1ql
Find (User|UserGroup|AccessRole)
  that assigned AccessPolicy
  that allows as permission
    (aws_s3|aws_s3_bucket) with
      classification!='public' and tag.Production=true
where permission.read=true
  return tree
```

### Which EC2 instances can read data from S3 via an IAM role?

```j1ql
find aws_instance
  that uses aws_iam_role
  that assigned AccessPolicy
  that allows as permission (aws_s3|aws_s3_bucket)
where permission.read=true
  return tree
```

## Other

### What are the Inline Policies in use?

```j1ql
Find (aws_iam_user|aws_iam_group|aws_iam_role) as u
  that (has|assigned)
    (aws_iam_user_policy|aws_iam_group_policy|aws_iam_role_policy) as p
return
  u.tag.AccountName, u._type, u.name, p.name
order by u.tag.AccountName
```

---

Source: /j1ql/queries/changes-and-attribution

# Changes and attribution

Below are some examples of how you might query your JupiterOne workspace data in order to identify changes that occurred in your environment.

### What changes were made in environment, SG or VPC in last time period ?

Find all changes in the last 24 hours:

```j1ql
Find * with _beginOn > date.now - 24 hours
```

Changes in the last 24 hours related to a particular VPC:

```j1ql
Find * with _beginOn > date.now - 24 hours
  that relates to aws_vpc with vpcId='{vpcId}' or name='{vpcName}'
```

Resources with a certain tag that change in the last 24 hours:

```j1ql
Find * with _beginOn > date.now - 24 hours
  and (tag.Environment = '{tagValue}' or tag.Project = '{tagValue}')
```

### Which developer(s) most likely introduced vulnerabilities in recent code changes?

_Requires integrations with [Github](/integrations/directory/github.md) or [Bitbucket](/integrations/directory/bitbucket.md), and code scanning solutions like [Veracode](/integrations/directory/veracode.md) or [WhiteHat](/integrations/directory/whitehat.md)._

```j1ql
Find User
  that OPENED PR with createdOn > date.now-7days
  that RELATES TO CodeRepo
  that HAS (Vulernability|Finding) with _createdOn > date.now-7days
return tree
```

---

Source: /j1ql/queries/data-security

# Data security

Below is a brief collection of example J1QL queries relating to surfacing data security findings.

### Show all resources without a data classification tag?

```j1ql
Find (Host|DataStore) with classification = undefined
```

Return a count instead:

```md
Find (Host|DataStore) with classification = undefined as e return count(e)
```

### Show all resources without a data classification tag in VPC with tag?

Filter by a tag on the VPC:

```md
Find (Host|DataStore|Workload) with classification = undefined
  that relates to aws_vpc with tag.{tagName} = '{tagValue}'
```

Filter by vpcId or name:

```md
Find (Host|DataStore|Workload) with classification = undefined
  that relates to aws_vpc with vpcId='{vpcId}' or name='{name}'
```

### What are all the resources without encryption with data security tag 'restricted'?

```j1ql
Find DataStore with encrypted!=true and classification='restricted'
```

Sometimes it is also interesting to

Find unencrypted data that is non-public:

```md
Find DataStore with encrypted!=true and classification!='Public'
```

### Aggregating Math Functions in the RETURN Clause

This query feature allows you to combine and deduplicate multiple scalar values into a single listing for a column/alias. You can combine multiple (defined) properties into a single property without having to choose to return one property or another.

```j1ql
FIND jira_issue WITH resolvedOn != undefined AND createdOn != undefined AS i 
RETURN AVG(i.resolvedOn - i.createdOn / 86400000) as 'Average Days to Close'
```

---

Source: /j1ql/queries/development

# Development

The queries below require either a [Github](/integrations/directory/github.md) or [Bitbucket](/integrations/directory/bitbucket.md) integration configuration in JupiterOne.

### Were there any Code Repos added in the last 24 hours?

```j1ql
Find CodeRepo with _beginOn > date.now-24hr and _version=1
```

### Which PRs did this developer open in the last 5 days?

For a developer whose first name is Charlie:

```text
'Charlie' that OPENED PR with _createdOn > date.now - 5days as PR
  return PR.displayName, PR.name, PR.webLink
```

Or, the following query is more accurate but it requires an IdP integration and proper mapping between the dev users and IdP users:

```j1ql
Find Person with firstName='Charlie'
  that IS (github_user|bitbucket_user)
  that OPENED PR with _createdOn > date.now - 5days as PR
return PR.displayName, PR.name, PR.webLink
```

### Who are the most recent contributors to this repo?

_This is particularly useful to identify who might be the best person to fix a newly discovered vulnerability._

```j1ql
Find User as u
  that OPENED PR as PR
  that HAS CodeRepo with name='repo-name' as repo
  return
    u.displayName, u.username,
    PR.displayName, PR.name, PR._createdOn, repo.name
  order by PR._createdOn
  limit 5
```

### What are the code repos for a particular application or project?

```j1ql
Find CodeRepo that relates to (Application|Project) with name='JupiterOne'
```

### Are there unapproved or self-approved code changes in the last week?

```j1ql
Find PR with
  approved=false and
  (createdOn > date.now-7days or updatedOn > date.now-7days)
```

### Are there code commits by an unknown developer in a PR?

```j1ql
Find PR with validated=false
```

---

Source: /j1ql/queries/identity-people-privileged-access

# Identity, people, and access

_Most of these queries depend on proper mapping of custom properties or profile attributes from your HR system or identity provider to the Person/employee entities._

### Who are the new hires within the last 12 months?

If you have been using JupiterOne for more than a year:

```j1ql
Find employee with _createdOn > date.now-12months
```

If your employee data source / user identity provider is Okta:

```j1ql
Find okta_user with created > date.now-12months
```

### Who are the contractors?

_Requires mapping from your HR system or IdP to capture the employment type._

```j1ql
Find employee with employment = 'contractor'
```

If you have a user group called 'Contractors':

```j1ql
Find User that (has|assigned) UserGroup
  with displayName='Contractors' or name='Contractors'
```

### Who are remote workers?

If the user or employee entity has a remote flag:

```j1ql
Find (User|employee) with remote=true
```

If you have a user group called 'Remote':

```j1ql
Find User that (has|assigned) UserGroup
  with displayName='Remote' or name='Remote'
```

### Who are the employees missing metadata about role?

```j1ql
Find employee with role=undefined
```

### Who are the employees missing metadata about team or department?

```j1ql
Find employee with department=undefined
```

```j1ql
Find employee that !relates to Team
```

### Who are the employees missing metadata about team or department with access to environment?

```j1ql
Find employee with department=undefined
  that is User
  that relates to (Account|AccessRole|UserGroup|Service)
    with tag.AccountName = '{accountName}'
```

### Who are the employees missing metadata about team or department with privileged access?

```j1ql
Find employee with department=undefined
  that is User
  that assigned (AccessPolicy|AccessRole) with admin=true
```

```j1ql
Find employee with department=undefined
  that is User
  that assigned AccessRole
  that assigned AccessPolicy with admin=true
```

### Who or what service has been assigned permissions with administrator/privileged access?

```j1ql
Find AccessPolicy with admin=true as policy
  that ASSIGNED * as e
  return policy.displayName, policy.webLink, e._type, e.displayName, e.webLink
```

### Who is able to make changes in a production data connected environment, and what changes can they make?

_We plan to do more in-depth analysis of AWS IAM policies to determine access. In the meantime, we determine admin access based on policy name and you can run the following query to find them._

```j1ql
Find AccessPolicy with admin=true and tag.AccountName='{accountName}' as policy
  that ASSIGNED (AccessRole|User) as e
return policy.displayName, policy.webLink, e._type, e.displayName, e.webLink
```

### What groups are an employee or contractor a member of?

```j1ql
'Joe Adams' as employee that relates to (Team|Group) as group
return
  employee._type, employee.displayName, employee.email,
  group._type, group.displayName
```

### What uses static authentication credentials (people, services) vs grant type credentials (saml, oidc)?

```j1ql
Find (User|UserGroup) that assigned AccessPolicy
```

```j1ql
Find AccessRole that assigned AccessPolicy
```

---

Source: /j1ql/queries/inventory-config

# Inventory and configuration

### What Workloads are in my environment?

```j1ql
Find Workload
```

```j1ql
Find Workload with tag.AccountName='{accountName}'
```

### What are my production systems and servers?

_(and what are those systems there to do?)_

```j1ql
Find (Host|Database) with tag.Production=true
```

```j1ql
Find (Host|Database) with tag.AccountName='{accountName}'
```

### What are my production resources?

Filter using production tag:

```j1ql
Find (Application|CodeRepo|Workload|Function|Task|Host|Device|Database|DataStore)
  with tag.Production=true
```

Filter using account name:

```j1ql
Find (Application|CodeRepo|Workload|Function|Task|Host|Device|Database|DataStore)
  with tag.AccountName='{accountName}'
```

You can also use `Find *` to cover everything but the results could be overwhelming.

### What are my production data stores and databases?

```j1ql
Find (DataStore|Database) with tag.Production=true
```

```j1ql
Find (DataStore|Database) with tag.AccountName='{accountName}'
```

### What are my production applications?

```j1ql
Find Application with tag.Production = true
```

```j1ql
Find Application with tag.AccountName='{accountName}'
```

### What are my network assets?

```j1ql
Find Network with _type!='mapped_entity'
```

Entities that are of type `'mapped_entity'` are resources that are not directly from the integrations.

You can use `_type='mapper_entity'` or `_source='system-mapper'` to find external resources:

```j1ql
Find Network with _source='system-mapper'
```

```j1ql
Find (Gateway|Firewall) with category='network'
```

### Which devices are/are not auto-scaling?

```j1ql
Find aws_instance that has aws_autoscaling_group
```

```j1ql
Find aws_instance that !has aws_autoscaling_group
```

### What information assets are missing metadata for data classification, tier of service or architectural tier?

```j1ql
Find (Host|DataStore|Workload|Task) with tag.Classification = undefined
```

### What applications and operating systems are in use?

```j1ql
Find Host as h return h.platform
```

_A 'Group By' capability will be added to J1QL soon to return objects or count by unique property values._

### Who owns a production system in account/zone/tier/layer/ VPC/SG?

```j1ql
Find (Host|DataStore|Workload|Task|Application)
  with tag.AccountName = '{accountName}' as system
return system.displayName, system.owner
```

```j1ql
Find (Host|DataStore|Workload|Task|Application) as system
  that relates to aws_vpc with vpcId='{vpcId}' or name='{vpcName}'
return system.displayName, system.owner
```

```j1ql
Find (Host|DataStore|Workload|Task|Application) as system
  that relates to aws_security_group with groupId='{sgId}' or name='{sgName}'
return system.displayName, system.owner
```

### How many systems were added to environment in last time period?

Example for last 24 hours time period:

```j1ql
Find * with _tag.AccountName='{accountName}' and _createdOn > date.now - 24hrs
```

### How many resources were added to manually vs automated?

Count entities added by its source:

```j1ql
Find * as e return e._source, count(e)
```

Source (`_source`) can be one of the following:

-   `integration-managed`: added via a provider integration
-   `powerup-managed`: added via a JupiterOne Powerup (currently endpoint compliance stethoscope agent)
-   `system-mapper`: added by the JupiterOne mapper (derived entities or external entities)
-   `api`: added manually by a JupiterOne user from either the webapp or API

### What container images, VM images, and software packages are available in my production environments?

Container entities/relationships are to be added when we support ECS, EKS, ECR and Fargate.

### What are the tags assigned to a particular inventory asset?

This is best viewed in the Asset app by selecting an entity and going to the Tags tab in the properties panel.

---

Source: /j1ql/queries/key-management

# Secrets and key management

### What SSH keys exist on system ?

Find all SSH keys in an AWS account:

```j1ql
Find aws_key_pair with tag.AccountName='{accountName}'
```

You can also use the abstract class:

```j1ql
Find AccessKey with usage='ssh' and tag.AccountName='{accountName}'
```

Find key usage and return a graph:

```j1ql
Find aws_key_pair that relates to Host return tree
```

Find key usage and return a table with specific properties:

```j1ql
Find aws_key_pair as key that relates to Host as h
return key.displayName,
  h.displayName, h.instanceId, h.region, h.classification, h.tag.AccountName
```

### What SSH keys exist on system without link to employee?

_The linkage will be mapped when we start processing cloudtrail events._

### What secrets (vault, kms, etc...) can a service access and what is that service able to do with them?

```j1ql
Find aws_kms_key that uses * return tree
```

---

Source: /j1ql/queries/network-zones

# Network connections and zones

### What network traffic is allowed between internal and external (i.e. between trusted and untrusted) networks?

```j1ql
Find Firewall as fw
  that ALLOWS as r (Network|Host) with
    internal=undefined or internal=false as n
return
  fw.tag.AccountName, fw._type, fw.displayName, fw.description,
  r.ipProtocol, r.fromPort, r.toPort,
  n.displayName, n.CIDR, n.ipAddress
order by
  fw.tag.AccountName
```

### What production resources are directly connected/exposed to the Internet/everyone?

```j1ql
Find (Internet|Everyone)
  that relates to * with
    tag.Production=true and
    _class!='Firewall' and
    _class!='Gateway' as resource
return
  resource.tag.AccountName, resource._type,
  resource.name, resource.description,
  resource.classification
order by
  resource.tag.AccountName
```

### What endpoints directly connected to the Internet?

```j1ql
Find aws_subnet with public=true as n
  that HAS aws_instance as i
  that PROTECTS aws_security_group as sg
  that ALLOWS as rule Internet
return
  n.displayName as subnet,
  i.displayName as instance,
  sg.displayName as SG, sg.groupId, sg.vpcId as VPC,
  sg.tag.AccountName as Account, sg.webLink,
  rule.ipProtocol, rule.fromPort, rule.toPort
```

Returns a graph instead using `return tree` at the end

```j1ql
Find aws_subnet with public=true as n
  that HAS aws_instance as i
  that PROTECTS aws_security_group as sg
  that ALLOWS as rule Internet
return tree
```

### What storage is directly connected to the internet?

Find databases that are public:

```j1ql
Find Database with public=true
```

Find data stores (including AWS S3 buckets) that allows public access:

```j1ql
Find DataStore that allows Everyone
```

### What are my proxies, relays or load balancers?

```j1ql
Find Gateway
```

Network layer gateways including AWS internet gateways, network load balancers, etc.:

```j1ql
Find Gateway with category='network'
```

Application layer gateways including API gateways, application load balancers, etc.:

```j1ql
Find Gateway with category='application'
```

More specifically, find AWS ELB application and network load balancers:

```j1ql
Find (aws_alb|aws_nlb)
```

### Which hosts have IP addresses in a specific network range?

Find all hosts with IPs in the `10.0.0.0/8` private range:

```j1ql
FIND Host WITH cidr(ipAddress, '10.0.0.0/8')
```

Find all hosts in any private network (RFC 1918):

```j1ql
FIND Host WITH cidr(ipAddress, '10.0.0.0/8')
  OR cidr(ipAddress, '172.16.0.0/12')
  OR cidr(ipAddress, '192.168.0.0/16')
```

Find hosts that are **not** in a private network (potentially public-facing):

```j1ql
FIND Host WITH !cidr(ipAddress, '10.0.0.0/8')
  AND !cidr(ipAddress, '172.16.0.0/12')
  AND !cidr(ipAddress, '192.168.0.0/16')
```

### Are there potential IP collisions among the networks/subnets in my environment?

Find subnets within the same VPC that have the same CIDR:

```j1ql
Find Network as n1 that has aws_vpc as env that has Network as n2
where
  n1.CIDR=n2.CIDR
return
  n1.displayName, n1.CIDR, n1.region,
  n2.displayName, n2.CIDR, n2.region,
  env.displayName, env.tag.AccountName
order by env.tag.AccountName
```

Find VPCs in the same AWS account that have the same CIDR:

```j1ql
Find aws_vpc as n1
  that has (Account|Service) as env
  that has aws_vpc as n2
where
  n1.CIDR=n2.CIDR
return
  n1.displayName, n1.CIDR, n1.region,
  n2.displayName, n2.CIDR, n2.region,
  env.displayName, env.tag.AccountName
order by env.tag.AccountName
```

Filters out default VPCs:

```j1ql
Find aws_vpc with defaultVpc!=true as n1
  that has (Account|Service) as env
  that has aws_vpc with defaultVpc!=true as n2
where n1.CIDR=n2.CIDR
return
  n1.displayName, n1.CIDR, n1.region,
  n2.displayName, n2.CIDR, n2.region,
  env.displayName, env.tag.AccountName
order by env.tag.AccountName
```

### Are wireless networks segmented and protected by firewalls?

_Requires an integration such as Cisco Meraki, or by adding the wireless network configuration information via the J1 API._

```j1ql
Find Network with wireless=true as n
  that (HAS|CONTAINS|CONNECTS|PROTECTS) (Gateway|Firewall)
    with category='network' as g
  that (CONNECTS|ALLOWS|PERMITS|DENIES|REJECTS) as r *
return
  n.displayName as Network, n._type as NetworkType,
  n.cidr as CIDR, n.environment as Environment,
  g.displayName as Gateway, g._type as GatewayType,
  r._class, r.ipProtocol, r.fromPort, r.toPort
```

### Are there VPN configured for remote access?

Performs a full text search to see if any indexed data that matches the search string 'vpn' is a VPN Host, a VPN Device, a VPN Network or a VPN Gateway:

```j1ql
'vpn' with
  _class=('Host' or 'Device' or 'Network' or 'Gateway')
```

### Is there proper segmentation/segregation of networks?

```j1ql
Find Network with internal=true as n
  that (HAS|CONTAINS|CONNECTS|PROTECTS) (Gateway|Firewall)
    with category='network' as g
return
  n.displayName as Network,
  n._type as NetworkType,
  n.CIDR as CIDR,
  n.tag.AccountName as Account,
  n.internal as Internal,
  g.displayName as Gateway,
  g._type as GatewayType
```

### Show all inbound SSH firewall rules across my network environments.

```j1ql
Find Firewall as fw
  that ALLOWS as rule * as src
where rule.ingress=true and
  rule.ipProtocol='tcp' and
  rule.fromPort<=22 and rule.toPort>=22
return
  fw.displayName,
  rule.ipProtocol, rule.fromPort, rule.toPort,
  src.displayName, src.ipAddress, src.CIDR
```

### Is inbound SSH allowed directly from an external host or network?

```j1ql
Find Firewall as fw
  that ALLOWS as rule (Host|Network)
    with internal=false or internal=undefined as src
where
  rule.ingress=true and rule.ipProtocol='tcp' and
  rule.fromPort<=22 and rule.toPort>=22
return
  fw.displayName,
  rule.fromPort, rule.toPort,
  src.displayName, src.ipAddress, src.CIDR
```

### Show listing of network layer firewall protection or SGs across all my environments.

```j1ql
Find Firewall as f that PROTECTS Network as n
return f.displayName as firewall, n.displayName as network
```

```j1ql
Find Firewall with category='network'
```

---

Source: /j1ql/queries/risk-vuln-mgmt

# Vulnerability management

### Which applications or code repos are vulnerable?

_Requires at least one application scanner integration such as Veracode or WhiteHat._

```j1ql
Find (Application|CodeRepo) as app that has (Finding|Vulnerability) as vuln
return
  app._type, app.displayName,
  vuln._type, vuln.displayName, vuln.severity, vuln.numericSeverity
```

### Which systems/instances are vulnerable?

_Requires enabling AWS Inspector, GuardDuty, Tenable or similar integration._

```j1ql
Find (Host|Workload|DataStore) as system
  that has (Finding|Vulnerability) as vuln
return
  system._type, system.displayName,
  vuln._type, vuln.displayName, vuln.severity, vuln.numericSeverity
```

### What open vulnerabilities do I have?

```j1ql
Find (Finding|Vulnerability) with open=true
```

_This is best viewed in the **Alerts** app under **Open Findings** tab._

### What vulnerabilities are suppressed/resolved/marked as exception?

Similar, you can query for vulnerability findings that are resolved/suppressed or marked as exception:

```j1ql
Find (Finding|Vulnerability)
  with open=false or suppressed=true or exception=true
```

### Do I have proper vendor support for my software applications?

_Requires integration with Okta or OneLogin or similar SSO identity provider._

This returns data that is derived from a SSO application:

```j1ql
Find Application as app that
  CONNECTS Account that RELATES TO Vendor as v
return app.displayName as app, v.name as vendor, v.linkToSLA, v.linkToMSA
```

Or in a more generic way:

```j1ql
Find Application that RELATES TO (Vendor|Account)
```

Returns all applications that does not have a vendor or vendor account associated:

```j1ql
Find Application that !RELATES TO (Vendor|Account)
```

### Are all system images updated in the past six months?

Find images that have been updated within 6 months:

```j1ql
Find Image with createdOn > date.now - 6 months
```

Find images that have not be updated within 6 months:

```j1ql
Find Image with createdOn < date.now - 6 months
```

### What are the approved server/system images?

Find private images or the ones that have been specifically approved:

```j1ql
Find Image with public=false or approved=true
```

### Who are my vendors? Do I have a BAA/DPA/NDA/MSA and SLA/Support Agreement with them?

```j1ql
Find Vendor
```

_This is best viewed in the Asset Inventory app by selecting the Vendor class from the quick filter._

---

Source: /j1ql/queries/servers-endpoints

# Servers and endpoints

## Who is responsible for patching a system in account/zone/tier/layer/VPC/SG?

Returns the owner of hosts in a particular account:

```j1ql
Find Host with tag.AccountName = '{AccountName}' as h
  return h.displayName, h.owner
```

Returns the owner of images used by hosts in a particular account:

```j1ql
Find Host with tag.AccountName = '{AccountName}' as h
  that uses Image as i
  return h.displayName, h.owner, i.displayName, i.owner
```

## Which devices are not compliant?

```j1ql
Find HostAgent with compliant=false as agent
  that (MONITORS|MANAGES|PROTECTS) Device as device
return
  agent._type, agent.displayName, agent.status, agent.compliant,
  device._type, device.displayName, device.hostname,
  device.platform, device.platformName, device.osVersion,
  device.hardwareModel, device.owner
```

---

Source: /j1ql/queries/training

# User training

### Which users have not completed assigned training?

_Requires training data from KnowBe4 or similar._

```j1ql
Find Training as t
  that assigned as enrollment User as u
where enrollment.completedOn = undefined
return u.first_name, u.last_name, u.email, t.name
```

### Is there any user with AWS access that hasn't completed certain training?

_The following example specifies `aws_iam_user` and `knowbe4_user`, requiring AWS and KnowBe4 integrations._

_Additionally, this requires proper mapping between User and Person entities._

```j1ql
Find aws_iam_user
  that is Person
  that is knowbe4_user
  that !completed Training with
    name='training name' or campaign='campaign name'
```

If SAML is used to connect an SSO user (e.g. Okta user) to an AWS IAM Role:

```j1ql
Find aws_iam_role as r
  that assigned User as u
  that is Person as p
  that is knowbe4_user
  that !completed Training with
    name='training name' or campaign='campaign name'
return r.displayName, u.displayName, p.displayName, p.email
```

### Is there any developer who has not completed "Secure Development" training?

_The following example specifies `bitbucket_user`, `github_user`, and `knowbe4_user`, which requires Bitbucket or GitHub, in addition to KnowBe4 integrations._

_Additionally, this requires proper mapping between User and Person entities._

```j1ql
Find (bitbucket_user|github_user)
  that is Person
  that is knowbe4_user
  that !completed Training with
    name='Secure Development' or campaign='Secure Development'
```

---

Source: /j1ql/regular-expressions

# Regular Expressions

Regular Expressions (regex) can be used in J1QL to filter against properties and to extract values using named capture groups in `RETURN` statements.

## Example Queries

### All Administrator Roles

Find all roles called `Administrator` using a case-insensitive search on the role name

```j1ql
FIND AccessRole WITH name = /administrator/i
```

### All AWS Policies Allowing Create or Delete

Find all AWS entities that are related by an ALLOW policy which includes Update and Delete permission flags

```j1ql
FIND * WITH _integrationType = "aws"
  THAT ALLOWS >> AS r *
WHERE r.permissionFlags = /..UD.../
RETURN TREE
```

## Supported Features

The features available today are restricted based on what is supported by the upstream storage services, and what is considered to be safe in regex for performance and complexity.

### Character Classes

Standard character classes are supported:

-   `[0-9]`
-   `[a-zA-Z]`
-   `[a-zA-Z0-9]`

Some shorthand classes are also supported:

-   `\d`
-   `\D`
-   `\w`
-   `\W`

The following are currently NOT supported:

-   `\s` and `\S` these whitespace shorthand classed are not supported. You can use a literal space in your regex.
-   POSIX character classes such as `[:digit:]`
-   Literal whitespace in the regex needs to be in a character class. For example `/john[ ]smith/` to match the string `john smith`.

> **INFO**
> 
> The limitation on use of `\s` and `\S` and whitespace is due to the regex implementaion in ElasticSearch. This limitation is expected to be resolved soon.

### Anchor Tags

The start `^` and `$` anchor tags are not supported at this time, although regex filters can be combined with the `^=` starts with and `$=` ends with comparison operators:

```j1ql
FIND User WITH name ^= /john/i
```

```j1ql
FIND User WITH name $= /smith/i
```

### Alternation

Regular expression `|` alternation is not supported, although multiple regex filters can be applied to the same field using the J1QL `AND` and `OR` syntax:

```j1ql
FIND User WITH (name = /john/i OR name = /smith/i)
```

### Other Unsupported Features

Regex has many features, some additional not currently supported features:

-   Lookarounds
-   Atomic Groups
-   Possessive Quantifiers

## Named capture groups

Named capture groups are only supported in `RETURN` statements and only supported by invoking the `REGEX` function.

The `REGEX` function takes two parameters:

1.  The property to search
2.  The regex to search with

`REGEX` requires that the regex argument has a named capture group. Anything else will fail to parse.

### Capture group names

Capture group names _must only_ be made up of letters. Anything else will fail to parse.

### Return values

The `REGEX` function extracts named capture group values from each entity's property. Each capture group becomes its own column in the result, with the capture group name as the column name. The entirety of the match **will not** be included _unless the `REGEX` function itself is aliased._

Entities where the property does not match the regex pattern will still appear in the results, with `null` values for the capture group columns and alias.

In practice, that means that

```j1ql
FIND User as u RETURN REGEX(u.username, '(?<firstLetter>\w).*')
```

will return a single column `firstLetter` that contains the first letter of the username for each user. Users whose username does not match the pattern will have a `null` value for `firstLetter`.

```j1ql
FIND User as u RETURN REGEX(u.username, '(?<firstLetter>\w).*(?<lastLetter>\w)') as username
```

returns three columns: `firstLetter` which contains the first letter of the match, `lastLetter` which contains the last letter of the match, and `username` which contains the entirety of the match. For non-matching entities, all three columns will be `null`.

---

Source: /j1ql/resolving-duplicate-results

# Resolving duplicate results

Sometimes a query may generate duplicate results. This duplication occurs if there are multiple paths of traversals (such as relationships) between the vertices (such as assets) referenced in a specific query. For example:

```j1ql
FIND aws_eni WITH publicIpAddress != undefined AS nic
  THAT RELATES TO aws_instance
  THAT RELATES TO aws_security_group AS sg THAT allows Internet
WHERE nic.securityGroupIds = sg.groupId
```

This query attempts to find network interfaces associated with a security group that allows public-facing AWS EC2 instances. In this case, there could be multiple security group rules allowing access to/from the Internet, which may result in duplicate data in the query result because each individual traversal is a successful match to the query. This issue can be resolved by leveraging `UNIQUE` and `RETURN`.

## UNIQUE and RETURN

You can use a combination of `UNIQUE` and `RETURN` keywords to filter out the duplicates. We can modify the above example query to eliminate duplicate data within our results:

```j1ql
FIND UNIQUE aws_eni WITH publicIpAddress != undefined AS nic
  THAT RELATES TO aws_instance
  THAT RELATES TO aws_security_group AS sg THAT ALLOWS Internet
WHERE
  nic.securityGroupIds = sg.groupId
RETURN
  nic.id, nic.subnetId, nic.attachmentId,
  nic.active, nic.privateIp, nic.publicIp,
  nic.vpcId, nic.securityGroupIds, nic.securityGroupNames,
  nic.tag.AccountName, nic.webLink
```

> Limitation: `UNIQUE` keyword **must** be used together with `RETURN`.

The following query may return multiple rows containing the same values. In the below example, Peter Parker is using the same username across different applications:

```j1ql
FIND User AS u THAT IS Person AS p
RETURN u.username, p.firstName, p.lastName, p.email
```

| u.username | p.firstName | p.lastName | p.email |
| --- | --- | --- | --- |
| spiderman | Peter | Parker | [not.spiderman@example.com](mailto:not.spiderman@example.com) |
| spiderman | Peter | Parker | [not.spiderman@example.com](mailto:not.spiderman@example.com) |
| batman | Bruce | Wayne | [totally.not.batman@example.com](mailto:totally.not.batman@example.com) |
| bwayne | Bruce | Wayne | [totally.not.batman@example.com](mailto:totally.not.batman@example.com) |

Modifying the query to leverage the `UNIQUE` keyword will make the J1QL engine deduplicate rows:

```j1ql
FIND UNIQUE User AS u THAT IS Person AS p
RETURN u.username, p.firstName, p.lastName, p.email
```

| u.username | p.firstName | p.lastName | p.email |
| --- | --- | --- | --- |
| spiderman | Peter | Parker | [not.spiderman@example.com](mailto:not.spiderman@example.com) |
| batman | Bruce | Wayne | [totally.not.batman@example.com](mailto:totally.not.batman@example.com) |
| bwayne | Bruce | Wayne | [totally.not.batman@example.com](mailto:totally.not.batman@example.com) |

> **NOTE**
> 
> De-duplicating rows using the `UNIQUE` keyword will cause the`_meta` property returned for each row of data to be stripped out.

## MERGE

The function `MERGE()` allows you to merge multiple properties into a single property list. You can now combine multiple (defined) properties into a single property without having to choose to return one property or another.

```j1ql
FIND UNIQUE User AS u
THAT IS Person AS p
RETURN p.displayName, merge(p.email, u.email, u.publicEmail) AS "Email List"
```

---

Source: /j1ql/scalar-functions

# Scalar functions

The ability to format and/or perform calculations on row-level columns can be accomplished through Scalar Functions. These scalar functions enhance the versatility and convenience of J1QL by providing powerful tools for transforming and combining data in queries.

## CONCAT

The scalar function `CONCAT()` empowers users to concatenate or join one or more values into a single string. Currently, `CONCAT` can be used in the `RETURN` to the clause of your function, will future development is planned for use in the `WHERE` clause.

> If this function receives a number or boolean value, the `CONCAT` intuitively converts these values to strings. Additionally, if `CONCAT` processes an empty selector field, it evaluates that field as an empty string.

`CONCAT` supports the following parameters, separated by commas:

-   Selector Fields: `selector.field`
-   String values: `'your string'` or `"your string"`
-   Number values: `123`
-   Boolean values: `true`

Example using CONCAT

```j1ql
FIND
  aws_s3_bucket as s3
RETURN
  CONCAT(s3.bucketSizeBytes, ' bytes') as size
```

## MERGE

The scalar function `MERGE()` allows you to merge multiple properties into a single property list. You can now combine multiple (defined) properties into a single property without having to choose to return one property or another.

Example using MERGE

```j1ql
FIND UNIQUE User AS u
THAT IS Person AS p
RETURN p.displayName, merge(p.email, u.email, u.publicEmail) AS "Email List"
```

## DATETIME

The scalar function `DATETIME()` allows you to format timestamp values into human-readable date and time strings using custom format patterns. This function requires two arguments: a timestamp field and a formatting string.

> **NOTE**
> 
> The timestamp field must be a defined property on the entity. If the timestamp value is undefined when passed to the DATETIME() function, the function will not work properly and may throw an error or return unexpected results.

The `DATETIME` function accepts:

-   Timestamp field: A property containing an epoch timestamp in milliseconds
-   Format string: A string specifying the desired date/time format pattern (required)

Example using DATETIME

```j1ql
FIND DataStore AS ds
RETURN
  ds.displayName,
  DATETIME(ds._createdOn, "yyyy-MM-dd HH:mm:ss.SSSSZ") AS "Created Date",
  DATETIME(ds._beginOn, "hh:mm") AS "Time Modified"
```

You can also combine `DATETIME` with other scalar functions:

Combining DATETIME with CONCAT

```j1ql
FIND * AS s
RETURN CONCAT("Created at ", DATETIME(s._createdOn, "hh:mm")) AS "Creation Time"
LIMIT 10
```

For more information about the format string patterns, see the [Java DateTimeFormatter documentation](https://docs.oracle.com/javase/8/docs/api/java/time/format/DateTimeFormatter.html).

---

Source: /j1ql/smart-classes

# Smart classes

Smart classes are a mechanism for applying a set of asset filters within a shorthand syntax. JupiterOne administrators can create smart classes in the Assets app by navigating to the smart classes sub section.

> **INFO**
> 
> For detailed information covering setting up smart classes, see our [smart classes page](/features/assets/smart-classes.md).

## Querying Smart Classes

Smart classes should be considered as a subgraph of your entire graph that only contains entities with additional context captured in the smart class. The additional context can be business-related, like asset criticality or owner group, or technical, like whether the assets are EOL or publicly accessible. When building your posture management, vulnerability management, or compliance use cases, you can use the following query patterns to only query for assets that are in your smart class.

### Using Smart Class Instance

The first way to query smart classes is by directly referring to the smart class. Smart classes are queryable by using the hash character before the name of the smart class. Some example queries that follow this pattern include:

-   `FIND #Sev1`
-   `FIND Finding THAT HAS #Sev1`

### Using Smart Classes as a Filter

Beyond directly referencing the smart class as in the above example, it is also possible to use the smart class as a filter. For example, if you are only interested in your DataStores with a certain criticality, you could use the following queries:

-   `FIND #Sev1 DataStore`
-   `FIND AccessRole THAT ALLOWS #Sev1 aws_s3_bucket`

### Using Smart Class Tags

Finally, smart classes can also be referenced by using tags. This is helpful if you want to find entities that belong to multiple smart classes. For example, if you want to find public entities that belong to a certain severity level, you can run the following queries:

-   `FIND DataStore WITH tag.Sev1=true AND tag.Public=true`

---

Source: /j1ql/style

# J1QL Style Guide

As with all query languages there are preferred conventions to have consistency between queries and ultimately make them more readable. This page documentes the preferred style for writing and sharing J1QL.

## Introduction

This style guide provides best practices and conventions for writing J1QL (JupiterOne Query Language) queries. Adhering to these guidelines will ensure your queries are readable, maintainable, and efficient.

## Formatting

### Indentation

-   Use two spaces for indentation to improve readability
-   Wrapped lines should have additional indentation

### Line Length

-   Keep lines under 120 characters where possible for better readability in various editors

### Whitespace

-   Use whitespace around operators (e.g., `=`, `!=`, `>`, `<`) for clarity
-   Include a space after commas in lists

### Case Sensitivity

-   Use uppercase for J1QL keywords and functions to maintain consistency
-   Entity properties should be in the case as defined in the data model

## Naming Conventions

### Aliases

-   Use meaningful aliases for entities and properties to improve query understandability
-   Aliases should be camelCase for consistency

## Query Structure

### FIND Clause

-   Begin queries with the `FIND` keyword followed by the entity type
-   Use the `AS` keyword for aliasing entities and properties when needed

### WITH and WHERE Clause

-   Use the `WITH` and `WHERE` clauses to filter results based on specific criteria
-   Group related conditions using parentheses for clarity

### RETURN Statement

-   Clearly specify what data to return using the `RETURN` statement for complex queries
-   `RETURN` should always be on a new line

## Operators

### Logical Operators

-   Use `AND`, `OR` and `!` to combine or exclude conditions
-   Group conditions with parentheses to override precedence

### Comparison Operators

-   Use `=`, `!=`, `<`, `>`, `<=`, `>=`, `^=` and `$=` for comparisons and filters
-   Use `/ ... /` for regex-based matching when applicable
-   The operand, when representing a string, should be enclosed in double quotes `"`

## Functions

### Usage

-   Use built-in functions (e.g., `COUNT`, `SUM`, `AVG`) to perform calculations or transform data
-   Always include parentheses, even if there are no arguments

## Comments

### Block and Inline Comments

-   Use `/*` and `*/` for block comments to describe overall query purpose or methodology at the beginning of the query
-   Use `/*` and `*/` for inline comments at the end of the line to which they apply

## Examples

Find all User entities

```j1ql
FIND User AS u
RETURN u.displayName, u.email
```

Find open vulnerabilities with critical severity

```j1ql
FIND Vulnerability WITH severity = "critical" AS v
RETURN v.displayName, v.score
```

---

Source: /j1ql/subqueries

# Subqueries

J1QL supports using a subquery as a filter for a property on an outer query.

These queries allow for filtering results from an outer query by specifying one or more subqueries to use. This is a powerful way to build queries across disjoint sections of the graph, or to simplify queries that would otherwise require complex traversals.

## Subqueries as Filters

J1QL subqueries can be used in place of property filter values for equality (`=`) and inequality (`!=`) checks. This allows for the filter to be dynamic, in contrast to using something like a query parameter which is a fixed value, or list of values.

### Subquery Filter Syntax

Subqueries can be used in `WHERE` and `WITH` filters, and can be combined with other filters. The most important thing about writing a subquery is that it must return only a single property from which to build the filter.

Subqueries are contained in parentheses and should follow the following pattern:

```j1ql
FIND something AS s 
WHERE s.property = ( FIND something_else AS se RETURN se.id )
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ This is the subquery
```

The supported operators are equality (`=`) and inequality (`!=`) only at this time. Subqueries do not support returning regex expressions, starts|endswith, or contains.

## Example

In the example below, we will look at a relatively simple query that can be completed both with and without the use of subqueries. In this example, we are looking for all AWS S3 buckets where the bucket belongs to an AWS account that falls under the `Prod` organizational unit in AWS.

J1QL without subqueries:

```j1ql
FIND aws_organizational_unit WITH name = "Prod"
  THAT HAS aws_account
  THAT HAS aws_s3
  THAT HAS aws_s3_bucket AS bucket
RETURN bucket.displayName, bucket.arn, bucket.accountId
```

J1QL with subqueries:

```j1ql
FIND aws_s3_bucket AS bucket
WHERE bucket.accountId = ( FIND UNIQUE aws_organizational_unit WITH name = "Prod" THAT RELATES TO aws_account AS a RETURN a.accountId )
RETURN bucket.displayName, bucket.arn, bucket.accountId
```

In this example, both queries are of similar complexity, and the relationships do exist in the graph to build the query without using subqueries, but the examples are not always so simple!

We may now decide we want these same results, but only where the aws\_account entity has an email address that does not correspond to a User in our identity system's security team.

Given our initial J1QL without subqueries:

```j1ql
FIND aws_organizational_unit WITH name = "Prod"
  THAT HAS aws_account <-- We would need a tangential traversal to filter these entities
  THAT HAS aws_s3
  THAT HAS aws_s3_bucket AS bucket
RETURN bucket.displayName, bucket.arn, bucket.accountId
```

We would need to filter the aws\_account nodes in this query based on the email addresses of the users in our security team. This is not possible for two reasons: we cannot combine in an optional/tangential traversal halfway through our query, and JupiterOne does not build relationships between aws\_account and User entities based on the email contact.

How would we solve this with Subqueries?

```j1ql
FIND aws_s3_bucket AS bucket
THAT HAS aws_s3
THAT HAS aws_account WITH email != ( FIND google_group WITH name = "Security" THAT HAS google_user AS u RETURN u.email )
WHERE bucket.accountId = ( FIND UNIQUE aws_organizational_unit WITH name = "Prod" THAT RELATES TO aws_account AS a RETURN a.accountId )
RETURN bucket.displayName, bucket.arn, bucket.accountId
```

Here there are two subqueries being used. The first is specifically filtering S3 buckets that belong to accounts where the account email is NOT found in the Google "Security" user members' emails. Note that this is a relationship that does not exist in the graph and was previously impossible to join this data. The second subquery is as before, looking only for accounts that belong to the "Prod" organizational unit.

## Important Considerations and Limits

The subqueries in J1QL have the following limitations that are good to understand as you write queries:

1.  **RETURN limit**: The subquery is limited to return up to 5000 values for building the filter. This limit has been found to provide a good balance between usability and performance. It is not possible to adjust this limit on a per-customer basis, but in the future, JupiterOne hopes to be able to increase this limit.
    
    It is recommended that you check your subqueries to ensure that you will not exceed the 5000 return limit. If your query does exceed the limit JupiterOne will inform the user that "The query results may be incomplete. One or more subqueries exceeded the maximum number of results".
    
2.  **Subquery Performance**: The subquery must be performant. Because the filter must be built in a single query as part of the outer query execution flow, it is not possible to apply JupiterOne's graph pagination strategy to the subquery. The query timeout applies to both the subquery and the outer queries' execution time.

---

Source: /j1ql/unwind

# Unwind

## UNWIND

`UNWIND` is a function that takes a list input and produces a row for each value in the list. `UNWIND` has many applications, and is particularly useful when you want to produce a value for each item in a list of values. Using `UNWIND` can ease downstream ETL pipelines, as well as provide insights that would be otherwise cumbersome to evaluate.

Example using UNWIND

```j1ql
FIND
  aws_instance as i
RETURN
  UNWIND(i._integrationClass) as class,
  COUNT(i) as class_count
```

This query retrieves all `aws_instance`s and then unwinds each return value's `_integrationClass` property, which is usually a list, into a discrete row. Each row is then counted and aggregated, effectively returning the total count of distinct `_integrationClass` values on all `aws_instance`s.

The query would return something like

| class | class\_count |
| --- | --- |
| Infrastructure | 237 |
| CSP | 237 |

Another powerful `UNWIND` query is

```j1ql
FIND 
  * as a
RETURN 
  UNWIND(a._type) as type,
  UNWIND(a._class) as class,
  COUNT(a) as total
  ORDER BY total
```

This query retrieves all `_type` and `_class` values for everything, splits them into their own rows, and then counts the total of unique combinations of `_type` and `_class`.

The (shortened) returned value would look something like

| type | class | total |
| --- | --- | --- |
| aws\_ecr\_image | Image | 450111 |
| aws\_macie\_finding | Finding | 320428 |
| unified\_entity | Person | 129009 |
| unified\_entity | UnifiedIdentity | 129009 |
| jira\_user | User | 121137 |
| jira\_issue | Issue | 48760 |

This query without the unwinds would produce results that _look_ similar at first glance, but further inspection will show that there are results that are not unwound, for instance:

| type | class | total |
| --- | --- | --- |
| aws\_ebs\_volume | DataStore,Disk | 538 |

Unwinding a query that filters for the `aws_ebs_volume` type gives:

| type | class | total |
| --- | --- | --- |
| aws\_ebs\_volume | DataStore | 538 |
| aws\_ebs\_volume | Disk | 538 |

### UNWIND caveats

#### Multiple UNWIND statements

Each unwind is combined with the result of each other unwind, effectively producing a list comprehension. Unwinding a list `x` and list `y` will produce `len(x) * len(y)` rows; `x`, `y`, `z` produces `len(x) * len(y) * len(z)`; and so on.

#### Usage inside other functions

Currently, J1QL does not support nesting an `UNWIND` inside other functions, like `COUNT` or `MERGE`.

---

Source: /jupiterOne-data-model

# JupiterOne Data Model

The **JupiterOne Data Model** is a reference model used to describe digital resources and the complex interconnections among all the resources in a technology organization as an **entity-relationship graph**.

The data model is defined by a set of Entities and their Relationships. It represents a reference model, not a strict or rigid structure.

## Entity

An Entity is a node/vertex in the graph that represents a resource within your digital infrastructure.

See the full data model schema in this [GitHub repo](https://github.com/JupiterOne/data-model).

### Class and Type of an Entity

Each Entity has a specific **type** that defines what that entity is, and is assigned one or more higher level **class** that represents a more abstract categorization or labeling of the entity in the perspective of security and technical operations.

#### Type

The **type** property represents the specific type that entity is as defined by the source. For example, an AWS resource may be of type `aws_instance` or `aws_s3_bucket` or `aws_iam_user`.

#### Class

The **class** of an entity is considered an abstract, super-type that defines what that entity is within the general framework of IT and security operations. In the above example, an `aws_instance` entity has a class of `Host`, while an `aws_s3_bucket` is a `DataStore`, and an `aws_iam_user` a `User`.

### Common Entity Properties

Most Entities will have the following common properties:

Common Entity Properties

| Property | Type | Description |
| --- | --- | --- |
| `id` | `string`,`array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |
| `name` | `string` | Name of this entity |
| `displayName` | `string` | Display name, e.g. a person's preferred name or an AWS account alias |
| `summary` | `string` | A summary / short description of this entity. |
| `description` | `string` | An extended description of this entity. |
| `classification` | `string`,`null` | The sensitivity of the data; should match company data classification scheme |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned |
| `active` | `boolean` | Indicates if this entity is currently active. |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. |
| `createdBy` | `string` | The source/principal/user that created the entity |
| `updatedBy` | `string` | The source/principal/user that updated the entity |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |
| `tags` | `array` | An array of unnamed tags |
| `notes` | `array` | User provided notes about this entity |

#### Findings Severity Data Normalization

When JupiterOne ingests data from an integration or an API, it uses the property `j1_severity` to normalize the severity rates of findings when severity is present. Normalizing the data simplifies searches and queries that apply to vendors with properties or values that are semantically equivalent but with different names and values. For example, vendor1\_severity and vendor2\_severity properties would be normalized to be j1\_severity but the original values remain in the database. Not all findings data has a severity rating. In that case, JupiterOne does not provide the `j1_severity`for those findings.

**Example queries**:

`find Finding with [j1_severity] = "high"` This query returns a list of all findings with a normalized severity of “high”.

`find Finding with [j1_severity] != undefined as f RETURN f.[j1_severity], count (f)` This query returns a count of all findings in JupiterOne grouped by `j1_severity`.

### Class Specific Entity Properties

Each specific class of Entity also has its own defined properties. For example, a `Person` entity will have properties including `firstName` and `lastName`, while a `Device` entity may have properties such as `hardwareVendor`, `hardwareModel`, and `hardwareSerial`.

### Custom Properties

Entities can also have custom properties that are specific to the type of that entity, defined by the source system where the resource belongs to, or defined by the individual or team managing the resource.

### Defined Entities

Here is a list of reference entities defined by the JupiterOne Data Model, each with its own defined set of properties in addition to the shared common properties:

Defined Entities Table

| Entity | Description |
| --- | --- |
| `AccessKey` | A key used to grant access, such as ssh-key, access-key, api-key/token, mfa-token/device, etc. |
| `AccessPolicy` | A policy for access control assigned to a Host, Role, User, UserGroup, or Service. |
| `AccessRole` | An access control role mapped to a Principal (e.g. user, group, or service). |
| `Account` | An organizational account for a service or a set of services (e.g. AWS, Okta, Bitbucket Team, Google G-Suite account, Apple Developer Account). Each Account should be connected to a Service. |
| `Application` | A software product or application. |
| `ApplicationEndpoint` | An application endpoint is a program interface that either initiates or receives a request, such as an API. |
| `Assessment` | An object to represent an assessment, including both compliance assessment such as a HIPAA Risk Assessment or a technical assessment such as a Penetration Testing. Each assessment should have findings (e.g. Vulnerability or Risk) associated. |
| `Attacker` | An attacker or threat actor. |
| `Backup` | A specific repository or data store containing backup data. |
| `Certificate` | A digital Certificate such as an SSL or S/MIME certificate. |
| `Channel` | A communication channel, such as a Slack channel or AWS SNS topic. |
| `Cluster` | A cluster of compute or database resources/workloads. |
| `CodeCommit` | A code commit to a repo. The commit id is captured in the \_id property of the Entity. |
| `CodeDeploy` | A code deploy job. |
| `CodeModule` | A software module. Such as an npm\_module or java\_library. |
| `CodeRepo` | A source code repository. A CodeRepo is also a DataRepository therefore should carry all the required properties of DataRepository. |
| `CodeReview` | A code review record. |
| `Configuration` | A Configuration contains definitions that describe a resource such as a Task, Deployment or Workload. For example, an `aws_ecs_task_definition` is a `Configuration`. |
| `Container` | A standard unit of software that packages up code and all its dependencies and configurations. |
| `Control` | A security or IT Control. A control can be implemented by a vendor/service, a person/team, a program/process, an automation code/script/configuration, or a system/host/device. Therefore, this is most likely an additional Class applied to a Service (e.g. Okta SSO), a Device (e.g. a physical firewall), or a HostAgent (e.g. Carbon Black CbDefense Agent). Controls are mapped to security policy procedures and compliance standards/requirements. |
| `ControlPolicy` | An technical or operational policy with rules that govern (or enforce, evaluate, monitor) a security control. |
| `CryptoKey` | A key used to perform cryptographic functions, such as an encryption key. |
| `DataObject` | An individual data object, such as an aws-s3-object, sharepoint-document, source-code, or a file (on disk). The exact data type is described in the \_type property of the Entity. |
| `DataStore` | A virtual repository where data is stored, such as aws-s3-bucket, aws-rds-cluster, aws-dynamodb-table, bitbucket-repo, sharepoint-site, docker-registry. The exact type is described in the \_type property of the Entity. |
| `Database` | A database cluster/instance. |
| `Deployment` | A deployment of code, application, infrastructure or service. For example, a Kubernetes deployment. An auto scaling group is also considered a deployment. |
| `Device` | A physical device or media, such as a server, laptop, workstation, smartphone, tablet, router, firewall, switch, wifi-access-point, usb-drive, etc. The exact data type is described in the \_type property of the Entity. |
| `Directory` | Directory, such as LDAP or Active Directory. |
| `Disk` | A disk storage device such as an AWS EBS volume |
| `Document` | A document or data object. |
| `Domain` | An internet domain. |
| `DomainRecord` | The DNS Record of a Domain Zone. |
| `DomainZone` | The DNS Zone of an Internet Domain. |
| `Finding` | A security finding, which may be a vulnerability or just an informative issue. A single finding may impact one or more resources. The `IMPACTS` relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The `IMPACTS` relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc. |
| `Firewall` | A piece of hardware or software that protects a network/host/application. |
| `Framework` | An object to represent a standard compliance or technical security framework. |
| `Function` | A virtual application function. For example, an aws\_lambda\_function, azure\_function, or google\_cloud\_function |
| `Gateway` | A gateway/proxy that can be a system/appliance or software service, such as a network router or application gateway. |
| `Group` | A defined, generic group of Entities. This could represent a group of Resources, Users, Workloads, DataRepositories, etc. |
| `Host` | A compute instance that itself owns a whole network stack and serves as an environment for workloads. Typically it runs an operating system. The exact host type is described in the \_type property of the Entity. The UUID of the host should be captured in the \_id property of the Entity |
| `HostAgent` | A software agent or sensor that runs on a host/endpoint. |
| `Image` | A system image. For example, an AWS AMI (Amazon Machine Image). |
| `Incident` | An operational or security incident. |
| `Internet` | The Internet node in the graph. There should be only one Internet node. |
| `IpAddress` | An re-assignable IpAddress resource entity. Do not create an entity for an IP Address _configured_ on a Host. Use this only if the IP Address is a reusable resource, such as an Elastic IP Address object in AWS. |
| `Key` | An ssh-key, access-key, api-key/token, pgp-key, etc. |
| `Logs` | A specific repository or destination containing application, network, or system logs. |
| `Module` | A software or hardware module. Such as an npm\_module or java\_library. |
| `Network` | A network, such as an aws-vpc, aws-subnet, cisco-meraki-vlan. |
| `NetworkEndpoint` | A network endpoint for connecting to or accessing network resources. For example, NFS mount targets or VPN endpoints. |
| `NetworkInterface` | An re-assignable software defined network interface resource entity. Do not create an entity for a network interface _configured_ on a Host. Use this only if the network interface is a reusable resource, such as an Elastic Network Interface object in AWS. |
| `Organization` | An organization, such as a company (e.g. JupiterOne) or a business unit (e.g. HR). An organization can be internal or external. Note that there is a more specific Vendor class. |
| `PR` | A pull request. |
| `PasswordPolicy` | A password policy is a specific `Ruleset`. It is separately defined because of its pervasive usage across digital environments and the well known properties (such as length and complexity) unique to a password policy. |
| `Person` | An entity that represents an actual person, such as an employee of an organization. |
| `Policy` | A written policy documentation. |
| `Procedure` | A written procedure and control documentation. A Procedure typically `IMPLEMENTS` a parent Policy. An actual Control further `IMPLEMENTS` a Procedure. |
| `Process` | A compute process -- i.e. an instance of a computer program / software application that is being executed by one or many threads. This is NOT a program level operational process (i.e. a Procedure). |
| `Product` | A product developed by the organization, such as a software product. |
| `Program` | A program. For example, a bug bounty/vuln disclosure program. |
| `Project` | A software development project. Can be used for other generic projects as well but the defined properties are geared towards software development projects. |
| `Queue` | A scheduling queue of computing processes or devices. |
| `Record` | A DNS record; or an official record (e.g. Risk); or a written document (e.g. Policy/Procedure); or a reference (e.g. Vulnerability/Weakness). The exact record type is captured in the \_type property of the Entity. |
| `Repository` | A repository that contains resources. For example, a Docker container registry repository hosting Docker container images. |
| `Requirement` | An individual requirement for security, compliance, regulation or design. |
| `Resource` | A generic assignable resource. A resource is typically non-functional by itself unless used by or attached to a host or workload. |
| `Review` | A review record. |
| `Risk` | An object that represents an identified Risk as the result of an Assessment. The collection of Risk objects in JupiterOne make up the Risk Register. A Control may have a `MITIGATES` relationship to a Risk. |
| `Root` | The root node in the graph. There should be only one Root node per organization account. |
| `Rule` | An operational or configuration compliance rule, often part of a Ruleset. |
| `Ruleset` | An operational or configuration compliance ruleset with rules that govern (or enforce, evaluate, monitor) a security control or IT system. |
| `Scanner` | A system vulnerability, application code or network infrastructure scanner. |
| `Section` | An object to represent a section such as a compliance section. |
| `Service` | A service provided by a vendor. |
| `Site` | The physical location of an organization. A Person (i.e. employee) would typically has a relationship to a Site (i.e. located\_at or work\_at). Also used as the abstract reference to AWS Regions. |
| `Standard` | An object to represent a standard such as a compliance or technical standard. |
| `Subscription` | A subscription to a service or channel. |
| `Task` | A computational task. Examples include AWS Batch Job, ECS Task, etc. |
| `Team` | A team consists of multiple member Person entities. For example, the Development team or the Security team. |
| `ThreatIntel` | Threat intelligence captures information collected from vulnerability risk analysis by those with substantive expertise and access to all-source information. Threat intelligence helps a security professional determine the risk of a vulnerability finding to their organization. |
| `Training` | A training module, such as a security awareness training or secure development training. |
| `User` | A user account/login to access certain systems and/or services. Examples include okta-user, aws-iam-user, ssh-user, local-user (on a host), etc. |
| `UserGroup` | A user group, typically associated with some type of access control, such as a group in Okta or in Office365. If a UserGroup has an access policy attached, and all member Users of the UserGroup would inherit the policy. |
| `Vault` | A collection of secrets such as a key ring |
| `Vendor` | An external organization that is a vendor or service provider. |
| `Vulnerability` | A security vulnerability (application or system or infrastructure). A single vulnerability may relate to multiple findings and impact multiple resources. The `IMPACTS` relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The `IMPACTS` relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc. |
| `Weakness` | A security weakness. |
| `Workload` | A virtual compute instance, it could be an aws-ec2-instance, a docker-container, an aws-lambda-function, an application-process, or a vmware-instance. The exact workload type is described in the \_type property of the Entity. |

#### Special Entities

There are three special entities defined. These are singleton entities.

| Entity | Description |
| --- | --- |
| `Everyone` | The global `UserGroup` that represents "everyone" publicly. |
| `Internet` | The Internet -- i.e. a `Network` entity with CIDR `"0.0.0.0/0"`. |
| `Root` | The entity that represents the top level organization. |

## Relationships

A relationship is the edge between two entity nodes in the graph. The `_class` of the relationship should be, in most cases, a generic descriptive verb, such as `HAS` or `IMPLEMENTS`.

Relationships can also carry their own properties.

For example, `CodeRepo -- DEPLOYED TO -> Host` may have `version` as a property on the `DEPLOYED` relationship. This represents the mapping between a code repo to multiple deployment targets, while one deployment may be of a different version of the code than another. Storing the version as a relationship property allows us to avoid duplicate instances of the code repo entity to be created to represent different versions.

Relationships have the same metadata properties as entities, which are managed by the integration providers.

### Example defined Relationships between abstract Entity Classes

#### HAS / CONTAINS

```text
Account         -- HAS ->             User
Account         -- HAS ->             UserGroup
Account         -- HAS ->             AccessRole
Account         -- HAS ->             Resource
CodeRepo        -- HAS ->             Vulnerability
Host            -- HAS ->             Vulnerability
Organization    -- HAS ->             Site
Organization    -- HAS ->             Organization (e.g. a business unit)
Application     -- HAS ->             Vulnerability
CodeRepo        -- HAS ->             Vulnerability
Host            -- HAS ->             Vulnerability
Service         -- HAS ->             Vulnerability
Site            -- HAS ->             Network
Site            -- HAS ->             Site
UserGroup       -- HAS ->             User
Network         -- CONTAINS ->        Host
Network         -- CONTAINS ->        Database
Network         -- CONTAINS ->        Network (e.g. a subnet)
```

#### IS / OWNS

```text
User            -- IS ->              Person
Vulnerability   -- IS ->              Vulnerability (e.g. a Snyk Vuln IS a CVE)
Person          -- OWNS ->            Device
```

#### EXPLOITS / IMPACTS

```text
Vulnerability   -- EXPLOITS ->        Weakness
Vulnerability   -- IMPACTS  ->        CodeRepo | Application
```

#### USES

```text
Host            -- USES ->            Resource (e.g. aws_instance USES aws_ebs_volume)
```

#### CONNECTS / TRIGGERS / EXTENDS

```text
Application     -- CONNECTS ->        Account
Gateway         -- CONNECTS ->        Network
Gateway         -- TRIGGERS ->        Function
HOST            -- EXTENDS  ->        Resource
```

#### IMPLEMENTS / MITIGATES

```text
Procedure       -- IMPLEMENTS ->      Policy
Control         -- IMPLEMENTS ->      Policy
Control         -- MITIGATES  ->      Risk
```

#### MANAGES

```text
Person          -- MANAGES ->         Person
Person          -- MANAGES ->         Organization
Person          -- MANAGES ->         Team
User            -- MANAGES ->         Account
User            -- MANAGES ->         UserGroup
ControlPolicy   -- MANAGES ->         Control
AccessPolicy    -- MANAGES ->         AccessRole
```

#### EVALUATES / MONITORS / PROTECTS

```text
ControlPolicy   -- EVALUATES ->       <any entity>
HostAgent       -- MONITORS  ->       Host
HostAgent       -- PROTECTS  ->       Host
```

#### TRUSTS

```text
AccessRole      -- TRUSTS ->          AccessRole
AccessRole      -- TRUSTS ->          Service
AccessRole      -- TRUSTS ->          Account
```

#### ASSIGNED

```text
User            -- ASSIGNED ->        Application
User            -- ASSIGNED ->        AccessRole
UserGroup       -- ASSIGNED ->        AccessRole
```

#### IDENTIFIED / PERFORMED / COMPLETED

```text
Person          -- PERFORMED  ->      Assessment
Person          -- COMPLETED  ->      Training
Assessment      -- IDENTIFIED ->      Risk
Assessment      -- IDENTIFIED ->      Vulnerability
```

#### PROVIDES

```text
Vendor          -- PROVIDES ->        Service
```

#### CONTRIBUTES TO

```text
User            -- CONTRIBUTES TO ->  CodeRepo
```

#### OPENED

```text
User            -- OPENED   ->        CodeReview (i.e. PR)
```

#### DEPLOYED TO

```text
CodeRepo        -- DEPLOYED TO ->     Account
CodeRepo        -- DEPLOYED TO ->     Host
CodeRepo        -- DEPLOYED TO ->     Container
CodeRepo        -- DEPLOYED TO ->     Function
```

## What does this look like?

The diagram below is an abstract illustration of the entities and relationships defined by the data model.

![data-model](/assets/images/data-model-d5694ff4fe77d208a1b02c1347706de6.png)

---

Source: /jupiterOne-data-model/aws-iam

# JupiterOne Data Model for AWS IAM Access and Trusts

The Identity and Access Model for the JupiterOne AWS integration shows which assets are ingested and the relationships that are created. A graph view of this model is available in your JupiterOne account after you turn on the AWS integration and starting ingesting data to your account.

![https://my.mindnode.com/6Sf6EftsmUqNqyXeKREWamqVzxqe4uvzBxyfRCpq/em#130.5,-318.0,-1](/assets/images/data-model-aws-iam-6fbc964b32a991043386d219581e656f.png)

---

Source: /jupiterOne-data-model/development

# JupiterOne Data Model for Software Development

![](/assets/images/j1-data-model-dev-782d93012d8af7638a257a24b36168bc.png)

---

Source: /jupiterOne-data-model/entity-ingestion-sources

# JupiterOne Entity Ingestion Sources

JupiterOne has a standard set of labels that represent how any single entity is ingested into the JupiterOne graph. You can find this information on entities on the `Metadata` tab in the entity drawer in J1 Assets. You can also filter against this information when you are querying JupiterOne by including the `_source` property in a `WITH` clause of a JupiterOne query.

For example:

```text
Which of my aws instances that were ingested by an integration use a data store?

FIND aws_instance
    WITH _source = 'integration-managed'
    THAT USES DataStore
RETURN TREE
```

## Labels of Ingestion Sources

`system-internal` - Entities that are created by an internal JupiterOne system that represents metadata about your JupiterOne instance. For example, users who have access to the JupiterOne software itself, compliance benchmarks, and alerts should have a `_source` value of `system-internal`.

`integration-managed` - Entities that are created by integrations. For example, if you configure an AWS integration and that integration ingests information into the J1 Graph, the source of those entities should have a `_source` value of `integration-managed`.

`system-mapper` - Entities that represent assets that have not been ingested into the J1 Graph by an integration but are determined to exist another way. In the JupiterOne data model, specific entity relationships can be inferred based on the correlation data certain entities have with one other. For example, you can expect that an entity that represents a `HostAgent` (such as scanning agents from vendors like CrowdStrike or SentinelOne) must also be accompanied by a `Host` that it is scanning (such as instances from a cloud service provider or a physical device that an employee uses to perform their work). In this case, the `Host` entity may be created by the system mapper if it does not already exist from an integration.

Another example of a `system-mapper` entity results from the timing of how integrations might execute or the information JupiterOne can retrieve from vendor solutions. JupiterOne uses an entity with a `_source` value of `system-mapper` to represent an asset that likely exists (based on relationship data) before other integration sources have had the opportunity to hydrate or enrich it in the J1 Graph.

`api` - Entities that are created using the JupiterOne APIs are given a `_source` value of `api`.

`sample-data` - Entities that are created using the sample data feature of JupiterOne are given a `_source` value of `sample-data`.

---

Source: /jupiterOne-data-model/mappings

# JupiterOne Entity Relationship Mappings

JupiterOne stores [entities and relationships](/jupiterOne-data-model.md) representing your organization's critical resources, their configurations, and their relationships. Relationships between entities may be explicitly stated in the APIs of the systems that manage them, and the integrations with those systems will leverage that information to build relationships in JupiterOne. In other cases, relationships need to be inferred from properties common to a set of related entities. This inference can extend across entities from multiple systems so that relationships can be automatically mapped, given enough context about how entities are related through their common properties. In some cases, entities will be generated to represent a resource that doesn't exist as an explicit thing in your systems, but is implied, such as the Internet.

Entity relationship mappings provide the context necessary to support this automatic relationship building.

## How Does It Work

Mapping rules are maintained by the JupiterOne engineering team; they cannot be modified by customers today. However, it is still important to understand how the mapping rules work because:

1.  Entities and relationships that mappings produce will exist in your data, though you will not be billed for these.
2.  Knowing about mappings allows you to leverage the entities and relationships they produce in J1 queries.
3.  Some mappings require customers to add properties to entities so that relationships can be inferred.

As entities are created and updated, the system will check to see if the entity matches a mapping rule. This entity is considered the source of the relationship to build. The target of the relationship is determined by performing a search according to the mapping's target filter parameters. When more than one entity matches the target filter, a relationship is established between the source and each target entity. No relationship is created when a target is not found. A single target entity will be created when no existing entities match, unless `skipTargetCreation: true`.

The mapping specifies the properties to transfer to a target created by the mapper. The values of those properties may be static, being explicitly defined in the rule, or the values may be transferred from the source entity. When multiple mapping rules resolve to the same mapper-created target entity, the target entity will accumulate the properties. This allows for a target to include properties from any mapped source entity.

The mapper will produce operations to create, update, or delete the target entities and relationships it manages. The entities produced by the mapper may themselves match a mapping rule, leading to a cascading effect that builds a graph of relationships.

Try this J1QL query to see entities produced by the mapper in your J1 account:

```j1ql
FIND * WITH _source="system-mapper" LIMIT 10
```

This query will show some relationships it created:

```j1ql
FIND * THAT RELATES TO AS r Root
WHERE r._source="system-mapper"
RETURN r.* LIMIT 10
```

## Example Use Cases

### Identifying Accounts That Belong to a Person

Integrations with an identity provider have mapping rules that cause the mapper to produce a `Person` entity when the users of the IdP have properties that identify the record as a real person, not a bot or service account. Once that `Person` entity exists, whenever a `User` entity is produced by any system, the `User` will be related to the `Person` as well when there are properties that identify the account with the `Person`, such as an `email` or `username`.

If you have an IdP integration configured, such as Okta or OneLogin, you may find user accounts that belong to a person:

```j1ql
FIND User AS u THAT RELATES TO Person AS p
RETURN u.email, u._type, u.displayName, p.employeeType
LIMIT 5
```

## Relationship Mapping Rules

Mapping rules are maintained by the JupiterOne engineering team, but it is instructive to see that rules take this basic form:

```json
{
  "sourceFilter": {
    "_class": "Person"
  },
  "relationshipProperties": {
    "_class": "IS"
  },
  "relationshipDirection": "REVERSE",
  "targetFilterKeys": [
    ["_class", "email"],
    ["_class", "username"]
  ],
  "propertyMappings": [
    {
      "sourceProperty": "email",
      "targetProperty": "email"
    },
    {
      "sourceProperty": "email",
      "targetProperty": "username"
    },
    {
      "targetValue": "User",
      "targetProperty": "_class"
    }
  ],
  "skipTargetCreation": true
}
```

-   `"sourceFilter"`: Declares the properties of the source entity that the rule matches
    
-   `"relationshipProperties"`: Declares the properties to place on generated relationships
    
-   `"relationshipDirection"`: Declares the directionality of the relationship
    
-   `"targetFilterKeys"`: Declares the properties to query when resolving the target entities
    
-   `"propertyMappings"`: Declares the properties to assign to target entities created by the mapper and provides the values used to search for the target entities
    
-   `"skipTargetCreation"`: Instructs the mapper to avoid creating the target entity when none already exist
    

## Mappings

The current mappings are summarized below. The _Global Mappings_ apply to entities no matter how they are produced, whether by a managed integration or through the JupiterOne API. Each managed integration may also specify mappings that are applied only to entities managed by that integration.

The summaries have a title taking the form `SOURCE RELATIONSHIP TARGET`.

-   `SOURCE` is always the entity that triggers the mapping configuration. The label is the `_class` or `_type` that will be matched. Other match properties are listed in the summary body.
-   `RELATIONSHIP` is relative to `SOURCE`, and the label of comes from the `_class`.
    -   Forward: `-CLASS->`
    -   Reverse: `<-CLASS-`
-   `TARGET` is determined by a search, or one will be created when not found (unless `skipTargetCreation: true`). The label is the `_class` or `_type` that will be matched. Other match properties are listed in the summary body.

It is important to remember:

-   Mapping rules are triggered when a `SOURCE` entity matches. Rules are NOT automatically reversed so that relationships are updated when a `TARGET` is created/updated.
-   Any change to the `SOURCE` entity triggers the mapping rule to be evaluated/re-evaluated.
-   The **Source Filters** must match an entity or the rule will not trigger. It may be necessary to _add properties to entities_ at the data source so that when they are ingested they will match the rule.
-   A rule produces relationships to all `TARGET` entities matching the **Target filters**. It may be necessary to _add properties to entities_ at the data source so that when they are ingested they will match the rule.
-   **Transferred Properties** are listed only when the mapper will create a target entity if none are found (`skipTargetCreation: false`).

### Mappings Rules

-   [Global Mapping Rules](/jupiterOne-data-model/mappings-global.md)
-   [Integration Specific Mapping Rules](/jupiterOne-data-model/mappings-integrations.md)

---

Source: /jupiterOne-data-model/mappings-global

# Global Mapping Rules

This document describes the global automated mapping rules that apply across all entities in the graph.

### 1\. Application -HAS-> qualys\_web\_app\_finding

> **Mapping Rule Conditions**
> 
> -   Application.`name` IN qualys\_web\_app\_finding.`targets`

Rule Id: igm-rule-83f5f4e4-7dd6-4645-9752-6c0ee098c402

### 2\. github\_repo -HAS-> snyk\_finding

> **Mapping Rule Conditions**
> 
> -   github\_repo.`fullName` = snyk\_finding.`repoFullName`

Rule Id: igm-rule-aae0a67a-6780-4a81-ac71-e1eccede9b8f

### 3\. gitlab\_project -HAS-> snyk\_finding

> **Mapping Rule Conditions**
> 
> -   gitlab\_project.`fullName` IN snyk\_finding.`targets`

Rule Id: igm-rule-be95f66d-c132-4a88-a3ba-3e0ff9f9220c

### 4\. aws\_instance -HAS-> aws\_guardduty\_finding

> **Mapping Rule Conditions**
> 
> -   aws\_instance.`id` = aws\_guardduty\_finding.`targets`

Rule Id: igm-rule-f7cd3d6f-0c1a-45ff-978b-19b34d77e85f

### 5\. qualys\_host\_finding -HAS-> aws\_instance

> **Mapping Rule Conditions**
> 
> -   qualys\_host\_finding.`ec2InstanceArn` = aws\_instance.`_key`

Rule Id: igm-rule-48187acf-c442-475b-bcbe-6cc6fadab071

### 6\. qualys\_host\_finding -HAS-> azure\_vm

> **Mapping Rule Conditions**
> 
> -   qualys\_host\_finding.`azureVmSourceId` = azure\_vm.`_key`

Rule Id: igm-rule-52561b1b-a1c8-4710-bf81-55b2c34557e0

### 7\. qualys\_host\_finding -HAS-> discovered\_host

> **Mapping Rule Conditions**
> 
> -   qualys\_host\_finding.`hostId` = discovered\_host.`qualysQwebHostId`

Rule Id: igm-rule-dc5a3636-6d37-4a17-ae81-09e686366f8c

### 8\. qualys\_host\_finding -HAS-> google\_compute\_instance

> **Mapping Rule Conditions**
> 
> -   qualys\_host\_finding.`gcpInstanceSelfLink` = google\_compute\_instance.`_key`

Rule Id: igm-rule-567bf866-962a-4292-a440-cbcf81cebb65

### 9\. Person|Team|UserGroup -MANAGES-> Account|Application|Channel|Cluster|CodeRepo|Configuration|DataStore|Domain|Firewall|Function|Gateway|Host|Network|Organization|Product|Repository|Service|Workload

> **Mapping Rule Conditions**
> 
> -   Person | Team | UserGroup.`email` = Account | Application | Channel | Cluster | CodeRepo | Configuration | DataStore | Domain | Firewall | Function | Gateway | Host | Network | Organization | Product | Repository | Service | Workload.`contactEmails`

Rule Id: igm-rule-438dc97a-7cac-11ed-a526-d3622dd84680

### 10\. Application -USES-> DomainZone

> **Mapping Rule Conditions**
> 
> -   Application.`name` = DomainZone.`domainName`
> -   Application.`name` = DomainZone.`domainName`

Rule Id: igm-rule-9981b9c8-8209-44d7-9fdf-38415f62ff32

### 11\. aws\_dms\_instance|aws\_lambda\_function -HAS-> aws\_vpc

> **Mapping Rule Conditions**
> 
> -   aws\_dms\_instance | aws\_lambda\_function.`vpcId` = aws\_vpc.`vpcId`

Rule Id: igm-rule-83871315-5eb9-4fc0-ada5-342ab075c3c2

### 12\. CodeRepo -DEFINES-> Function

> **Mapping Rule Conditions**
> 
> -   CodeRepo.`name` = Function.`name`

Rule Id: igm-rule-752d55ca-7cae-11ed-b27f-c7f83e8f75c9

### 13\. Control -DEFINES-> ControlTest

> **Mapping Rule Conditions**
> 
> -   Control.`id` = ControlTest.`controlId`

Rule Id: igm-rule-78a3c2d0-bded-47a3-aa74-fa04c638b4cc

### 14\. Domain -HAS-> DomainZone

> **Mapping Rule Conditions**
> 
> -   Domain.`name` = DomainZone.`parentDomain`
> -   Domain.`name` = DomainZone.`domainName`

Rule Id: igm-rule-cdb79aae-7cac-11ed-9949-0ff60fee3b5d

### 15\. Domain|DomainZone|DomainRecord -HAS-> Certificate

> **Mapping Rule Conditions**
> 
> -   Domain | DomainZone | DomainRecord.`name` = Certificate.`domainName`

Rule Id: igm-rule-ee40c6e2-7cac-11ed-9e6f-c39034f30ecd

### 16\. DomainRecord -CONNECTS-> IpAddress|Gateway|Cluster

> **Target Filters**
> 
> -   `type = "A"`
> -   `type = "AAAA"`

> **Mapping Rule Conditions**
> 
> -   IpAddress | Gateway | Cluster.`publicIpAddresses` IN DomainRecord.`value`

Rule Id: igm-rule-9b2b7aec-7cac-11ed-b2e0-b3e60622bc88

### 17\. DomainRecord -CONNECTS-> Host

> **Target Filters**
> 
> -   `type = "A"`
> -   `type = "AAAA"`

> **Mapping Rule Conditions**
> 
> -   Host.`publicIpAddresses` IN DomainRecord.`value`

Rule Id: igm-rule-88bbbafa-4b34-476e-8f6b-ce6bc76fef69

### 18\. DomainRecord -CONNECTS-> IpAddress

> **Target Filters**
> 
> -   `type = "A"`
> -   `type = "AAAA"`

> **Mapping Rule Conditions**
> 
> -   IpAddress.`publicIpAddress` IN DomainRecord.`value`

Rule Id: igm-rule-d55bcb92-7688-4aa3-8ee4-40351d583c10

### 19\. DomainRecord -CONNECTS-> IpAddress

> **Target Filters**
> 
> -   `type = "A"`
> -   `type = "AAAA"`

> **Mapping Rule Conditions**
> 
> -   IpAddress.`privateIpAddress` IN DomainRecord.`value`

Rule Id: igm-rule-d822c12e-e163-4dd0-b8a0-42d15e023466

### 20\. DomainRecord -CONNECTS-> NetworkInterface

> **Target Filters**
> 
> -   `type = "A"`
> -   `type = "AAAA"`

> **Mapping Rule Conditions**
> 
> -   NetworkInterface.`publicIpAddresses` IN DomainRecord.`value`

Rule Id: igm-rule-61efba4a-f0f2-4018-8a95-c66cbeefca0f

### 21\. security\_procedure -IMPLEMENTS-> compliance\_control

> **Mapping Rule Conditions**
> 
> -   security\_procedure.`_key` = compliance\_control.`policyItemId`

Rule Id: igm-rule-3ade111a-0081-4c35-9d77-3f70ae0c6d03

---

Source: /jupiterOne-data-model/mappings-integrations

# Integration Mapping Rules

This document describes the automated mapping rules that connect integration entities to other entities in the graph.

## AWS Rules

### 1\. jupiterone\_integration -INGESTS-> aws\_account

> **Mapping Rule Conditions**
> 
> -   jupiterone\_integration.`id` = aws\_account.`_integrationInstanceId`

Rule Id: igm-rule-a0017fd5-35ef-441e-bb05-cc15cb8ed525

### 2\. Person|Team|UserGroup -MANAGES-> aws\_account

> **Mapping Rule Conditions**
> 
> -   Person | Team | UserGroup.`email` IN aws\_account.`operationsContactEmail`
> -   Person | Team | UserGroup.`email` IN aws\_account.`securityContactEmail`
> -   Person | Team | UserGroup.`email` IN aws\_account.`billingContactEmail`
> -   Person | Team | UserGroup.`email` IN aws\_account.`email`

Rule Id: igm-rule-31add946-1a33-48e1-8936-e0e78b3478c8

### 3\. aws\_route53\_record -CONNECTS-> aws\_alb

> **Mapping Rule Conditions**
> 
> -   aws\_route53\_record.`value` = aws\_alb.`dualstackDnsName`

Rule Id: igm-rule-696f31bd-845f-4020-92a6-cc0a4be6b674

### 4\. aws\_ami -USES-> aws\_autoscaling\_launch\_configuration

> **Mapping Rule Conditions**
> 
> -   aws\_ami.`imageId` = aws\_autoscaling\_launch\_configuration.`imageId`

Rule Id: igm-rule-2df898ba-26b5-4901-aab7-5cb977b202b8

### 5\. aws\_cloudfront\_distribution -CONNECTS-> aws\_api\_gateway\_domain\_name

> **Mapping Rule Conditions**
> 
> -   aws\_cloudfront\_distribution.`origins` IN aws\_api\_gateway\_domain\_name.`domainName`
> -   aws\_cloudfront\_distribution.`origins` IN aws\_api\_gateway\_domain\_name.`regionalDomainName`

Rule Id: igm-rule-33e6d176-7651-4f49-a767-906fbcc845a3

### 6\. aws\_cloudfront\_distribution -CONNECTS-> aws\_route53\_record

> **Mapping Rule Conditions**
> 
> -   aws\_cloudfront\_distribution.`origins` IN aws\_route53\_record.`name`

Rule Id: igm-rule-4bf61f3f-0ef6-4166-92cb-b4a41febd5f6

### 7\. aws\_cloudfront\_distribution -CONNECTS-> Internet

Rule Id: igm-rule-618661e0-49ea-4e27-846d-44d7ddb479d6

### 8\. aws\_cloudfront\_distribution\_origin -CONNECTS-> aws\_alb|aws\_elb|aws\_nlb

> **Mapping Rule Conditions**
> 
> -   aws\_cloudfront\_distribution\_origin.`domainName` = aws\_alb | aws\_elb | aws\_nlb.`dnsName`

Rule Id: igm-rule-c0fb6e72-7129-4448-8f73-2747216ace6b

### 9\. aws\_instance -RUNS-> aws\_ecs\_container\_instance

> **Mapping Rule Conditions**
> 
> -   aws\_instance.`instanceId` = aws\_ecs\_container\_instance.`ec2InstanceId`

Rule Id: igm-rule-6aa57e31-a2a0-421c-a565-4481fe2bbf79

### 10\. aws\_ecs\_service -TRIGGERS-> aws\_ecs\_task

> **Mapping Rule Conditions**
> 
> -   aws\_ecs\_service.`deployments` IN aws\_ecs\_task.`startedBy`

Rule Id: igm-rule-52068a54-42f7-43dc-a5a8-1445a71613c2

### 11\. aws\_iam\_access\_key -HAS-> aws\_guardduty\_finding

> **Mapping Rule Conditions**
> 
> -   aws\_iam\_access\_key.`id` = aws\_guardduty\_finding.`accessKeyId`

Rule Id: igm-rule-c8bbf641-9cc7-4001-939c-b7bc41527613

### 12\. aws\_iam\_role -HAS-> aws\_guardduty\_finding

> **Mapping Rule Conditions**
> 
> -   aws\_iam\_role.`id` = aws\_guardduty\_finding.`roleId`

Rule Id: igm-rule-a800d381-0118-43b4-b87c-676915bf4014

### 13\. aws\_iam\_user -HAS-> aws\_guardduty\_finding

> **Mapping Rule Conditions**
> 
> -   aws\_iam\_user.`id` = aws\_guardduty\_finding.`userId`

Rule Id: igm-rule-897ec90e-5b96-44df-a4ba-ea3c799ef2ea

### 14\. Person -HAS-> aws\_guardduty\_finding

> **Mapping Rule Conditions**
> 
> -   Person.`userId` IN aws\_guardduty\_finding.`userName`

Rule Id: igm-rule-9cb629a3-276d-4f0c-9474-4e515166a92b

### 15\. aws\_instance -USES-> aws\_iam\_role

> **Mapping Rule Conditions**
> 
> -   aws\_instance.`iamInstanceProfileId` = aws\_iam\_role.`instanceProfileId`

Rule Id: igm-rule-a59cd62c-408b-4709-9219-0415b9c63b02

### 16\. aws\_internet\_gateway -CONNECTS-> Internet

Rule Id: igm-rule-332bf443-6209-4ca9-a35a-9779d59081ce

### 17\. aws\_route53\_record -CONNECTS-> aws\_alb

> **Mapping Rule Conditions**
> 
> -   aws\_route53\_record.`value` = aws\_alb.`dnsName`

Rule Id: igm-rule-e4bd96bd-f98d-4feb-87c0-ffbda49b1852

### 18\. aws\_route53\_zone -USES-> aws\_vpc

> **Mapping Rule Conditions**
> 
> -   aws\_route53\_zone.`vpcIds` IN aws\_vpc.`id`

Rule Id: igm-rule-703b8bfa-ba7a-4620-9584-91249cc5e6c5

### 19\. aws\_transfer\_server -CONNECTS-> Internet

Rule Id: igm-rule-2ddebda4-f4ca-4c0e-acaf-d11b7c59a9bd

### 20\. aws\_alb|aws\_s3\_bucket|aws\_nlb|aws\_elb|aws\_redshift\_cluster -LOGS-> aws\_s3\_bucket

> **Mapping Rule Conditions**
> 
> -   aws\_alb | aws\_s3\_bucket | aws\_nlb | aws\_elb | aws\_redshift\_cluster.`loggingTargetBucket` = aws\_s3\_bucket.`bucketName`

Rule Id: igm-rule-cff0f85f-194e-40e7-876f-0f44a0314cc5

## BIGID Rules

### 21\. bigid\_datasource -IS-> aws\_s3\_bucket

> **Mapping Rule Conditions**
> 
> -   bigid\_datasource.`awsBucket` = aws\_s3\_bucket.`bucketName`

Rule Id: igm-rule-139aca1f-b86d-4a9d-812b-82dc93a07feb

### 22\. bigid\_datasource -IS-> aws\_s3\_bucket

> **Mapping Rule Conditions**
> 
> -   bigid\_datasource.`awsBucketv2` = aws\_s3\_bucket.`bucketName`

Rule Id: igm-rule-0c8e196e-a44c-4b27-aca4-9cbabb7bd3cc

### 23\. Person -OWNS-> bigid\_datasource

> **Mapping Rule Conditions**
> 
> -   Person.`email` IN bigid\_datasource.`owners`

Rule Id: igm-rule-e5195ef4-2b50-48e2-9f34-4c17fc760d32

## CISCO MERAKI Rules

### 24\. user\_endpoint -CONNECTS-> meraki\_device

> **Mapping Rule Conditions**
> 
> -   user\_endpoint.`publicIp` = meraki\_device.`publicIp`

Rule Id: igm-rule-53f81e82-efe3-4828-bdb2-69f0e3994dec

## CROWDSTRIKE Rules

### 25\. crowdstrike\_aws\_api\_gateway\_resource -IS-> aws\_api\_gateway\_resource

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_api\_gateway\_resource.`arn` = aws\_api\_gateway\_resource.`arn`

Rule Id: igm-rule-e2c96f24-52f7-4a26-b39c-6b98d3cccdd6

### 26\. crowdstrike\_aws\_api\_gateway\_rest\_api -IS-> aws\_api\_gateway\_rest\_api

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_api\_gateway\_rest\_api.`arn` = aws\_api\_gateway\_rest\_api.`arn`

Rule Id: igm-rule-b6c7d8e9-0314-2345-bcde-678901234567

### 27\. crowdstrike\_aws\_autoscaling\_launch\_configuration -IS-> aws\_autoscaling\_launch\_configuration

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_autoscaling\_launch\_configuration.`arn` = aws\_autoscaling\_launch\_configuration.`arn`

Rule Id: igm-rule-ad477be7-d4f4-47f7-a7e4-a787855c6eac

### 28\. crowdstrike\_aws\_cloudformation\_stack -IS-> aws\_cloudformation\_stack

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_cloudformation\_stack.`arn` = aws\_cloudformation\_stack.`arn`

Rule Id: igm-rule-1105a0f1-1903-4bf3-8293-1e697b416957

### 29\. crowdstrike\_aws\_cloudfront\_domain -IS-> aws\_cloudfront\_distribution

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_cloudfront\_domain.`arn` = aws\_cloudfront\_distribution.`arn`

Rule Id: igm-rule-fb68b517-ea1d-479b-a5cd-25c3f42404e9

### 30\. crowdstrike\_aws\_cloudtrail -IS-> aws\_cloudtrail

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_cloudtrail.`arn` = aws\_cloudtrail.`arn`

Rule Id: igm-rule-1dd4f45b-064f-4a49-8652-8a718b1c9f38

### 31\. crowdstrike\_aws\_codebuild\_project -IS-> aws\_codebuild\_project

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_codebuild\_project.`arn` = aws\_codebuild\_project.`arn`

Rule Id: igm-rule-81e9cffb-4a2a-4f9b-8937-9b1b23d0ff36

### 32\. crowdstrike\_aws\_cognito\_user\_pool -IS-> aws\_cognito\_user\_pool

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_cognito\_user\_pool.`arn` = aws\_cognito\_user\_pool.`arn`

Rule Id: igm-rule-6e316cfd-9379-464c-a6e0-27e061eb5fec

### 33\. crowdstrike\_aws\_config\_account -IS-> aws\_account

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_config\_account.`arn` = aws\_account.`arn`

Rule Id: igm-rule-39e3055f-e440-427b-8ffe-b36ff6e52bad

### 34\. crowdstrike\_aws\_dynamodb\_table -IS-> aws\_dynamodb\_table

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_dynamodb\_table.`arn` = aws\_dynamodb\_table.`arn`

Rule Id: igm-rule-b8c9d0e1-2536-4567-bcde-890123456789

### 35\. crowdstrike\_aws\_ebs\_snapshot -IS-> aws\_ebs\_snapshot

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_ebs\_snapshot.`arn` = aws\_ebs\_snapshot.`arn`

Rule Id: igm-rule-25ed5301-c22a-4fe8-b600-d8ea5f4da4d5

### 36\. crowdstrike\_aws\_ebs\_volume -IS-> aws\_ebs\_volume

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_ebs\_volume.`arn` = aws\_ebs\_volume.`arn`

Rule Id: igm-rule-e6729c53-60a4-45bd-8754-3ad9b3bf7cd6

### 37\. crowdstrike\_aws\_ec2\_instance -IS-> aws\_instance

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_ec2\_instance.`arn` = aws\_instance.`arn`

Rule Id: igm-rule-b9b2a8a7-5c47-46c6-a4a1-3b7a0c9d8c1f

### 38\. crowdstrike\_aws\_ec2\_network\_acl -IS-> aws\_network\_acl

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_ec2\_network\_acl.`arn` = aws\_network\_acl.`arn`

Rule Id: igm-rule-766c6af5-d768-4139-a8ec-40060bb9ddf5

### 39\. crowdstrike\_aws\_ec2\_security\_group -IS-> aws\_security\_group

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_ec2\_security\_group.`arn` = aws\_security\_group.`arn`

Rule Id: igm-rule-3f7d2c56-9e8b-4a02-8c9b-7a6a1dfb2a34

### 40\. crowdstrike\_aws\_ecr\_repository -IS-> aws\_ecr\_repository

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_ecr\_repository.`arn` = aws\_ecr\_repository.`arn`

Rule Id: igm-rule-15a9ab22-01e8-4003-b830-173d0a1bd1d2

### 41\. crowdstrike\_aws\_ecs\_task\_definition -IS-> aws\_ecs\_task\_definition

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_ecs\_task\_definition.`arn` = aws\_ecs\_task\_definition.`arn`

Rule Id: igm-rule-12835efa-19da-4d1f-a380-127898009c95

### 42\. crowdstrike\_aws\_eks\_cluster -IS-> aws\_eks\_cluster

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_eks\_cluster.`arn` = aws\_eks\_cluster.`arn`

Rule Id: igm-rule-5a633deb-f88f-41e6-8c10-0042ff90aefe

### 43\. crowdstrike\_aws\_elasticache\_cluster -IS-> aws\_elasticache\_redis\_cluster

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_elasticache\_cluster.`arn` = aws\_elasticache\_redis\_cluster.`arn`

Rule Id: igm-rule-4b75304c-670c-44d9-b922-8f9b39226eec

### 44\. crowdstrike\_aws\_elb\_load\_balancer -IS-> aws\_elb

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_elb\_load\_balancer.`arn` = aws\_elb.`arn`

Rule Id: igm-rule-b8153aa7-a1d7-4753-ba9b-a6a0d261d96c

### 45\. crowdstrike\_aws\_eventbridge\_event\_bus -IS-> aws\_cloudwatch\_event\_rule

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_eventbridge\_event\_bus.`arn` = aws\_cloudwatch\_event\_rule.`arn`

Rule Id: igm-rule-2afb8bc1-5c37-41ce-82af-d33242be8049

### 46\. crowdstrike\_aws\_iam\_account -IS-> aws\_account

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_iam\_account.`arn` = aws\_account.`arn`

Rule Id: igm-rule-f3b1c20f-c352-4cd4-b786-f060695249a3

### 47\. crowdstrike\_aws\_iam\_group -IS-> aws\_iam\_group

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_iam\_group.`arn` = aws\_iam\_group.`arn`

Rule Id: igm-rule-f7c0872b-adb8-4644-b7d3-f9d74099b163

### 48\. crowdstrike\_aws\_iam\_policy -IS-> aws\_iam\_policy

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_iam\_policy.`arn` = aws\_iam\_policy.`arn`

Rule Id: igm-rule-d6ecf11d-e915-4e8c-a6f7-9f346298250d

### 49\. crowdstrike\_aws\_iam\_role -IS-> aws\_iam\_role

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_iam\_role.`arn` = aws\_iam\_role.`arn`

Rule Id: igm-rule-93d0f6db-3f36-4d1a-a36a-540a8b809abd

### 50\. crowdstrike\_aws\_iam\_s3\_policy -IS-> aws\_iam\_policy

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_iam\_s3\_policy.`arn` = aws\_iam\_policy.`arn`

Rule Id: igm-rule-61c8743a-0968-49b5-86ac-1aafa7563fc1

### 51\. crowdstrike\_aws\_iam\_user -IS-> aws\_iam\_user

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_iam\_user.`arn` = aws\_iam\_user.`arn`

Rule Id: igm-rule-21c728c4-3cf4-4ef4-a821-c80f48a4967d

### 52\. crowdstrike\_aws\_kinesis\_stream -IS-> aws\_kinesis\_stream

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_kinesis\_stream.`arn` = aws\_kinesis\_stream.`arn`

Rule Id: igm-rule-164aae9d-6cc8-49c0-aa92-0a048d5d2beb

### 53\. crowdstrike\_aws\_kms\_key -IS-> aws\_kms\_key

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_kms\_key.`arn` = aws\_kms\_key.`arn`

Rule Id: igm-rule-28a12b5a-5f14-4673-b917-f0fe4e104002

### 54\. crowdstrike\_aws\_lambda\_function -IS-> aws\_lambda\_function

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_lambda\_function.`arn` = aws\_lambda\_function.`arn`

Rule Id: igm-rule-e930188f-471c-4355-a43a-c3e0dd242bd8

### 55\. crowdstrike\_aws\_nlb\_alb\_load\_balancer -IS-> aws\_alb

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_nlb\_alb\_load\_balancer.`arn` = aws\_alb.`arn`

Rule Id: igm-rule-f1172121-2dfb-4a87-8d2b-7f9b2752118d

### 56\. crowdstrike\_aws\_rds\_database -IS-> aws\_db\_instance

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_rds\_database.`arn` = aws\_db\_instance.`arn`

Rule Id: igm-rule-398666a3-b114-4314-9fd6-723b3b02ed9c

### 57\. crowdstrike\_aws\_route53\_domain -IS-> aws\_route53\_domain

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_route53\_domain.`arn` = aws\_route53\_domain.`arn`

Rule Id: igm-rule-29278d53-90ae-4578-bca5-3d208f6dff59

### 58\. crowdstrike\_aws\_s3\_bucket -IS-> aws\_s3\_bucket

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_s3\_bucket.`arn` = aws\_s3\_bucket.`arn`

Rule Id: igm-rule-a7b8c9d0-1425-3456-abcd-789012345678

### 59\. crowdstrike\_aws\_secrets\_manager\_secret -IS-> aws\_secret

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_secrets\_manager\_secret.`arn` = aws\_secret.`arn`

Rule Id: igm-rule-a5b6c7d8-9203-1234-abcd-567890123456

### 60\. crowdstrike\_aws\_sns\_topic -IS-> aws\_sns\_topic

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_sns\_topic.`arn` = aws\_sns\_topic.`arn`

Rule Id: igm-rule-7a07b65e-88db-4e3e-9c81-3b6360012f72

### 61\. crowdstrike\_aws\_sqs\_queue -IS-> aws\_sqs\_queue

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_sqs\_queue.`arn` = aws\_sqs\_queue.`arn`

Rule Id: igm-rule-4bf0120f-45e3-440c-be72-6d9a411359bd

### 62\. crowdstrike\_aws\_ssm\_parameter -IS-> aws\_ssm\_parameter

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_ssm\_parameter.`arn` = aws\_ssm\_parameter.`arn`

Rule Id: igm-rule-dc3746dd-5dd9-4d00-9714-371711e1d345

### 63\. crowdstrike\_aws\_vpc -IS-> aws\_vpc

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_vpc.`arn` = aws\_vpc.`arn`

Rule Id: igm-rule-f4b70c18-6ee1-4fa8-9537-2481f08f39c7

### 64\. crowdstrike\_aws\_vpc\_endpoint -IS-> aws\_vpc\_endpoint

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_vpc\_endpoint.`arn` = aws\_vpc\_endpoint.`arn`

Rule Id: igm-rule-d64a5a4e-c412-4f72-b1c5-bf39546394da

### 65\. crowdstrike\_aws\_vpc\_route\_table -IS-> aws\_route\_table

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_vpc\_route\_table.`arn` = aws\_route\_table.`arn`

Rule Id: igm-rule-b50ce981-4bb7-4131-908a-246ffbfdb21d

### 66\. crowdstrike\_aws\_vpc\_subnet -IS-> aws\_subnet

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_vpc\_subnet.`arn` = aws\_subnet.`arn`

Rule Id: igm-rule-1c5cb5b1-9567-4125-bdba-ee749cfa749e

### 67\. crowdstrike\_aws\_waf\_vpc\_endpoint -IS-> aws\_vpc\_endpoint

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_waf\_vpc\_endpoint.`arn` = aws\_vpc\_endpoint.`arn`

Rule Id: igm-rule-0ad3b176-b193-46dc-a1bf-6be9bad98c50

### 68\. crowdstrike\_azure\_ad\_domain\_service -IS-> azure\_ad\_domain\_service

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_ad\_domain\_service.`id` = azure\_ad\_domain\_service.`id`

Rule Id: igm-rule-f3e2a1c4-2d7b-4a8f-91b0-7e6d5c4b3a2f

### 69\. crowdstrike\_azure\_app\_service -IS-> azure\_function\_app

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_app\_service.`id` = azure\_function\_app.`id`

Rule Id: igm-rule-234ad630-692b-4880-8126-5e5c8d6f111e

### 70\. crowdstrike\_azure\_cdn\_profile -IS-> azure\_cdn\_profile

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_cdn\_profile.`id` = azure\_cdn\_profile.`id`

Rule Id: igm-rule-79d15aa2-740a-4fd1-8e67-c7bc67ed8854

### 71\. crowdstrike\_azure\_container\_app -IS-> azure\_container\_app

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_container\_app.`id` = azure\_container\_app.`id`

Rule Id: igm-rule-b9d0c2a1-5f7b-4b9b-9d5e-2f3e8c4f2c5a

### 72\. crowdstrike\_azure\_cosmosdb\_account -IS-> azure\_cosmosdb\_account

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_cosmosdb\_account.`id` = azure\_cosmosdb\_account.`id`

Rule Id: igm-rule-fdcbe5d2-35b5-4af4-a993-0c5546bad06a

### 73\. crowdstrike\_azure\_event\_hub -IS-> azure\_event\_hub\_namespace

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_event\_hub.`id` = azure\_event\_hub\_namespace.`id`

Rule Id: igm-rule-b5811ae5-25c8-4eda-a0ab-f7e71874c286

### 74\. crowdstrike\_azure\_firewall -IS-> azure\_network\_firewall

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_firewall.`id` = azure\_network\_firewall.`id`

Rule Id: igm-rule-a1c20a78-c067-4762-b19f-08308c0fd0ae

### 75\. crowdstrike\_azure\_key\_vault -IS-> azure\_keyvault\_service

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_key\_vault.`id` = azure\_keyvault\_service.`id`

Rule Id: igm-rule-1494f590-b952-47e9-8445-9641ef45e557

### 76\. crowdstrike\_azure\_kubernetes\_cluster -IS-> azure\_kubernetes\_cluster

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_kubernetes\_cluster.`id` = azure\_kubernetes\_cluster.`id`

Rule Id: igm-rule-62ab1fec-87d0-4503-a9b0-17feeb1848f2

### 77\. crowdstrike\_azure\_managed\_disk -IS-> azure\_managed\_disk

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_managed\_disk.`id` = azure\_managed\_disk.`id`

Rule Id: igm-rule-6f626e1c-adcc-4fa0-9681-1bbfb2c738e7

### 78\. crowdstrike\_azure\_mysql\_server -IS-> azure\_mysql\_server

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_mysql\_server.`id` = azure\_mysql\_server.`id`

Rule Id: igm-rule-c57ed702-8f21-4825-bbb3-393576652601

### 79\. crowdstrike\_azure\_security\_group -IS-> azure\_security\_group

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_security\_group.`id` = azure\_security\_group.`id`

Rule Id: igm-rule-307ca2f4-ab1e-49f9-ae3f-f05d7058b09a

### 80\. crowdstrike\_azure\_storage\_account -IS-> azure\_storage\_account

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_storage\_account.`id` = azure\_storage\_account.`id`

Rule Id: igm-rule-cc9d5f2d-c2c5-467c-8de2-f85601af26cd

### 81\. crowdstrike\_azure\_subscription -IS-> azure\_subscription

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_subscription.`id` = azure\_subscription.`id`

Rule Id: igm-rule-d5c3e587-4a00-4dec-b40c-5249daa9a575

### 82\. crowdstrike\_azure\_vm -IS-> azure\_vm

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_vm.`id` = azure\_vm.`id`

Rule Id: igm-rule-8a95c67e-aa09-4e68-a354-b740d3fef52a

### 83\. crowdstrike\_azure\_vnet -IS-> azure\_vnet

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_vnet.`id` = azure\_vnet.`id`

Rule Id: igm-rule-ad55b4b1-8042-4789-9967-ee86529c5b6c

### 84\. crowdstrike\_azure\_web\_app -IS-> azure\_function\_app

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_web\_app.`id` = azure\_function\_app.`id`

Rule Id: igm-rule-1001f1f6-0940-4e2b-a3b8-9e9252015711

### 85\. crowdstrike\_sensor -PROTECTS-> aws\_instance

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_sensor.`ec2InstanceArn` = aws\_instance.`_key`

Rule Id: igm-rule-1652c792-fc60-41fb-af6e-58c425c252c4

### 86\. crowdstrike\_sensor -PROTECTS-> azure\_vm

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_sensor.`instanceId` = azure\_vm.`vmId`

Rule Id: igm-rule-69bd8f24-faba-410f-86c0-c6cdaa467562

### 87\. crowdstrike\_sensor -PROTECTS-> Device&!unified\_device

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_sensor.`macAddress` IN Device&!unified\_device.`macAddress`

Rule Id: igm-rule-d4a56fa5-7d2b-43b2-9a83-ae96475a9379

### 88\. crowdstrike\_sensor -PROTECTS-> Device&!unified\_device

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_sensor.`macAddress` = Device&!unified\_device.`macAddress`

Rule Id: igm-rule-41db719f-2da4-49cd-aa45-656f099d10e4

### 89\. crowdstrike\_sensor -PROTECTS-> google\_compute\_instance

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_sensor.`instanceId` = google\_compute\_instance.`id`

Rule Id: igm-rule-e94163ae-9746-11ed-a8fc-0242ac120002

### 90\. crowdstrike\_sensor -PROTECTS-> oci\_compute\_instance

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_sensor.`instanceId` = oci\_compute\_instance.`_key`

Rule Id: igm-rule-a8f3b2c1-5d4e-4a9b-8c7f-1e2d3f4a5b6c

### 91\. crowdstrike\_sensor -PROTECTS-> vsphere\_vm

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_sensor.`macAddress` IN vsphere\_vm.`macAddress`
> -   crowdstrike\_sensor.`connectionIp` = vsphere\_vm.`ipAddress`
> -   crowdstrike\_sensor.`hostname` = vsphere\_vm.`host`

Rule Id: igm-rule-350e504d-18d8-4f71-b9ca-37765e0dd09e

## JAMF Rules

### 92\. crowdstrike\_sensor -PROTECTS-> user\_endpoint

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_sensor.`macAddress` = user\_endpoint.`macAddress`

Rule Id: igm-rule-8f7bf995-5356-4425-a78e-713d186ca176

## KUBERNETES Rules

### 93\. kube\_container\_spec -USES-> aws\_ecr\_image

> **Mapping Rule Conditions**
> 
> -   kube\_container\_spec.`image` IN aws\_ecr\_image.`fullName`

Rule Id: igm-rule-65a1103a-1207-4cbe-8899-1f3f49be19ca

## MICROSOFT ENDPOINT DEFENDER Rules

### 94\. microsoft\_defender\_machine -PROTECTS-> aws\_instance

> **Mapping Rule Conditions**
> 
> -   microsoft\_defender\_machine.`computerDnsName` IN aws\_instance.`fqdn`

Rule Id: igm-rule-923ad033-1da2-497f-b75d-a0d03ff6541a

## OKTA Rules

### 95\. okta\_application -CONNECTS-> azure\_account

> **Target Filters**
> 
> -   `appAccountType = "office365_account"`
> -   `isSAMLApp = true`
> -   `ssoEnabled = true`

> **Mapping Rule Conditions**
> 
> -   okta\_application.`appVendorName` = azure\_account.`vendor`
> -   okta\_application.`appDomain` = azure\_account.`verifiedDomains`
> -   okta\_application.`appAccountId` = azure\_account.`displayName`

Rule Id: igm-rule-99de2f2a-23d5-4299-ae53-066881436340

## ORCA Rules

### 96\. aws\_lambda\_function -HAS-> orca\_asset

> **Target Filters**
> 
> -   `type = "function"`
> -   `cloudProvider = "aws"`

> **Mapping Rule Conditions**
> 
> -   aws\_lambda\_function.`arn` = orca\_asset.`assetVendorId`

Rule Id: igm-rule-c2180448-f0be-4091-9596-642661432917

### 97\. aws\_instance -IS-> orca\_asset

> **Target Filters**
> 
> -   `type = "vm"`
> -   `cloudProvider = "aws"`

> **Mapping Rule Conditions**
> 
> -   aws\_instance.`instanceId` = orca\_asset.`assetVendorId`

Rule Id: igm-rule-0f4bd643-e1c1-425c-b2d2-228358be68ad

### 98\. azure\_vm -IS-> orca\_asset

> **Target Filters**
> 
> -   `type = "vm"`
> -   `cloudProvider = "azure"`

> **Mapping Rule Conditions**
> 
> -   azure\_vm.`vmId` = orca\_asset.`assetVendorId`

Rule Id: igm-rule-014f01d5-4059-4ae5-88dd-5e587d05079a

## RAPID7 Rules

### 99\. insightvm\_host -IS-> aws\_instance

> **Mapping Rule Conditions**
> 
> -   insightvm\_host.`sourceAWS` = aws\_instance.`id`

Rule Id: igm-rule-ad4da876-f247-4fb0-a0eb-70edff0c1135

## SENTINELONE Rules

### 100\. sentinelone\_agent -PROTECTS-> user\_endpoint

> **Mapping Rule Conditions**
> 
> -   sentinelone\_agent.`uuid` = user\_endpoint.`deviceId`
> -   sentinelone\_agent.`serial` = user\_endpoint.`serial`

Rule Id: igm-rule-a241f3e8-39b5-4c4a-bb03-6a57cfb56e54

## SNYK Rules

### 101\. snyk\_project -SCANS-> CodeRepo

> **Target Filters**
> 
> -   `snyk_project = "github"`
> -   `snyk_project = "github-enterprise"`
> -   `snyk_project = "bitbucket"`
> -   `snyk_project = "gitlab"`

> **Mapping Rule Conditions**
> 
> -   snyk\_project.`repoOrganization` = CodeRepo.`owner`
> -   snyk\_project.`repoName` = CodeRepo.`name`

Rule Id: igm-rule-79e7b53f-7fec-43f0-8aa2-25d86d1f630d

## TENABLE CLOUD Rules

### 102\. tenable\_asset -IS-> user\_endpoint

> **Mapping Rule Conditions**
> 
> -   user\_endpoint.`macAddress` IN tenable\_asset.`macAddresses`

Rule Id: igm-rule-dd10f855-f7ea-4344-94dd-029b5e66a89f

### 103\. user\_endpoint -HAS-> tenable\_vulnerability\_finding

> **Mapping Rule Conditions**
> 
> -   user\_endpoint.`macAddress` = tenable\_vulnerability\_finding.`macAddress`

Rule Id: igm-rule-16059bc4-b30d-48c7-a817-ff1d5820ae0d

## TREND MICRO Rules

### 104\. trend\_micro\_sensor -PROTECTS-> aws\_instance

> **Target Filters**
> 
> -   `cloudProvider = "AWS"`

> **Mapping Rule Conditions**
> 
> -   trend\_micro\_sensor.`ec2InstanceId` = aws\_instance.`instanceId`

Rule Id: igm-rule-74cb8e41-c566-4cd3-b68a-89edea7099a1

### 105\. trend\_micro\_sensor -PROTECTS-> user\_endpoint

> **Mapping Rule Conditions**
> 
> -   trend\_micro\_sensor.`hostname` = user\_endpoint.`hostname`

Rule Id: igm-rule-041a190d-25c2-47a7-a0ac-da70304a7475

## WIZ Rules

### 106\. Entity -HAS-> wiz\_vulnerability\_finding

> **Target Filters**
> 
> -   `assetCloudPlatform = "AWS"`

> **Mapping Rule Conditions**
> 
> -   Entity.`_key` = wiz\_vulnerability\_finding.`assetProviderUniqueId`

Rule Id: igm-rule-71f137fd-43f6-4b57-ad41-1f55d16a0714

---

Source: /jupiterOne-data-model/metadata

# Entity and Relationship Metadata

The following metadata is assigned by JupiterOne internally to entities and relationships. All internal metadata has `_` prefix to the property name.

## Class, Type, Key and ID

| Property | Type | Description |
| --- | --- | --- |
| `_class` | \`string | string\[\]\` |
| `_type` | `string` | The specific type of the resource. |
| `_key` | `string` | An identifier of the resource unique within an integration instance or data source scope. |
| `_id` | `string` | A globally unique identifier of the resource within JupiterOne. |

## Timestamps

_All timestamps are store in Epoch milliseconds and displayed in the UI in ISO date string format._

| Property | Type | Description |
| --- | --- | --- |
| `_createdOn` | `number` | The timestamp the entity/relationship was first created in JupiterOne. Usually represents a time after the resource was created in the provider environment. |
| `_beginOn` | `number` | The timestamp when the latest version of entity/relationship was created. Equivalent to last updated timestamp within JupiterOne (_not_ the timestamp of the resource updated in the provider environment). |
| `_endOn` | `number` | THe timestamp a version of the entity/relationship was deleted in JupiterOne. |

> Timestamps from the resource provider, if available, are generally normalized to one of the following:
> 
> -   `createdOn`
> -   `updatedOn`
> -   `deletedOn`
> -   `startedOn`
> -   `stoppedOn`

## State and source related metadata

| Property | Type | Description |
| --- | --- | --- |
| `_deleted` | `boolean` | Indicates whether a resource was deleted from JupiterOne graph/CMDB. This typically means the resource was recently deleted from the provider source environment. |
| `_version` | `number` | The version number, which increments every time a change to the resource configuration/attribute is captured. |
| `_source` | `string` | The source from where the resource was created. Valid options include: `integration-managed`, `powerup-managed`, `system-internal`, `system-mapper`, and `api`. |

## Integration specific metadata

_The following metadata only exists on resources created via an integration._

| Property | Type | Description |
| --- | --- | --- |
| `_integrationClass` | \`string | string\[\]\` |
| `_integrationType` | `string` | Type of the integration. Typically the service provider name. For example: `aws`, `google`, `azure`, `okta`, `knowbe4`, `vmware`, etc. |
| `_integrationName` | `string` | User-provided friendly name of the integration instance. |
| `_integrationDefinitionId` | `string` | Internal UUID that identifies the definition for this integration, e.g. AWS, Azure, etc. |
| `_integrationInstanceId` | `string` | Internal UUID that identifies the integration instance. An integration can have more than one configuration instances. For example, multiple AWS accounts have multiple AWS integration instances. |

---

Source: /jupiterOne-data-model/network-endpoint

# JupiterOne Data Model for Network and Endpoint Infrastructure

As we build integrations for network and endpoint protection products we start with this reference model and attempt to collect these types of entities and map these kinds of relationships so that customers using these products will be able to use the same queries for any network or endpoint product integrated with JupiterOne. Based on the product and what is available to JupiterOne for import, adjustments are made that will be unique to each product.

![https://my.mindnode.com/xwTb6G79dPheRUr55ZZfDxb1qE27iYjTiAqSY9pH/em#357,243,-2](/assets/images/data-model-network-endpoint-76b0fa4024d8b300eee8bdc6581e913c.png)

---

Source: /jupiterOne-data-model/org-grc

# JupiterOne Data Model for Governance, Risk, and Compliance (GRC)

As we build integrations for Governance, Risk and Compliance (GRC) products we start with a reference model like this and attempt to collect these types of entities and map these kinds of relationships so that customers using GRC products will be able to use similar queries for any GRC product integrated with JupiterOne. Based on the product and what is available to import to JupiterOne, adjustments are made that will be unique to each product.

![https://my.mindnode.com/2ayndotqvjEJ3qAeEfwyy6sgkRciyxRvH1sgpYw4/em#333.4,207.2,-2](/assets/images/data-model-org-grc-c6a36c00d1940b3e79fb3c6bef68963f.png)

## Standards, Sections, Requirements

Standards are, broadly, compliance frameworks, regulations, or industry best practices. Standards can be used interchangeably with the synonymous term frameworks.

Examples of standards include: HIPAA, ISO 27001, PCI-DSS, FedRAMP, NIST CSF, CIS Benchmarks, etc.

> A standard is a collection of requirements grouped by sections, or a collection of controls grouped by domains.

Sections can be considered as parts or components of a standard.

Examples of sections include: HIPAA Physical Safeguards (§164.310), ISO 27001 Clause 6, PCI-DSS Requirement 8, the Access Control (AC) Family within FedRAMP, CIS Basics 2. Inventory of Software Assets, etc.

> A standard _has_ one or more sections. A section _has_ one or more requirements.

Requirements comprise sections of a standard. Individual requirements outline the specification that needs to be met.

Examples of requirements include: HIPAA §164.310(a)(1)(i), ISO 27001 6.1.3 a, PCI-DSS 8.4.b, FedRAMP AC-2 (7), utilizing application whitelisting to implement CIS Basics 2.7, etc..

When thinking through different regulatory or compliance standards/frameworks, the idea of a standard _having_ one or more sections, which _have_ one or more requirements is equivalent to a framework _having_ one or more domains, which _have_ one or more controls.

## Policies, procedures, controls, control policies/configurations, vendors

You can think of an organization’s policies, procedures, and controls to loosely align to the compliance or regulatory standards, sections, and requirements.

Another way of looking at it would be: **policies** + **procedures** reflect you organization's internal view of how to run security, which is demonstrated to external stakeholders via the compliance implementation of **standards/sections/requirements** or **framework/domains/controls**.

At JupiterOne, we have an internal **framework** of **controls**. How we do security is reflected in our **policies** + **procedures** within the [**Policies** app](https://j1.apps.us.jupiterone.io/policies/overview). **Policies** map to **domains**, **procedures** map to **controls**. Conversely, those same internal JupiterOne **policies, procedures, and controls** satisfy external regulatory/compliance **standards, sections, and requirements** in the [**Compliance** app](https://j1.apps.us.jupiterone.io/compliance).

**Policies** are high-level statements of management intent; they are written security documents which frequently satisfy external requirements.

Examples of policies include: access management policies, data protection policies, human resource policies.

> **Policies** are _implemented_ by **procedures**.

**Procedures** are written security documents which describe how to implement policies via technology or processes, or a combination of the two; the ‘who’, ‘what’, ‘when’, ‘how’, etc; they can be thought of as control or process descriptions.

Examples of procedures (aka control/process descriptions) include:

-   password management
-   protecting data at rest
-   employee screening

> **Policies** are _implemented_ by **procedures**; **controls** _implement_ **procedures**.

**Controls** are the technical, administrative, and physical safeguards that enforce the procedures; they can manifest commonly as a process managed by a person/team or as a product/service provided by a vendor.

Examples of controls include:

-   user identity management, access control, multi-factor authentication
-   data encryption at rest or in transit
-   penetration testing, code scanning
-   pre-employment background checks.

> A `ControlPolicy` or `Configuration` _enforces_ or _manages_ a `Control`.

**Control Policies** or **configurations** are the technical settings whereby controls are implemented.

Examples of control policies or configurations include:

-   requiring 12+ characters including a number + a symbol for all passwords
-   using AES-256 cipher for encryption at rest
-   for background checks, specifically include searches for federal, criminal, state, county, city, financial, and education verification

> **Vendors** _provide_ **controls**.

Vendors are frequently companies, organizations, or people that provide the controls.

Examples of vendors include:

-   Microsoft (the Vendor) for Active Directory (AD), user authentication, and access control
-   Amazon Web Services (AWS, the Vendor) for Key Management Service (KMS)
-   Checkr (the Vendor) for background screens

> **Policies** are _implemented_ by **procedures**; **controls** _implement_ **procedures**. A **control Policy** or **configuration** _enforces_ or _manages_ a **control**.

> **Policies** are _implemented_ by **procedures**; **controls** _implement_ **procedures**. **Vendors** _provide_ **controls**.

---

Source: /jupiterOne-data-model/org-mgmt

# JupiterOne Data Model for Organization, Account, and Vendor Management

As we build integrations for products that have organization, account, or vendor management features we start with this reference model and attempt to collect these types of entities and map these kinds of relationships so that customers using these products will be able to use the same queries for any product integrated with JupiterOne. Based on the product and what is available to JupiterOne for import, adjustments are made that will be unique to each product.

![](/assets/images/data-model-person-vendor-org-02e8025f0c9893f9b2e475dcf1bab634.png)

---

Source: /jupiterOne-data-model/parameters

# JupiterOne Parameter Service

Previously, some use cases of JupiterOne required referencing a _literal_ value that is better suited to reference as a _variable_ or a **parameter**. Some common values that are better stored and retrieved at runtime instead of saved literally include:

-   Long or unwieldy values (such as a long URL)
-   Sensitive values (such as a private key or API token)
-   Common values (such as dates, keys) that you may want to change in many places at one time

A better alternative exists in the form of parameters that can be stored and referenced in rules and queries with a special syntax.

## Examples

In the use case of a very long URL, which may not be easily human-readable and may be referenced in many rules, queries, or questions, use:

### Example: Parameters in J1QL

```j1ql
FIND Application WITH loginUrl = ${ param.longURL }
```

### Example: Parameters in Rules

```json
  "headers": {
    "Authorization": "Bearer {{param.secretApiKey}}"
  }
```

The service hydrates the value of `longUrl` or `secretApiKey` and evaluates it against the remote contents instead of the parameter expression. You can leverage this same pattern for different types of parameter types and comparisons, explained below. As shown above, the syntax between rules and queries differs slightly, but is consistent with variables (in the case of queries) and expressions (in the case of rules).

## Usage: Schema

Currently, the storage of parameters is only accessible from public-facing GraphQL endpoints. In the future, a user interface will be available to account users but, currently, only the API exists.

A parameter is an object stored in the parameter-service, which uses the following schema:

| Property | Type | Description |
| --- | --- | --- |
| `name` | `string` | The parameter **key** or "name" |
| `value` | `string` | `number` | `boolean` | `list`[\*](#list-types) | The parameter **value** to be stored/retrieved |
| `secret` | `boolean` | **Flag** to treat value as sensitive data |
| `lastUpdatedOn` | `date` | **Date** which indicates last update |

#### List Types

Lists are considered to be arrays of `string`, `number`, or `boolean` types.

## Usage: API Operations and Queries

| Queriable fields: |  |
| --- | --- |
| parameter | Individual `QUERY` for one parameter |
| parameterList | Bulk `QUERY` for parameters |

| Mutations: |  |
| --- | --- |
| setParameter | Create/update a remote parameter |
| deleteParameter | Remove a parameter from the remote store |

### GraphQL API

### Query: `parameter`

| _Argument_ | _Type_ | _Required?_ |
| --- | --- | --- |
| name | `string` | Yes |

**_Returns_**: Parameter

**_Example_**:

```gql
query Query($name: String!) {
  parameter(name: $name) {
    name
    value
    secret
    lastUpdatedOn
  }
}
```

### Query: `parameterList`

| _Argument_ | _Type_ | _Required?_ | _Default_ |
| --- | --- | --- | --- |
| limit | `number` | No | 100 |
| cursor | `string` | No (unless paginating) | n/a |

**_Returns_**: Paginated

**_Example_**:

```gql
query Query($limit: Int, $cursor: String) {
  parameterList(limit: $limit, cursor: $cursor) {
    items {
      name
      value
      secret
      lastUpdatedOn
    }
    pageInfo {
      endCursor
      hasNextPage
    }
  }
}
```

### Mutation: `setParameter`

| _Argument_ | _Type_ | _Required?_ | _Default_ |
| --- | --- | --- | --- |
| name | `string` | Yes | n/a |
| value | `string` | `number` | `boolean` | `list` | Yes | n/a |
| secret | `boolean` | No | `false` |

### **_Returns_**

```ts
{
  success: boolean;
}
```

**_Example_**

```gql
mutation Mutation($name: String!, $value: ParameterValue!) {
  setParameter(name: $name, value: $value) {
    success
  }
}
```

**_List Parameters Variables Example_**

```gql
{
  "name": "items",
  "value": ["jupiterone.com", 2] // multi-type arrays are allowed
}
```

**_Non-List Parameters Variables Example_**

```gql
{
  "name": "j1domain",
  "value": "jupiterone.com"
}
```

#### Mutation: `deleteParameter`

| _Argument_ | _Type_ | _Required?_ |
| --- | --- | --- |
| name | `Array<string>` | Yes |

#### **_Returns_**

```ts
{
  success: boolean;
}
```

**_Example_**

```gql
mutation Mutation($name: String!) {
  deleteParameter(name: $name) {
    success
  }
}
```

## Parameter References

You can reference parameters in [rules' configurations](/api/alert-rules.md#rule-definition-reference) or any [query expression](/j1ql.md), although the syntax is slightly different between the two. `param` is a special keyword that, when invoked, fetches values from the parameter-storing service.

**Note:** In the case of both rules and queries, referencing a nonexistent parameter causes an error and abandon execution.

## Auditing and Security

All changes (including creation and deletion) of parameters is captured by an audit trail providing visibility into the historic usage and access of these values. In addition, all parameters are encrypted-at-rest and in-transit, subject to log redaction, and are subject to either ABAC or IAM-based fine-grained permissions.

## Secret Parameters

Any parameters set with `secret` to be `true` have write-only values and are not readable from the API. Only evaluations of the query can access these parameter values. This usage enables the storage of sensitive parameters such as API keys that JupiterOne users should not be able to see. All read access to these secret parameters contains redacted values, but metadata is able to be read.

**Note:** By design, you cannot update a parameter that has had `secret` set to true to `secret: false` without also changing the value in the same request.

---

Source: /jupiterOne-data-model/people

# JupiterOne Data Model for People and Access

As we build integrations for products that include user or people account along with different access levels or permissions we start with this reference model and attempt to collect these types of entities and map these kinds of relationships so that customers using these products will be able to use the same queries for any integration they have enabled. Based on the product and what is available to JupiterOne for import, adjustments are made that will be unique to each product.

![](/assets/images/j1-data-model-people-90461e3e63bb9253ebeeb4306174911a.png)

---

Source: /jupiterOne-data-model/vuln-mgmt

# JupiterOne Data Model for Vulnerability Management

As we build integrations for products that identify findings and vulnerabilities we start with this reference model and attempt to collect these types of entities and map these kinds of relationships so that customers using these products will be able to use the same queries for any integration they have enabled. Based on the product and what is available to JupiterOne for import, adjustments are made that will be unique to each product.

![https://my.mindnode.com/8G2MirWYz1zs1sbynAj7XUMtCeDctYiqqjy1hjnN/em#520,-145,-2](/assets/images/data-model-vuln-mgmt-9c838e396b17baa2dcbf1ad2d1be2e54.png)

---

Source: /platform-overview/alerts-intro

# Alerts and workflows

JupiterOne supports the ability to [turn any J1QL query into an alert](/features/insights-and-alerts/alerts.md), which allows you to proactively monitor questions of interest without the need to manually perform those queries to find changes.

With an alert rule, JupiterOne will automate the monitoring process for a particular question and allows you to send that information into a variety of workflows such as alerting or ticketing, or remediation flows. With alerts, you can have JupiterOne kick off a variety of workflows that support:

-   Creating a Jira ticket
-   Sending an email or Slack message
-   Creating ServiceNow incident
-   Sending a generic webhook

### Alert packs

Along with JupiterOne's ability to create alert rules for individual questions, we also offer [rule packs](/features/insights-and-alerts/alert-rule-packs.md) based on the integrations you have configured within your JupiterOne workspace. For example, if you have AWS configured, you can leverage the pre-built rule packs that allow for alerts on questions relating to your AWS environment. These alert rule packs automatically turn on once the respective integration has been configured.

---

Source: /platform-overview/assets-intro

# Asset Insights

JupiterOne supports more than just users and devices. We capture and ingest a broad variety of asset classes that span from code repositories to user access roles to findings.

## Assets supported by JupiterOne

JupiterOne supports the [ingestion and mapping of a wide variety of assets](/features/assets/ingesting-assets.md) that build a holistic picture of your ecosystem. Go beyond merely users and devices and build a holistic view of your assets, including:

-   Applications and services
-   Compute and devices
-   Data and storage
-   Identities and access
-   Networks
-   People and Organizations
-   Policies and documentation
-   Risk and alerts
-   Custom assets (define your own)

### Streamline findings

Context is key to evaluating your asset landscape. JupiterOne brings your data to one centralized location, providing for meaningful discoveries and clear, actionable insights. Make the most of your assets by:

-   Having a centralized location for managing all assets
-   Identifying unknown risks and relationships in your attack surface
-   Monitoring and maintaining critical assets
-   Taking action to resolve key findings

#### Target assets quickly with classes

By normalizing your assets into asset classes, JupiterOne enables you the ability to query and evaluate and filter data quickly. This allows you to focus on finding entities within the class rather than needing to explicitly state the entity in the query.

#### Up next

We'll illustrate how the JupiterOne graph can help monitor and address more complex Cloud Security Posture Management use cases.

---

Source: /platform-overview/billing-faqs

# Billing FAQs

## Billing Models

JupiterOne has historically supported both entity count and activity based billing models. For enterprise customers additional usage terms may exist in your contract. This document is intended to serve as a guide to how JupiterOne calculates billing, but your license agreement and terms of your contract with JupiterOne always take precedence over this document.

### All Assets Count

Total asset count billing model is the current default billing for new JupiterOne customers. It is a very simple billing metric where all assets (aka entities) are counted, and does not include system created entities.

### Employee Count or Asset Operations (legacy)

Employee count based billing relied on an "Asset Operation" (aka AO) fair usage limit, which was calculated monthly for customers.

For more details on the legacy AO billing model please see [Billing FAQ (legacy)](/platform-overview/legacy-billing.md)

### Billable Entities (legacy)

Billable Entities (aka BE) billing was similar to the current Entity Count model but with complex exclusions for some classes of assets.

For more details on the legacy BE billing model please see [Billing FAQ (legacy)](/platform-overview/legacy-billing.md)

## FAQ

### Q: How are assets counted in the "All Assets" model?

Assets can be counted using the following JupiterOne query:

```j1ql
FIND * WITH  _source !^= "system-" AS e
RETURN COUNT(e) AS allEntityCount
```

This counts all non-deleted assets in your account that were not created by the system mapping rules. This is all assets that have been created via integrations, through the API, or manually though the web UI.

For monitoring purposes this asset count is collected daily and entitlements are calculated using a rolling average.

### Q: I don't want be billed for a particular asset type

One of the reasons that JupiterOne has been able to move to a simplified asset billing model is the greatly increased flexibility customers have in configuring what types of assets an integration ingests. For example the AWS integration allows fine grained control of over 160 different types of assets. Customers that don't get value from a particular type of asset can choose to not bring them into JupiterOne.

### Q: Do ephemeral entities inflate my billing counts?

No, ephemeral workloads will not cause the asset count to be artificially high. Any short term spikes in assets, or weekly and monthly seasonality, will not inflate asset counts as JupiterOne reviews usage over a rolling period.

The usage calculations are done as a daily single point in time count of entities, it is _not_ a count of all unique entities in the last 24 hours.

---

Source: /platform-overview/cspm-intro

# Cloud Security Posture Management

Building off of the example queries showcased in the previous video, here we will explore how we can leverage the context provided by the JupiterOne graph to solve for a complex, real-world use case: discovering public-facing instances that have access to non-public S3 buckets.

By leveraging the [prebuilt questions in JupiterOne](https://docs.jupiterone.io/features/admin/query-builder#questions), you can quickly execute queries. In this example, we are using **Are there public facing instances that are allowed to access non-public S3 buckets?**. By selecting the question, JupiterOne will run the associated query and display the results.

#### Up next

In the next article, we'll illustrate how JupiterOne can help automate your security workflows by creating alerts based on questions and queries such as the one illustrated above–enabling you to be alerted whenever a change may occur in findings for a particular query.

---

Source: /platform-overview/incident-response-intro

# Incident Response

By leveraging the JupiterOne graph, you can quickly evaluate and determine where and how an incident may have taken place with all the context you need to make an informed decision.

## Cloud Workloads

Type in a hostname, instance id, or IP address to see all the contextual information you need to quickly understand a cloud resource. This information includes the blast radius, connected resources, privileged access paths, internet attack path, and more.

## User endpoint blast radius

Search for the MAC address or IP address of a device, or the email address of an employee to understand the blast radius of any devices they own, the user accounts they have, and the related identities or permissions in order to understand what a malicious user could access if the device were compromised.

#### Up next

Next, we'll explore our vulnerability reporting solution and how it can improve your ability to secure your digital environment.

---

Source: /platform-overview/j1-platform-introduction

# JupiterOne Intro

Welcome to JupiterOne. Our innovative platform combines the power of automation, threat intelligence, and intuitive visualization to provide a holistic view of your entire digital infrastructure.

  

## Features

JupiterOne helps you monitor and safeguard your digital assets as well as streamline your security operations through the following use cases:

-   [Incident response](/platform-overview/incident-response-intro.md)
-   [Vulnerability reporting](/platform-overview/vulnerability-reporting-intro.md)
-   [Asset inventory and management](/platform-overview/assets-intro.md)
-   [Cloud Security Posture Management (CSPM)](/platform-overview/cspm-intro.md)
-   [Alerts and security workflows](/platform-overview/alerts-intro.md)

#### Up next

To kick things off, we'll dive into an example illustrating how JupiterOne can handle incident response and showcase the depth and context provided by the JupiterOne graph.

---

Source: /platform-overview/legacy-billing

# Billing FAQs (Legacy)

This page includes FAQ entries for the old billing models. If in doubt regarding billing please check with your customer support representative.

### Q: What are asset operations? What functions make up asset operations?

> **NOTE**
> 
> The Employee and Asset Operations (AO) billing model is deprecated for new customers

Asset operations for the JupiterOne security platform is defined as the cumulative count over a month of the changes to the J1 graph: create, delete, and update operations for entities and relationships.

The following is the full list of asset operation functions that count towards the asset operations total:

-   create\_entity
-   update\_entity
-   delete\_entity
-   remap\_entity
-   create\_relationship
-   update\_relationship
-   create\_mapped\_relationship
-   delete\_relationship
-   delete\_integration

### Q: What is the billable entities licensing model? What are entities? And how are they counted for usage/billing?

> **NOTE**
> 
> The Billable Entities (BE) model is deprecated for new customers

Prior to 2023, JupiterOne used the billable entities licensing model. This model is now deprecated and the asset operations model applies going forward.

The billable entities model counted the number of entities under management in the JupiterOne account.

An `entity` is a `node` stored in the JupiterOne graph database. Entities typically come from an integration. They can also be added via the Asset Inventory web app or API (custom scripts).

Each entity represents an object from your organization's digital operational environment. Examples include an AWS EC2 instance, RDS DB cluster, RDS DB instance, IAM role, IAM policy, user endpoint, etc.

The following entities are not counted for billing/usage calculation:

-   **Mapped Entities** -- these are entities with `_source='system-mapper'` property. These are entities derived by the JupiterOne Mapper, such as an external Network or Host entity created because a security group contains a rule pointing to it.
    
-   **System Internal Entities** -- these are entities with `_source='system-internal'` property. These are internal JupiterOne system/app generated resources that are mapped to the graph as entities, such as `compliance_standard`, `compliance_requirement`, etc.
    
-   **Findings and PRs** -- these entities are considered "event-like" and not true resources in an digital operating environment, therefore they are not being counted for usage/billing purpose.
    
-   **Images, NetworkInterfaces, and IpAddress** -- these entities are also not counted against the usage or billing.
    
-   **Records and DomainRecords** -- records such as DNS records, Jira issues are not considered as billable.
    

Billable entities count is averaged daily, and again monthly. This can be viewed by going to **Settings** -> **Account Management** in the JupiterOne web UI.

> **NOTE**
> 
> There is a soft-limit on non-billable entities. Depending on your JupiterOne subscription plan, the soft-limit is 2x, 5x or 10x of the total billable entities limit.
> 
> For example, if your purchased the Enterprise Premier plan with 50,000 billable entities, you can have up to 500,000 non-billable entities.

You can also run the following query in your account to get a live count of your billable entities:

```j1ql
FIND * WITH  _source !^= "system-"
  AND _class != ("Finding" OR "PR" OR "Image" OR "NetworkInterface" OR "IpAddress" OR "Record" OR "DomainRecord") AS e
RETURN COUNT(e) AS billableEntityCount
```

#### Billable entities table

> **NOTE**
> 
> This table is not exhaustive, it only indicates examples of the most common classes and their billable status.

| Entity | Description | Billable |
| --- | --- | --- |
| `AccessKey` | A key used to grant access, such as ssh-key, access-key, api-key/token, mfa-token/device, etc. | Yes |
| `AccessPolicy` | A policy for access control assigned to a Host, Role, User, UserGroup, or Service. | Yes |
| `AccessRole` | An access control role mapped to a Principal (e.g. user, group, or service). | Yes |
| `Account` | An organizational account for a service or a set of services (e.g. AWS, Okta, Bitbucket Team, Google G-Suite account, Apple Developer Account). Each Account should be connected to a Service.Description | Yes |
| `Application` | A software product or application. | Yes |
| `ApplicationEndpoint` | An application endpoint is a program interface that either initiates or receives a request, such as an API. | Yes |
| `Assessment` | An object to represent an assessment, including both compliance assessment such as a HIPAA Risk Assessment or a technical assessment such as a Penetration Testing. Each assessment should have findings (e.g. Vulnerability or Risk) associated. | Yes |
| `Attacker` | An attacker or threat actor. | Yes |
| `Backup` | A specific repository or data store containing backup data. | Yes |
| `Certificate` | A digital Certificate such as an SSL or S/MIME certificate. | Yes |
| `Channel` | A communication channel, such as a Slack channel or AWS SNS topic. | Yes |
| `Cluster` | A cluster of compute or database resources/workloads. | Yes |
| `CodeCommit` | A code commit to a repo. The commit id is captured in the \_id property of the Entity. | No |
| `CodeDeploy` | A code deploy job. | Yes |
| `CodeModule` | A software module. Such as an npm\_module or java\_library. | Yes |
| `CodeRepo` | A source code repository. A CodeRepo is also a DataRepository therefore should carry all the required properties of DataRepository. | Yes |
| `CodeReview` | A code review record. | Yes |
| `Configuration` | A Configuration contains definitions that describe a resource such as a Task, Deployment or Workload. For example, an `aws_ecs_task_definition` is a `Configuration`. | Yes |
| `Container` | A standard unit of software that packages up code and all its dependencies and configurations. | Yes |
| `Control` | A security or IT Control. A control can be implemented by a vendor/service, a person/team, a program/process, an automation code/script/configuration, or a system/host/device. Therefore, this is most likely an additional Class applied to a Service (e.g. Okta SSO), a Device (e.g. a physical firewall), or a HostAgent (e.g. Carbon Black CbDefense Agent). Controls are mapped to security policy procedures and compliance standards/requirements. | Yes |
| `ControlPolicy` | An technical or operational policy with rules that govern (or enforce, evaluate, monitor) a security control. | Yes |
| `CryptoKey` | A key used to perform cryptographic functions, such as an encryption key. | Yes |
| `DataObject` | An individual data object, such as an aws-s3-object, sharepoint-document, source-code, or a file (on disk). The exact data type is described in the \_type property of the Entity. | No |
| `DataStore` | A virtual repository where data is stored, such as aws-s3-bucket, aws-rds-cluster, aws-dynamodb-table, bitbucket-repo, sharepoint-site, docker-registry. The exact type is described in the \_type property of the Entity. | Yes |
| `Database` | A database cluster/instance. | Yes |
| `Deployment` | A deployment of code, application, infrastructure or service. For example, a Kubernetes deployment. An auto scaling group is also considered a deployment. | Yes |
| `Device` | A physical device or media, such as a server, laptop, workstation, smartphone, tablet, router, firewall, switch, wifi-access-point, usb-drive, etc. The exact data type is described in the \_type property of the Entity. | Yes |
| `Directory` | Directory, such as LDAP or Active Directory. | Yes |
| `Disk` | A disk storage device such as an AWS EBS volume | Yes |
| `Document` | A document or data object. | No |
| `Domain` | An internet domain. | Yes |
| `DomainRecord` | The DNS Record of a Domain Zone. | No |
| `DomainZone` | The DNS Zone of an Internet Domain. | Yes |
| `Finding` | A security finding, which may be a vulnerability or just an informative issue. A single finding may impact one or more resources. The `IMPACTS` relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The `IMPACTS` relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc. | No |
| `Firewall` | A piece of hardware or software that protects a network/host/application. | Yes |
| `Framework` | An object to represent a standard compliance or technical security framework. | Yes |
| `Function` | A virtual application function. For example, an aws\_lambda\_function, azure\_function, or google\_cloud\_function | Yes |
| `Gateway` | A gateway/proxy that can be a system/appliance or software service, such as a network router or application gateway. | Yes |
| `Group` | A defined, generic group of Entities. This could represent a group of Resources, Users, Workloads, DataRepositories, etc. | Yes |
| `Host` | A compute instance that itself owns a whole network stack and serves as an environment for workloads. Typically it runs an operating system. The exact host type is described in the \_type property of the Entity. The UUID of the host should be captured in the \_id property of the Entity | Yes |
| `HostAgent` | A software agent or sensor that runs on a host/endpoint. | Yes |
| `Image` | A system image. For example, an AWS AMI (Amazon Machine Image). | No |
| `Incident` | An operational or security incident. | Yes |
| `Internet` | The Internet node in the graph. There should be only one Internet node. | No |
| `IpAddress` | An re-assignable IpAddress resource entity. Do not create an entity for an IP Address _configured_ on a Host. Use this only if the IP Address is a reusable resource, such as an Elastic IP Address object in AWS. | No |
| `Key` | An ssh-key, access-key, api-key/token, pgp-key, etc. | Yes |
| `Logs` | A specific repository or destination containing application, network, or system logs. | Yes |
| `Module` | A software or hardware module. Such as an npm\_module or java\_library. | Yes |
| `Network` | A network, such as an aws-vpc, aws-subnet, cisco-meraki-vlan. | Yes |
| `NetworkEndpoint` | A network endpoint for connecting to or accessing network resources. For example, NFS mount targets or VPN endpoints. | Yes |
| `NetworkInterface` | An re-assignable software defined network interface resource entity. Do not create an entity for a network interface _configured_ on a Host. Use this only if the network interface is a reusable resource, such as an Elastic Network Interface object in AWS. | No |
| `Organization` | An organization, such as a company (e.g. JupiterOne) or a business unit (e.g. HR). An organization can be internal or external. Note that there is a more specific Vendor class. | Yes |
| `PR` | A pull request. | No |
| `PasswordPolicy` | A password policy is a specific `Ruleset`. It is separately defined because of its pervasive usage across digital environments and the well known properties (such as length and complexity) unique to a password policy. | Yes |
| `Person` | An entity that represents an actual person, such as an employee of an organization. | Yes |
| `Policy` | A written policy documentation. | Yes |
| `Procedure` | A written procedure and control documentation. A Procedure typically `IMPLEMENTS` a parent Policy. An actual Control further `IMPLEMENTS` a Procedure. | Yes |
| `Process` | A compute process -- i.e. an instance of a computer program / software application that is being executed by one or many threads. This is NOT a program level operational process (i.e. a Procedure). | Yes |
| `Product` | A product developed by the organization, such as a software product. | Yes |
| `Program` | A program. For example, a bug bounty/vuln disclosure program. | Yes |
| `Project` | A software development project. Can be used for other generic projects as well but the defined properties are geared towards software development projects. | Yes |
| `Queue` | A scheduling queue of computing processes or devices. | Yes |
| `Record` | A DNS record; or an official record (e.g. Risk); or a written document (e.g. Policy/Procedure); or a reference (e.g. Vulnerability/Weakness). The exact record type is captured in the \_type property of the Entity. | No |
| `Repository` | A repository that contains resources. For example, a Docker container registry repository hosting Docker container images. | Yes |
| `Requirement` | An individual requirement for security, compliance, regulation or design. | Yes |
| `Resource` | A generic assignable resource. A resource is typically non-functional by itself unless used by or attached to a host or workload. | Yes |
| `Review` | A review record. | Yes |
| `Risk` | An object that represents an identified Risk as the result of an Assessment. The collection of Risk objects in JupiterOne make up the Risk Register. A Control may have a `MITIGATES` relationship to a Risk. | Ye |
| `Root` | The root node in the graph. There should be only one Root node per organization account. | Yes |
| `Rule` | An operational or configuration compliance rule, often part of a Ruleset. | Yes |
| `Ruleset` | An operational or configuration compliance ruleset with rules that govern (or enforce, evaluate, monitor) a security control or IT system. | Yes |
| `Scanner` | A system vulnerability, application code or network infrastructure scanner. | Yes |
| `Secret` | A configuration item representing a secret token of some form. | Yes |
| `Section` | An object to represent a section such as a compliance section. | Yes |
| `Service` | A service provided by a vendor. | Yes |
| `Site` | The physical location of an organization. A Person (i.e. employee) would typically has a relationship to a Site (i.e. located\_at or work\_at). Also used as the abstract reference to AWS Regions. | Yes |
| `Standard` | An object to represent a standard such as a compliance or technical standard. | Yes |
| `Subscription` | A subscription to a service or channel. | Yes |
| `Task` | A computational task. Examples include AWS Batch Job, ECS Task, etc. | Yes |
| `Team` | A team consists of multiple member Person entities. For example, the Development team or the Security team. | Yes |
| `ThreatIntel` | Threat intelligence captures information collected from vulnerability risk analysis by those with substantive expertise and access to all-source information. Threat intelligence helps a security professional determine the risk of a vulnerability finding to their organization. | Yes |
| `Training` | A training module, such as a security awareness training or secure development training. | Yes |
| `User` | A user account/login to access certain systems and/or services. Examples include okta-user, aws-iam-user, ssh-user, local-user (on a host), etc. | Yes |
| `UserGroup` | A user group, typically associated with some type of access control, such as a group in Okta or in Office365. If a UserGroup has an access policy attached, and all member Users of the UserGroup would inherit the policy. | Yes |
| `Vault` | A collection of secrets such as a key ring | Yes |
| `Vendor` | An external organization that is a vendor or service provider. | Yes |
| `Vulnerability` | A security vulnerability (application or system or infrastructure). A single vulnerability may relate to multiple findings and impact multiple resources. The `IMPACTS` relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The `IMPACTS` relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc. | Yes |
| `Weakness` | A security weakness. | Yes |
| `Workload` | A virtual compute instance, it could be an aws-ec2-instance, a docker-container, an aws-lambda-function, an application-process, or a vmware-instance. The exact workload type is described in the \_type property of the Entity. | Yes |
| \[System Mapped Entities\] | Entities with `_source='system-mapper'` | No |
| \[System Internal Entities\] | Entities with `_source='system-internal'` | No |
| \[Custom Created Entities\] | Entities created with a custom-defined \_class or \_type | Yes |

---

Source: /platform-overview/vulnerability-reporting-intro

# Vulnerability Reporting

Use JupiterOne to see an aggregation of your vulnerabilities and findings across all your systems. Understand which are most critical because they are production resources, in the cloud, or classified in some way that makes them critical to your organization.

### Prioritize effectively

By leveraging JupiterOne's [graph context](/features/admin/j1-dashboard.md), you can discover and prioritize critical vulnerabilities and incorporate ticketing systems such as Jira to both send tickets regarding vulnerabilities to be addressed and also reporting on tickets that have already been completed.

#### Up next

Assets are a key component to the JupiterOne graph and are the foundation to building out your digital environment within JupiterOne. We'll explore how these are ingested and can be managed in the next article.

---

Source: /reference

# API Overview

Leverage JupiterOne's API to seamlessly ingest custom data and programmatically manage your workspace.

## Introduction

The JupiterOne platform exposes a number of public GraphQL endpoints which can be leveraged with operations relating to queries, graph, alerts, and rules.

```text
Base URL: https://graphql.us.jupiterone.io
```

Visit the [JupiterOne Public Workspace](https://www.postman.com/jupiterone-sol/jupiterone-public-workspace/overview) for examples to get started with JupiterOne's API.

Rate Limits: Rate limiting is enforced based on your account tier:

-   Free: 10/min, no burst
-   Freemium: 30/min, no burst
-   Enterprise: 30-60/min with burst

A `429` HTTP response code indicates the limit has been reached.

> **INFO**
> 
> For more information regarding API rate limiting, see our [dedicated rate limiting article](/api/rate-limiting.md).

## JupiterOne API topics

Start by connecting JupiterOne with other tools to populate relevant data within your JupiterOne workspace.

[

![](/icons/illustrations/orbit.svg)![](/icons/illustrations/orbit.svg)

The JupiterOne Data Model

Review the JupiterOne Data model and learn about two fundamental elements of the JupiterOne graph: Entities and Relationships.





](/data-model/jupiterone-data-model.md)[

![](/icons/illustrations/strategy.svg)![](/icons/illustrations/strategy.svg)

Authentication

Learn how to authenticate with the JupiterOne API and create Auth tokens for use in your JupiterOne workspace.





](/api/authentication.md)

---

Source: /reference/api-query-eratta

# Updates and Corrections to JupiterOne Query API

## Summary

Being able to retrieve all results of a query reliably is a critical capability for users of JupiterOne. There have been various improvements made to the JupiterOne query API over the years. This page is used to capture the details of ongoing updates and corrections to the JupiterOne Query API.

### Variable Result Size (September 2024)

Queries are now assumed to tolerate variable result sizes unless otherwise specified. Usage of `VariableResultsSize: true` is required to retrieve stable and complete results.

More detailed information is available [here](/reference/api-query-pagination-changes.md).

### `_type` Always Returned as String (October 2024)

Every entity in the JupiterOne graph has a `_type` property. Work was previously done to ensure that this was always returned as a string value. A defect was identified whereby aliasing this property could cause it to sometimes be returned as an array of length 1.

Going forward the `_type` property will always be returned as a string even if the property has been aliased, for example:

```j1ql
FIND Host AS h
RETURN h._type AS "Host Type"
```

Old behavior would return a response like this:

```text
... "Host Type":["device42_device"] ...
```

New behavior guarantees this response:

```text
... "Host Type":"device42_device" ...
```

---

Source: /reference/api-query-pagination-changes

# Changes to JupiterOne Query API

## Summary

Being able to retrieve all results of a query reliably is a critical capability for users of JupiterOne. There have been various improvements made to the JupiterOne query API over the years; JupiterOne is now proactively monitoring customers using legacy and unsafe techniques for retrieving query results.

From the **1st September 2024** two features will be deprecated from the JupiterOne query language and query API. Customers using these features will be proactively contacted through August 2024 to adapt their usage.

-   `SKIP` will not longer be accepted in the JupiterOne Query Language (J1QL)
-   `VariableResultsSize` will be forced to `true` for all Query API requests regardless of the flag set by the caller

### Why are we making this change now?

As part of the graph upgrade program JupiterOne has improved pagination performance, but has also identified that the legacy pagination cursor is now more unstable than before. Customers should be getting reliable results from API queries, we want to accelerate the adoption of the improved pagination and deprecate the legacy approach as soon as possible.

## What changes might you need to make?

Using JupiterOne's GraphQL API it is possible to submit a J1QL query to the service and retrieve results. There are various flags that can be passed to this query interface that impact the behavior and are relevant to this issue.

For API calls using `SKIP` and `LIMIT` pagination: use `VariableResultSize: true` and `cursor` for requesting addition pages.

For API calls already using `cursor`: use `VariableResultSize: true`.

> **INFO**
> 
> JupiterOne has observed examples where API consumers have assumed that receiving less than 250 results for a page (including zero results) indicates that the results pages have been exhausted. This is not a safe assumption, only a NULL cursor being returned indicates that the result pagination is complete.

### `SKIP` and `LIMIT` versus `cursor` pagination

Using `SKIP` and `LIMIT` for pagination is not reliable as the order of results isn't guaranteed, specifically the results that you "skip" may not have been returned on a previous call (missed results), or results may be returned on multiple pages (duplicated results).

When using the `cursor` approach it is important to continue to call the `cursor` until a NULL cursor is returned, even if a page has no results.

### Fixed versus Variable Page Size

`VariableResultSize: true` means that a returned page may include any number of results, including 0 (zero) results. For some queries (e.g. `FIND UNIQUE ...`) it is necessary for the API to respond with ALL results on the first page. Any API consumer should be prepared to deal with many results per page.

## Clients and SDKs

For customers using the client libraries and SDKs there are some details that are relevant to this work

### Python Client

The Python Client was originally built by Auth0. JupiterOne is currently working with Auth0 to adopt the PIP package. The canonical implementation of the python package is available here: [https://github.com/JupiterOne/jupiterone-api-client-python/](https://github.com/JupiterOne/jupiterone-api-client-python/).

### Go Client

The Go client is already compatible with these requirements but defaults to `VariableResultSize: false`, users should be sure to set the flag to `true`. This client is pending updates, and is available here: [https://github.com/JupiterOne/jupiterone-client-go/](https://github.com/JupiterOne/jupiterone-client-go/).

### Node Client

The node client has been updated to use the correct configuration, and no longer uses `SKIP` and `LIMIT` for pagination. This client is pending a release at this time. The client is available here: [https://github.com/JupiterOne/jupiterone-client-nodejs/](https://github.com/JupiterOne/jupiterone-client-nodejs/).

---

Source: /reference/browser-support

# Browser Support

JupiterOne is designed to work on the latest web browsers. We recommend that you use the latest version of one of the following browsers. While the application will function on browsers not supported below, not all features are guaranteed to work as designed.

## Browser Support Table

| Browser Name | Supported? | Supported Version(s) |
| --- | --- | --- |
| Google Chrome | Yes | Latest major release, and 2 preceding |
| Apple Safari | Yes | Latest major release, and 1 preceding |
| Microsoft Edge | Yes | Latest major release, and 2 preceding |
| Mozilla Firefox | Yes | Latest major release, and 2 preceding |
| Internet Explorer | No | N/A |
| Opera | No | N/A |

## Mobile Browsers

The JupiterOne application is build to be a desktop experience, so there are no guarantees that mobile browsers will create a functional experience. Please use a desktop browser to receive the best experience.

---

Source: /reference/data-retention

# Data Retention Enhancements Announcement

Data retention policies within the platform are being enhanced by JupiterOne, and as valued JupiterOne customers we wanted to update you on these improvements. Historically, clarity in our application's data retention policies has not been emphasized enough; there are numerous instances where historical data has been retained, and JupiterOne aims to standardize this process. The objective is to ensure that correct and clear expectations regarding data retention are maintained for all customers, and that data is expunged in a timely manner.

In summary, increased data retention and a clearer understanding of where that retention applies and how it operates will be experienced by all customers:

-   **Graph data:** Unlimited retention for all customers
-   **Soft-deleted data:** 7 days for existing customers
-   **Alert aggregate metrics:** Unlimited retention for all customers
-   **Alert raw results:** 180 days retention for existing customers

## Data under Consideration

When data retention is discussed by JupiterOne, it pertains to customer data in the platform, specifically the information captured in JupiterOne through integrations, data sent over the API, or manual data entry. This is referred to as the "data plane" in JupiterOne, specifically:

-   The data that is stored and accessible in the graph, i.e., the data accessed via running a J1QL query. Ref: [Data Retention in the Graph](#graph-data-retention)
-   Historical data returned by alerts, including both raw results from the queries and the high-level metrics for generating the visualizations. Ref: [Alert Results and Metrics](#alert-results-and-metrics)

Some data in JupiterOne is not affected by this data retention update and is considered "control plane" or audit data. This includes information about customer user accounts, audit logs, and logs from integration runs.

## Graph Data Retention

Moving forward, data retention in the graph is intended to be for an "unlimited" period. As long as a customer contract is in place, any data sent to the graph (and not deleted) will be retained indefinitely.

This implies that there is no requirement to resend data after a period of time or in any other way "refresh" it unless the data requires an update.

**NOTE:** If your own data is sent to JupiterOne using a custom integration or directly via the API, it is recommended that you ensure you are able to resend that data should it be necessary.

Two notable ways in which data can be routinely deleted from the graph are:

1.  If an asset has been removed from the source system (e.g., an AWS EC2 instance is terminated), JupiterOne will mark that data as "deleted," and the data will be permanently removed from the graph in the future. Ref: Soft Deleted Data
2.  An integration instance is deleted by an administrator. When this occurs, JupiterOne will delete all assets and relationships that are created by that integration and clean up the graph.

## Soft Deleted Data

When data is "deleted" from the graph, JupiterOne does not immediately remove that data; it is retained for a short period of time so that queries can capture details of entities and relationships being removed (e.g., "how many EC2 machines were removed in the last 24 hours").

Soft-deleted data is excluded from query results by default and can be identified with the property `_deleted=true`, and the data will be permanently deleted from the graph 7 days after it is soft deleted. This allows any rules, which can have up to a 7-day polling interval, to capture details on deleted assets.

## Alert Results and Metrics

Recognition by JupiterOne that once controls and queries that are critical are identified, it is important to retain the results of those evaluations. Two outputs from alerts that are relevant for data retention are metrics (i.e., total number of results, and if triggers fired), and the raw results of the queries.

The aggregate metric from the alerts is intended to be retained indefinitely as long as the alert is in place. Alert raw results are intended to be retained for 180 days; this allows customers to go back up to 6 months and re-fetch the raw results from an alert run.

**NOTE:** Alert actions are designed to facilitate the continuous and near real-time export of alert results. This should be the primary mode of long-term alert retention for customers.

## Timeline

When are these changes being made? As a customer, significant changes in the way JupiterOne is used will not be seen. Work will be conducted through December 2023 and January 2024 to ensure adherence to these clearer data retention policies.

If any questions or concerns arise, please reach out to [support@jupiterone.com](mailto:support@jupiterone.com).

---

Source: /reference/drop-rules

# Drop rules (admin)

Drop rules let an account administrator stop JupiterOne from ingesting specific entities that the account considers noise — for example, AWS default VPCs, default subnets, or AWS-managed IAM policies. A drop rule is a simple filter: any entity that matches an enabled rule is skipped at ingest and never written to your graph.

Drop rules are a controlled feature. JupiterOne enables them per account, and there is no default rule set — nothing is ever dropped unless you author a rule yourself.

## Shared responsibility

> **DANGER**
> 
> You own every drop rule and its consequences. JupiterOne provides the mechanism; you decide what to remove. If a rule drops entities that a dashboard, alert, compliance mapping, or saved query depends on, those things will break — and that is your responsibility, not a defect. Author rules deliberately and review their effect.

The model is intentionally simple and one-directional:

-   **You are in control.** JupiterOne never decides what to exclude. Completeness is the default; a drop only ever happens because your account authored a rule that names it.
-   **You own the outcome.** Dropped entities are absent from the graph. Anything that relies on them — queries, alerts, compliance evidence, reports — sees them as gone. That trade-off is yours to make and to monitor.
-   **Fail-open, never fail-closed.** A missing, disabled, or invalid rule set drops nothing. The failure direction is always "we kept data you meant to skip," never "we silently lost data you wanted."
-   **Reversible, but not instant.** Disabling or deleting a rule stops the drop, and the affected entities are re-ingested on the next full sync of each integration. They are not restored the moment you change the rule.

> **WARNING**
> 
> Drop rules are the wrong tool for most exclusions. If your goal maps to a single integration step or data source, turn that off with **Data Sources** instead. Use drop rules only for cross-cutting noise that Data Sources cannot express.

## Prerequisites

-   You must have the account **Administrator** role. Every drop-rules operation requires the `accessAdmin` permission and is rejected otherwise.
-   Drop rules must be enabled for your account by JupiterOne.

## What drop rules apply to

Drop rules are evaluated only during **integration sync ingest**, at the point where an entity would be created or updated. This has deliberate boundaries:

-   **Integration-managed data only.** Rules apply to entities ingested by an integration sync. They are scoped to the `integration-managed` source and evaluated per sync job.
-   **Entities only.** Rules match entities, never relationships or tags. When an entity is dropped, any relationship or tag that pointed at it is skipped automatically, so no dangling nodes are created.
-   **Reversible through normal sync.** On the next sync, matching entities stop being re-ingested and any copies already in the graph are removed by the standard stale-delete pass.

## What drop rules do not cover

Drop rules are narrowly scoped by design. They do **not** apply to:

-   **Mapper and MRR entities.** Entities created through the mapper or mapped-relationship (MRR) path are **not** affected by drop rules. A rule that matches a noisy asset will not suppress a mapper-created copy of it. This is a known, deliberate boundary.
-   **Direct API writes and mutations.** Entities you create or update directly through the API (including `:OVERRIDE` claims) are never dropped. A drop rule cannot silently discard a deliberate write.
-   **System-managed data.** JupiterOne-authored nodes (for example, rule, compliance, and lifecycle data) are excluded from drop-rule evaluation.

> **NOTE**
> 
> If you need mapper-created or API-created entities excluded, drop rules will not do it today. Raise the use case with JupiterOne rather than assuming a rule covers it.

## Rule shape

A rule set is an array of rules. A rule matches an entity when its optional `_type` and `_class` match and **all** of its conditions match. An entity is dropped if it matches **any** enabled rule.

```json
{
  "id": "aws-default-subnets",
  "enabled": true,
  "_type": "aws_subnet",
  "_class": "Network",
  "conditions": [
    { "property": "defaultForAz", "op": "eq", "value": true }
  ]
}
```

| Field | Required | Description |
| --- | --- | --- |
| `id` | Yes | Stable identifier for the rule. Used for per-rule reporting and for per-rule updates. |
| `enabled` | No (default `true`) | Set to `false` to keep a rule without applying it. |
| `_type` | No | Match only entities of this type. |
| `_class` | No | Match only entities of this class. |
| `conditions` | No (default `[]`) | Property conditions, combined with logical AND. |

Each condition is `{ property, op, value }`. The supported operators are:

| Operator | Meaning |
| --- | --- |
| `eq` | Property equals `value`. |
| `neq` | Property is present and does not equal `value`. |
| `in` | Property equals one of the values in the `value` array. |
| `exists` | Property is present. |
| `startsWith` | String property begins with `value` (case-sensitive; mirrors the J1QL `^=` operator). |

### Conditions match integration-supplied properties only

A condition can only reference a property that the **integration itself** puts on the entity — the value must be present in the source data at the moment of ingest. Drop rules are evaluated on the raw entity before JupiterOne enriches it, so anything JupiterOne adds _after_ ingest is invisible to a rule and cannot be matched.

Tags are the clearest example:

-   A tag set by the integration is part of the entity the integration delivers, so you **can** filter on it.
-   A tag applied by a JupiterOne **tagging rule** is added after ingest. That value is not present when the drop rule runs, so you **cannot** filter on it.

The same limitation applies to any JupiterOne-derived data — for example, properties added by mapping, tagging rules, or other post-ingest processing. Write conditions only against properties that originate from the integration.

## Limits

Rule sets are bounded to keep ingest predictable. A rule set that exceeds any limit is rejected as invalid, and — consistent with fail-open — an invalid configuration drops nothing.

| Limit | Maximum |
| --- | --- |
| Rules per account | 50 |
| Conditions per rule | 10 |
| Values in a single `in` condition | 20 |

## Managing rules through the API

Manage drop rules through the JupiterOne GraphQL API, authenticated as a user with the account Administrator role. Every field below requires admin access; a non-admin caller receives a `FORBIDDEN` error and no change is made.

### Read the current configuration

```graphql
query {
  dropRulesConfigBeta {
    enabled
    version
    ruleCount
    rules {
      id
      _type
      _class
      conditions { property op value }
    }
  }
}
```

The query returns `null` when no configuration exists. The `version` field is used for safe concurrent updates (see [Concurrent updates](#concurrent-updates)).

### Save the entire rule set

Use `saveDropRulesConfigBeta` to replace the whole configuration. This is the safest way to make bulk changes.

```graphql
mutation {
  saveDropRulesConfigBeta(
    input: {
      enabled: true
      rules: [
        {
          id: "aws-default-subnets"
          _type: "aws_subnet"
          conditions: [{ property: "defaultForAz", op: eq, value: true }]
        }
        {
          id: "aws-managed-iam-policies"
          _type: "aws_iam_policy"
          conditions: [{ property: "arn", op: startsWith, value: "arn:aws:iam::aws:policy/" }]
        }
      ]
    }
  ) {
    created
    config { version ruleCount }
  }
}
```

`created` is `true` when this call created the configuration for the first time.

### Add, replace, or remove a single rule

```graphql
# Add or replace a rule by id
mutation {
  saveDropRuleBeta(
    rule: {
      id: "aws-service-linked-roles"
      _type: "aws_iam_role"
      conditions: [{ property: "path", op: startsWith, value: "/aws-service-role/" }]
    }
  ) {
    created
    config { ruleCount }
  }
}

# Remove a rule by id
mutation {
  deleteDropRuleBeta(id: "aws-service-linked-roles") {
    deleted
    config { ruleCount }
  }
}
```

### Turn drop rules off

To stop all dropping without losing your rules, save the configuration with `enabled: false`. Once the change takes effect (see [When changes take effect](#when-changes-take-effect)), syncs re-ingest everything the rules had been dropping.

```graphql
mutation {
  saveDropRulesConfigBeta(input: { enabled: false, rules: [] }) {
    config { enabled }
  }
}
```

### Concurrent updates

The configuration carries a `version` that increases on every write. To update safely when more than one administrator (or tool) might be editing, pass the `version` you last read as `ifVersion`:

```graphql
mutation {
  saveDropRulesConfigBeta(
    input: { enabled: true, ifVersion: 4, rules: [ /* ... */ ] }
  ) {
    config { version }
  }
}
```

If the stored version no longer matches, the mutation fails with a `CONFLICT` error instead of overwriting the newer change. Read the configuration again, reapply your change, and retry. Omit `ifVersion` for a last-writer-wins save.

## When changes take effect

Drop rule changes are not applied instantly. Each replication worker caches the rule configuration in memory for up to 30 minutes, so a rule you add, change, remove, or disable can take up to that long to take effect across in-progress and future syncs. This happens automatically — there is nothing to trigger or restart.

Two consequences worth knowing:

-   After you save a change, entities a new rule matches may keep ingesting — or, for a removed rule, keep being dropped — for a short period until the cache refreshes.
-   If the configuration temporarily cannot be read (for example, while the database is under heavy load), workers keep applying the last successfully-loaded configuration for up to 24 hours rather than dropping the filter, so your rules stay in force through a transient outage.

Drop rules are meant for stable, rarely-changing filters, so this delay is not normally noticeable.

## Validation errors

-   A rule set that violates a limit or uses a malformed condition is rejected with a `BAD_USER_INPUT` error that describes the problem. Nothing is written.
-   Because a rejected configuration is never stored, a validation error cannot leave your account in a state where the wrong data is dropped.

## Related topics

-   [Data retention](/reference/data-retention.md)

---

Source: /reference/graph-upgrade

# Graph Upgrade Overview and Compatibility

## Overview

JupiterOne is upgrading the primary data stores used to process J1QL queries. The project is intended to improve query performance and reduce the time in which the latest data is available to query.

As part of this upgrade user will get access to an improved query experience, with a more responsive and configurable results page.

The upgrade involves some changes in behavior of queries and the results returned to the user. JupiterOne believes that each of these changes is towards more correct results.

## New Search Experience

As part of the graph upgrade program JupiterOne is introducing an improved search experience and results table. Users will be able to get more value and a better experience when searching data in JupiterOne.

![New Table Component](/assets/images/new-table-component-1977d58fee4cfaa4261272bde170d35a.png)

### Increased Results Limits

The table will now show up to 250 results per page, with on-demand loading of additional pages. This allows the system to return the first page of query results to a user much faster in most cases.

The results table produces either a total row count, or an estimate for very large result sets. As you paginate through the pages the estimate becomes more refined, or becomes the absolute value.

### Faster, more stable experience

The table component has been rebuilt to only render the section of the table visible to the user. This has made scrolling vertically and horizontally though large tables of results much more performant on the browser.

### Column resizing, reordering, and left/right pinning

Columns can now be drag and dropped into a new ordering, with the ability to pin one or more columns to either the left or right side of the table. This makes understanding the data in the table much easier and more intuitive (1).

### Quick column selection, including in Insights table widgets

Users can now much more quickly select which columns to show, including a column name search filter. Also includes the quick option to "Hide" a column without having to redo column selection.

### Colors and Icons for Classes of Assets

Providing a more consistent and intuitive experience for users (2).

### Stacked Icons for Graph Queries

When returning a graph query (i.e. a query with a traversal) and returning columns from multiple elements the icons to the left of the table show a stacked representation of the entity types (2), with a tool tip (3).

## Query Compatibility and Results

The compatibility changes have been grouped into MAJOR, MEDIUM, and MINOR categories.

-   MAJOR: Indicates a change in behavior that may significantly change query results
-   MEDIUM: Covers changes where query results may change slightly, or previously invalid queries may now be rejected
-   MINOR: Typically more style based changes, but might introduce incompatibility with downstream systems

### API Pagination / Query Result Ordering MAJOR

In the legacy query service the same query on unchanged data, in some cases, would produce results with a stable order. This was not true for all queries, and should not be relied upon.

The new query engine produces results in any order and will frequently do so for the same query against unchanged data.

Paginating through query results using a cursor and `VariableResultSize` flag is always guaranteed to eventually return all results for a query.

For more details on this topic, and changes customers will need to make by 1st September 2024 please see the [extended notes](/reference/api-query-pagination-changes.md).

> **INFO**
> 
> This change was originally classified as a MINOR change, but the impact has proven to be greater than expected. Customers using inappropriate API query calls are being proactively contacted to update their usage.
> 
> All JupiterOne provided clients / SDKs have been updated to use the appropriate options, please check you are using the latest clients.

### Unwinding of Arrays MAJOR

Previously JupiterOne would "unwind" rows where the returned values contained arrays of values. This would introduce more results than expected in a lot of cases. The results are no longer unwound in this fashion.

-   This may reduce the number of results in queries and alerts. The new number of rows better reflects the actual number of assets returned in your query
-   Aggregations on properties with arrays no longer duplicates counts across rows

Using the following query as an example, where we have 461 aws\_instances in the system:

```j1ql
FIND aws_instance AS i
RETURN COUNT(i) AS "Instance Count", i._integrationClass AS "Integration Class"
```

The legacy query service would return a table like so:

```text
+----------------+---------------------+
| Instance Count | Integration Class   |
|----------------|---------------------|
| 461            | CSP                 |
| 461            | Infrastructure      |
+----------------+---------------------+
```

The upgraded query service will return this table:

```text
+----------------+---------------------+
| Instance Count | Integration Class   |
|----------------|---------------------|
| 461            | CSP, Infrastructure |
+----------------+---------------------+
```

The rationale here is that the sum of the aggregates should reflect the total number of assets, not the count of each individual property. This was particularly confusing in the legacy system where properties with array values were not clearly identified to the user and the number of rows, or aggregation results, did not match the total number of assets.

> **INFO**
> 
> The way you search against these properties is **not** changed. The following query still returns all the results:
> 
> ```j1ql
> FIND aws_instance WITH _integrationClass = "CSP" AS i
> RETURN COUNT(i) AS "Instance Count", i._integrationClass AS "Integration Class"
> ```

### ORDER BY on returned columns only MEDIUM

Previously it was possible to order results by any property, even if that property was not in the returned columns. In the upgraded query system it is only possible to `ORDER BY` on properties that are returned in the results.

This query will still produce results, but the ordering will not be applied:

```j1ql
FIND aws_instance AS i
RETURN i.displayName, i.arn
ORDER BY i.accountId
```

The query should be written as:

```j1ql
FIND aws_instance AS i
RETURN i.displayName, i.arn, i.accountId
ORDER BY i.accountId
```

### Aliasing a Negated Traversal MEDIUM

It was previously possible to alias a negated (do not match) traversal. This was confusing to users as the alias is to something that "does not exist". The results of such an alias, when included in a `RETURN` or aggregation, were undefined.

The following query will now produce an error. Note the negated traversal `!RELATES`:

```j1ql
FIND aws_instance AS i
  THAT !RELATES TO DataStore AS ds
RETURN i.displayName, i.arn, ds.displayName, ds.arn
```

The error returned is `Could not find node, relationship, or variable with identifier ds`

### Less De-duplication in Optional Traversals MEDIUM

Previously, optional traversals would de-duplicate traversal paths based on a collection of entities that were previously traversed. This would at times remove results that should have been included.

After the upgrade the system will not de-duplicate these matching paths. This is a more correct representation of the relationships in the graph as it shows all possible paths, although it is possible there will be more duplicated data in the results.

These effects can also be observed across multiple pages of results, they will not necessarily appear adjacent to each other in the table output.

The effect of this change can be reduced by including the `UNIQUE` keyword in queries.

### Default Expression Names now more descriptive MEDIUM

Using an expression (aggregation, math operator, etc) in a `RETURN` without an `AS` alias would historically generate names such as `expression0`. This was unhelpful as it did not clearly indicate the source of the data. As part of the graph upgrade the expression names are now derived from the expression itself, when not aliased.

The legacy behavior: ![Legacy Default Expression Names](/assets/images/legacy-expression-names-e46d620f805b3f555a3b54495dceae19.png)

New behavior: ![New Expression Names](/assets/images/upgraded-expression-names-5cfc6c62aff751397363d52f4ae9b5ba.png)

> **INFO**
> 
> This change may have an impact on any automation that expects the old `expressionN` format of un-aliased expressions.

### RBAC Policy Filters no longer modify returned properties MEDIUM

It is possible in JupiterOne Enterprise RBAC access policies to filter what assets a user can query based on properties of those assets (e.g. limit a group of users to a specific AWS account by filtering on `accountId`), **this is not being changed**.

Additionally the system would strip non-matching property values from the returned entities based on these policies, the new system no longer does this.

Example: A user has an access filter that limits access to only entities with `_class = Device`. If this user searches in JupiterOne and we return an entity with `_class = ['Device', 'Host']` historically the system would strip out the filtered property value, so the user would see the entity as having `_class = ['Device']`.

Having reviewed this feature it was determined this offered no meaningful security to the system and caused significant confusion when comparing entities between users with different RBAC policies.

### Full Text Search Tokenization MEDIUM

Previously full text searches would tokenize the search string based on word boundaries, e.g: searching for `"Keith Packard"` would match an entity containing `keith.packard@example.com`. Alternatively, searching for `"keith packard"` would match `Keith Packard`.

The new query full text search functionality only supports case-insensitive “contains” searches. For example, if you search `"Keith Packard"`, it now returns `Keith Packard`, `keith packard`, `KEITH PACKARD`, etc. It will NOT match things like `keith.packard@example.com` or `Keith-Packard`.

This simplification was made as analysis of full text search behavior indicated that only literal matches were desirable, rather than tokenized matches across all properties.

For more advanced text searching it is recommended to look at the new [regex functionality](/j1ql/regular-expressions.md) in J1QL.

> **INFO**
> 
> This change may have an impact on any Insights dashboards where the dashboard filters were applied as a free text search at the beginning of the query.

### Undefined Properties returned as Null MINOR

Where undefined properties were previously returned as `undefined` these are now returned as `null`. This change allows for better serialization to JSON.

> **INFO**
> 
> The way you search against these properties is **not** changed. The following query syntax should continue to be used:
> 
> ```j1ql
> FIND aws_instance WITH ebsOptimized != undefined
> ```

### Invalid Numeric Aggregations return 0 MINOR

Previously, J1QL would return `NaN` for any sum operation that included non-summable data (i.e. non-numeric strings).

J1QL will now return 0 for the aggregation.

### Relationships to Self MINOR

The legacy graph implementation would filter out relationships that looped back to the same object, for example `aws_security_group` objects often have a relationship to themselves. In the following query in the previous implementation the query would return only instances where the `source` was not the same node as the `target`:

```j1ql
FIND aws_security_group AS source
  THAT ALLOWS aws_security_group AS target
```

The upgraded query service does not remove these relationships as they can carry potentially important information.

![Relationship to Self](/assets/images/relationship-to-self-80b3c8aa03e32a327185b148c834ab0e.png)

To replicate the legacy behavior it is necessary to introduce an additional check where the source and target are not the same node:

```j1ql
FIND aws_security_group AS source
  THAT ALLOWS aws_security_group AS target
WHERE source._id != target._id
```

### Optional Traversals De-Duplicate Short Paths MINOR

Take the following optional traversal query:

```j1ql
FIND Person AS p
  (THAT IS User AS u)?
```

In the legacy implementation, a return of both the optional match and the non-optional matched rows were returned.

Examples of old results:

```text
{ p: { <some person> }, u: undefined }
{ p: { <some person> }, u: { <some user> } }
```

In this case the person is the same, and both the paths were returned for a single entity.

In the new system, only the row on the optional path (when it exists) will be returned. This reduces confusion over what was found using the optional vs non-optional path.

Instead of returning both rows above the new system will only return:

```text
{ p: { <some person> }, u: { <some user> } }
```

Or if the optional traversal does not match:

```text
{ p: { <some person> }, u: undefined }
```

### Nested Optional Traversals MINOR

The legacy system allowed for inner traversals within optional traversals like so:

```j1ql
FIND User
  (THAT IS Person
    (THAT HAS AccessKey)? )?
```

This capability was not documented and is no longer supported. The intention of such a query was undefined. The equivalent supported query would be:

```j1ql
FIND User
  (THAT IS Person)?
  (THAT HAS AccessKey)?
```

### Nested Optional Traversal Negation MINOR

The legacy system allowed for inner traversals with chained negated traversals like so:

```j1ql
FIND User
  (THAT IS Person
   THAT !HAS AccessKey)?
```

This capability was not documented and is no longer supported. The intention of such a query was undefined.

### Aliasing to non-ASCII or Empty String MINOR

J1QL previously allowed for non-ASCII or empty string literal as an alias:

```j1ql
FIND Person AS p
RETURN p.displayName AS ""
```

In the new system, empty string literals will not be allowed and all aliases must be non-zero length ASCII strings.

### Empty results due to property selections filtered out MINOR

When running a J1QL query with column selectors, if all the columns selected had no values empty objects would be filtered out from query results. This meant that the number of rows would not accurately reflect the number of assets returned in the query, only those with the selected attributes.

For example, the following query would only return AWS instances that have a public IP address set, and any AWS instance without that property would be filtered from the results:

```j1ql
FIND aws_instance AS i
RETURN i.publicIpAddress
```

This was confusing because the "total" number of results would reflect the complete count of all `aws_instance` objects, so you may see a table or result set with 10 rows but get a count of hundreds of instances.

In the new system, empty objects will be returned. This displays more clearly what the results actually are instead of obscuring potentially important information about the structure of the returned data.

If a query relies on this behavior to filter results the property should be moved to be a filter also:

```j1ql
FIND aws_instance WITH publicIpAddress != undefined AS i
RETURN i.publicIpAddress
```

### CONCAT() now concatenates arrays MINOR

The `CONCAT()` function, when passed two properties that were arrays, would behave more like a `ZIP()` function. This function now properly concatenates the arrays together.

Using the following query as an example:

```j1ql
FIND aws_instance AS i
RETURN CONCAT(i.privateIpAddresses, i.privateDnsName) AS privateEndpoints
```

In the legacy system would produce results like this:

```text
+----------------------------------------------------------------------------------------------------------------------+
| privateEndpoints                                                                                                     |
+----------------------------------------------------------------------------------------------------------------------+
| ["10.0.3.123ip-10-0-3-123.us-east-2.compute.internal", "10.0.3.146ip-10-0-3-123.us-east-2.compute.internal"]         |
| ["10.0.3.19ip-10-0-3-54.us-east-2.compute.internal", "10.0.3.21ip-10-0-3-54.us-east-2.compute.internal"]             |
| ["10.0.1.131ip-10-0-1-52.us-east-2.compute.internal", "10.0.1.212ip-10-0-1-52.us-east-2.compute.internal"]           |
+----------------------------------------------------------------------------------------------------------------------+
```

And now produces results like this:

```text
+----------------------------------------------------------------------------------------------------------------------+
| privateEndpoints                                                                                                     |
+----------------------------------------------------------------------------------------------------------------------+
| ["10.0.3.123", "ip-10-0-3-123.us-east-2.compute.internal", "10.0.3.146", "ip-10-0-3-123.us-east-2.compute.internal"] |
| ["10.0.3.19", "ip-10-0-3-54.us-east-2.compute.internal", "10.0.3.21", "ip-10-0-3-54.us-east-2.compute.internal"]     |
| ["10.0.1.131", "ip-10-0-1-52.us-east-2.compute.internal","10.0.1.212", "ip-10-0-1-52.us-east-2.compute.internal"]    |
+----------------------------------------------------------------------------------------------------------------------+
```

### Null no longer filtered from MERGE() MINOR

The `MERGE()` function will now preserve null values when merging, as this gives a more correct array length for the results.

If the null value is not desired it should be filtered in the query when possible.

---

Source: /reference/pipeline-upgrade

# Data Pipeline Upgrade Overview and Compatibility

## Overview

JupiterOne is upgrading the data pipeline used to bring data into JupiterOne. The project is intended to significantly improve data ingest performance, reducing the time needed to process incoming data and allow the graph to more quickly reflect the data sent from an integration.

There are very few functional changes that impact customers, but if you do make use of JupiterOne's APIs for sending custom data or manipulating data in the graph please review these documents carefully.

> **INFO**
> 
> These changes will start rolling out to customers from **Monday 28th April 2025**

## API Compatibility and Other Changes

The compatibility changes have been grouped into MAJOR, MEDIUM, and MINOR categories:

-   MAJOR: Indicates a change in behavior that may significantly change API usage or APIs becoming unavailable
-   MEDIUM: Covers changes where APIs change in behaviour but no particular actions are required from customers, or data in the graph may change in a way that impacts downstream processing
-   MINOR: More minor changes, removal of undocumented or unused functionality, or additional metadata being added

### CREATE\_OR\_UPDATE Sync Jobs MAJOR

The `CREATE_OR_UPDATE` sync job mode will no longer be supported. Customers using the `CREATE_OR_UPDATE` mode should use the `PATCH` mode. More information on how to migrate to this mode will be communicated directly to customers via our customer success team.

### No Versioned Raw Data MEDIUM

The Persister APIs previously allowed fetching of Raw Data by version. This will no longer be supported, only the latest version of Raw Data is retained.

### New UUIDv5 `_id` Metadata MINOR

Existing objects `_id` will be updated to a new, stable, deterministic UUIDv5. This UUID is derived from the `_scope` and `_key` of the object, i.e. the natural identifiers. Customers should not be relying on the `_id` property being stable for a given entity prior to this change.

### Duplicate `_key` + `_scope` Constraints Enforced MINOR

Prior to this upgrade the system would partially tollerate entities that had duplicated `_key` and `_scope` combinations. The behaviour in this case was undefined. The new data pipeline will strictly enforce this constraint. Any duplicated `_key` and `_scope` data will be dropped at ingest time.

### `_scope` Required and Defaulted MINOR

The `_scope` property was previously optional and the system would derive the scope through a combination of the data source and any `_integrationInstanceId` that may have been provided. `_scope` is now a required property, and will be set to a default value for certain routes, e.g. certain APIs will default to `_scope = api`.

### No PUT of Raw Data MINOR

It will no longer be possible to directly set the Raw Data for an entity using a PUT. The raw data must be ingested as part of a sync job and cannot be updated outside of that flow.

### `PATCH` Sync Jobs cannot target Relationships

`PATCH` jobs will not support patching relationships. Either a full `DIFF` mode sync job must be used or the `updateRelationship` mutations via GraphQL.

---

Source: /reference/unified-device

# Unified Devices and Device Matrix

BETA

## New JupiterOneUnifiedDevice

Through 2023 JupiterOne had a BETA feature called "Unified Devices". This feature was a prototype solution to the problem of representing a single device entity when multiple source device and host entities were present in JupiterOne. We learnt a lot from this BETA feature, and are now ready to replace it with a new and improved solution.

## End of Life for unified\_device

The original unified\_device feature will be retired on 1st November 2024. From that point onwards you will no longer see unified\_device entities in your JupiterOne environment. In addition the "Device Matrix" visualization will no longer be available.

## New UnifiedDevice Entities

We are starting the process of rolling out the Generally Available version of the new UnifiedDevice entities. These are a set of new entities that replace the old unified\_device entities, and are created in a more reliable way. We made a lot of changes to how these UnifiedDevices are created, correlated, and merged to produce a consistent view across your Device and Host entities in JupiterOne.

The rollout of the new UnifiedDevice entities is being done in phases, with an initial closed program where selected new and existing customers are being set up with the new entities.

By the end of 2024 we expect to have completed the rollout of the new UnifiedDevice entities to all customers.

## Frequently Asked Questions

### What do I need to do?

Nothing! unless you want to participate early in the rollout of the new UnifiedDevice entities and visualizations this is a feature that will be automatically enabled for all customers over the coming months.

If you are interested in participating in the closed program to get early access to the new UnifiedDevice entities and visualizations please contact your JupiterOne account team.

### What will replace the Device Matrix visualization?

The Device Matrix visualization will be replaced by a set of new visualizations that help you understand the summary of devices and hosts in your environment. This is being rebuilt as a standard search component rather than a standalone visualization, bringing more power to the wider JupiterOne search experience.

---

Source: /reference/unified-vulnerability

# Unified Vulnerability and VulnCheck Enrichment

## What is Unified Vulnerability

JupiterOne will automatically create deduplicated entities for all `Vulnerability` objects in your database with a valid `cveId` property. These will produce a single representation of any open CVEs.

These entities only carry 2 properties from their sources `Vulnerability` entities: `cveId` and `open` status. All other properties on these entites are enriched directly from the VulnCheck EVI data sources.

These enrichments are updated every 24 hours to ensure the latest information is available for your vulnerability data in JupiterOne.

### Why add external enrichment

A consistent piece of feedback JupiterOne has received concerns the lack of normalization across vulnerability (CVE) data provided by various sources. One vendor will use certain language for priority such as `high`, `medium`, `low`; whilst another vendor will have `CRITICAL`, `HIGH`, `MODERATE`. We have also consistently seen outdated, missing, or incorrect intelligence data coming from these vendors.

JupiterOne wanted to provide customers with a standardized and extremely high quality real-time vulnerability and exposure data feed. We've partnered with VulnCheck and can now bring that data into JupiterOne for your vulnerability data.

### What additional enrichment is available

THe current version of UnifiedVulnerability enrichment is focussed primarily on CVSS, EPSS, and MITRE data. There is a lot more information available and we plan to continue to expand our capabilities in this area, as well as enhancing the user experience around Vulnerability Prioritization in general.

## How to use Unified Vulnerability?

The simplest usage of Unified Vulnerabilities is as an extension of existing use cases. Any query you have today that looks at a CVE entity can be extended to bring in the enrichment information.

An existing query fetching Hosts with vulnerabilities

```j1ql
FIND Vulnerability AS vuln
  THAT RELATES TO (Device|Host) AS host
RETURN host.displayName, host._type, vuln.id, vuln.severity
```

This query produces only very basic information about the state of that vulnerability, and normalizing across the different vulnerability scanners is complex.

Updated query using Unified Vulnerability

```j1ql
FIND UnifiedVulnerability AS vuln
  THAT IS Vulnerability
  THAT RELATES TO (Device|Host) AS host
RETURN host.displayName, host._type, vuln.*
```

This updated query now gives you access to all of the below properties for the vulnerabilities you already ingest into JupiterOne.

## Unified Vulnerability Explorer View

To open the explorer view run the following query:

```j1ql
FIND UnifiedVulnerability
```

![UnifiedVulnerability Explorer View](/assets/images/unified-vuln-explorer-view-2151bc00a927e02ed9b0b4ab420a0b40.png)

## CVSS Properties (Common Vulnerability Scoring System)

### CVSS Score Properties

-   **cvssBasescore**: The base CVSS score ranging from 0.0-10.0 that represents the intrinsic severity of a vulnerability. Higher scores indicate more severe vulnerabilities based on exploitability and impact metrics.
    
-   **cvssBaseseverity**: The qualitative severity rating derived from the base score, categorized as None (0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), or Critical (9.0-10.0).
    
-   **cvssVersion**: Indicates which version of CVSS is being used (e.g., 2.0, 3.0, 3.1, 4.0). Different versions have different scoring methodologies and metrics.
    
-   **cvssVectorstring**: The textual representation of CVSS metrics in a compressed format (e.g., "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"). This string encodes all the individual metric values used to calculate the score.
    
-   **cvssSource**: Identifies the organization that provided the CVSS score (e.g., "[nvd@nist.gov](mailto:nvd@nist.gov)", vendor, or third-party source). Multiple sources may provide different scores for the same vulnerability.
    

### CVSS Impact Metrics

-   **cvssImpactscore**: The sub-score representing the impact component of CVSS, measuring the consequences of a successful exploit. This combines confidentiality, integrity, and availability impact ratings.
    
-   **cvssConfidentialityimpact**: Measures the impact to confidentiality if the vulnerability is exploited. Values include None (N), Low (L), or High (H), indicating data disclosure severity.
    
-   **cvssIntegrityimpact**: Measures the impact to data integrity if exploited. Values indicate whether and how severely data can be modified by an attacker.
    
-   **cvssAvailabilityimpact**: Measures the impact to system availability if exploited. Indicates potential for denial of service or system disruption.
    

### CVSS Exploitability Metrics

-   **cvssExploitabilityscore**: The sub-score representing how easy it is to exploit the vulnerability. Higher scores indicate easier exploitation based on attack complexity and required conditions.
    
-   **cvssAttackvector**: Describes how the vulnerability can be exploited - Network (N), Adjacent (A), Local (L), or Physical (P). Network attacks are typically most severe as they can be conducted remotely.
    
-   **cvssAttackcomplexity**: Indicates how difficult it is to exploit the vulnerability - Low (L) or High (H). Low complexity means reliable exploitation, while high requires specific conditions.
    
-   **cvssPrivilegesrequired**: Specifies the level of privileges an attacker must have - None (N), Low (L), or High (H). None means no authentication needed, increasing severity.
    
-   **cvssUserinteraction**: Indicates whether user interaction is required for exploitation - None (N) or Required (R). Vulnerabilities requiring no user interaction are typically more severe.
    
-   **cvssScope**: Indicates whether exploitation can affect resources beyond the vulnerable component - Unchanged (U) or Changed (C). Changed scope increases severity as impact extends beyond the vulnerable component.
    

### CVSS Temporal Metrics

-   **cvssTemporalscore**: A modified score that factors in the current state of exploit techniques, remediation availability, and confidence in the vulnerability details. This score decreases over time as patches become available.
    
-   **cvssEnvironmentalscore**: A customized score that considers the specific environment where the vulnerable system operates. Organizations can adjust this based on their security requirements and mitigations.
    

### CVSS v2 Legacy Metrics

-   **cvssAccessvector**: CVSS v2 metric for attack vector - Local (L), Adjacent Network (A), or Network (N). Replaced by cvssAttackvector in CVSS v3.
    
-   **cvssAccesscomplexity**: CVSS v2 metric for access complexity - High (H), Medium (M), or Low (L). Replaced by cvssAttackcomplexity in CVSS v3.
    
-   **cvssAuthentication**: CVSS v2 metric indicating authentication requirements - Multiple (M), Single (S), or None (N). Replaced by cvssPrivilegesrequired in CVSS v3.
    
-   **cvssUserinteractionrequired**: CVSS v2 boolean indicating if user interaction is needed. Replaced by cvssUserinteraction in CVSS v3.
    
-   **cvssAcinsufinfo**: CVSS v2 indicator for "Access Complexity: Insufficient Information". Used when complete access complexity details are unavailable.
    
-   **cvssObtainallprivilege**: CVSS v2 boolean indicating whether exploitation grants complete system control. Part of the impact assessment in v2.
    
-   **cvssObtainuserprivilege**: CVSS v2 boolean indicating whether exploitation grants user-level privileges. Part of the impact assessment in v2.
    
-   **cvssObtainotherprivilege**: CVSS v2 boolean indicating whether exploitation grants other types of privileges. Part of the impact assessment in v2.
    

## EPSS Properties (Exploit Prediction Scoring System)

-   **epssScore**: A probability score between 0 and 1 (0-100%) predicting the likelihood of exploitation in the next 30 days. Higher scores indicate greater probability of active exploitation based on threat intelligence and historical data.
    
-   **epssPercentile**: The percentile ranking showing what percentage of all CVEs have a lower EPSS score. For example, 90th percentile means this CVE is more likely to be exploited than 90% of all other CVEs.
    
-   **epssLastModified**: The timestamp of when the EPSS score was last updated. EPSS scores are recalculated daily as new threat intelligence becomes available.
    

## CVE Core Properties

-   **id**: The unique identifier for this vulnerability record in VulnCheck's system. This is VulnCheck's internal ID, distinct from the CVE ID.
    
-   **cveId**: The official CVE (Common Vulnerabilities and Exposures) identifier in the format CVE-YYYY-NNNNN. This is the industry-standard identifier for the vulnerability.
    
-   **description**: A detailed text description of the vulnerability, including affected components, attack vectors, and potential impacts. This helps security teams understand the nature of the threat.
    
-   **sourceidentifier**: The organization or entity that originally reported or coordinated the vulnerability disclosure. Common sources include vendors, researchers, or coordination centers like MITRE.
    
-   **status**: The current status of the CVE entry, such as "Analyzed", "Modified", or "Rejected". This indicates the maturity and validity of the vulnerability information.
    
-   **vulnstatus**: VulnCheck's assessment of the vulnerability's current state. This may include additional context beyond the standard CVE status.
    

## Date Properties

-   **dateAdded**: The date when this vulnerability was added to VulnCheck's database. This helps track when VulnCheck first became aware of the vulnerability.
    
-   **published**: The official publication date when the CVE was first publicly disclosed. This is typically when the vulnerability becomes public knowledge.
    
-   **lastmodified**: The date when the CVE record was last updated with new information. Changes could include score updates, new references, or additional details.
    
-   **enrichedon**: The date when VulnCheck last enriched this vulnerability with additional intelligence. VulnCheck continuously adds threat data, exploit information, and other context.
    

## Exploitation Evidence Properties

### General Exploitation

-   **reportedExploited**: Boolean indicating whether this vulnerability has been reported as exploited in the wild. True means active exploitation has been observed by security researchers or organizations.
    
-   **reportedExploitedByThreatActors**: Boolean indicating whether known threat actors have been observed using this vulnerability. This suggests targeted, sophisticated attacks.
    
-   **reportedExploitedByBotnets**: Boolean indicating whether botnets have weaponized this vulnerability. Botnet usage often indicates widespread, automated exploitation.
    
-   **reportedExploitedByRansomware**: Boolean indicating whether ransomware groups have used this vulnerability. Ransomware exploitation represents high business impact risk.
    

### Exploit Maturity

-   **maxExploitMaturity**: The highest level of exploit sophistication observed, ranging from proof-of-concept to weaponized exploits. Higher maturity indicates easier exploitation by less skilled attackers.
    
-   **commercialExploitFound**: Boolean indicating whether commercial penetration testing tools include exploits for this vulnerability. Commercial availability lowers the barrier for exploitation.
    
-   **weaponizedExploitFound**: Boolean indicating whether weaponized exploits exist that can be readily deployed. Weaponized exploits require minimal modification to use in attacks.
    
-   **publicExploitFound**: Boolean indicating whether public exploit code is available. Public exploits significantly increase the risk as anyone can access the code.
    

### Exploit Counts

-   **countsExploits**: The total number of known exploits for this vulnerability across all sources. Higher counts indicate more widespread exploitation capability.
    
-   **countsBotnets**: The number of distinct botnet families observed exploiting this vulnerability. Multiple botnets suggest profitable and reliable exploitation.
    
-   **countsRansomwareFamilies**: The number of different ransomware families using this vulnerability. Multiple families indicate high value for initial access or lateral movement.
    
-   **countsThreatActors**: The number of distinct threat actor groups observed exploiting this vulnerability. More actors suggest strategic value for targeted attacks.
    

## MITRE ATT&CK Mapping Properties

-   **mitreTactics**: List of MITRE ATT&CK tactics associated with this vulnerability (e.g., "Initial Access", "Privilege Escalation"). Tactics represent the attacker's tactical goals.
    
-   **mitreTechniqueids**: List of specific MITRE ATT&CK technique IDs (e.g., "T1190", "T1068"). These provide detailed attack patterns and procedures.
    
-   **mitreTechniquenames**: Human-readable names of the MITRE ATT&CK techniques. These describe how attackers use the vulnerability in their operations.
    
-   **mitreTechniqueurls**: Direct URLs to the MITRE ATT&CK framework pages for each technique. These provide comprehensive technique documentation and detection guidance.
    
-   **mitreTechniquedomains**: The ATT&CK domains where techniques apply (e.g., "enterprise-attack", "mobile-attack"). Different domains cover different technology platforms.
    

## KEV Properties (Known Exploited Vulnerabilities)

### VulnCheck KEV

-   **invckev**: Boolean indicating inclusion in VulnCheck's Known Exploited Vulnerabilities catalog. VulnCheck KEV contains 130% more vulnerabilities than CISA KEV.
    
-   **vulncheckkevexploitadd**: Date when the vulnerability was added to VulnCheck's KEV catalog. This tracks when VulnCheck identified active exploitation.
    

### CISA KEV

-   **inkev**: Boolean indicating inclusion in CISA's Known Exploited Vulnerabilities catalog. CISA KEV represents vulnerabilities actively exploited and requiring federal agency remediation.
    
-   **cisaexploitadd**: Date when CISA added this vulnerability to their KEV catalog. This is when CISA confirmed active exploitation.
    
-   **cisaactiondue**: The deadline by which US federal agencies must remediate this vulnerability. This date is typically 2-3 weeks after addition to KEV.
    
-   **cisarequiredaction**: CISA's mandated remediation action, typically "Apply updates per vendor instructions" or specific mitigation steps. Federal agencies must complete this action by the due date.
    
-   **cisavulnerabilityname**: CISA's descriptive name for the vulnerability, often more readable than the CVE ID. This helps identify the affected product and vulnerability type.
    

## Timeline Properties

-   **timelineFirstExploitPublished**: The earliest date when exploit code for this vulnerability was publicly released. This marks when exploitation became broadly feasible.
    
-   **timelineMostRecentExploitPublished**: The most recent date when new exploit code was published. Recent exploits may include improvements or target new platforms.
    
-   **timelineFirstExploitPublishedWeaponizedOrHigher**: The first date when weaponized or highly mature exploits appeared. This indicates when low-skill attackers could begin exploitation.
    
-   **timelineNvdPublished**: When NIST's National Vulnerability Database published this CVE. NVD publication typically includes CVSS scores and technical details.
    
-   **timelineNvdLastModified**: The most recent NVD update for this vulnerability. Updates may include score changes or additional information.
    
-   **timelineFirstReportedThreatActor**: The earliest date when a threat actor was observed exploiting this vulnerability. This marks the beginning of targeted attacks.
    
-   **timelineMostRecentReportedThreatActor**: The latest threat actor activity observed for this vulnerability. Recent activity suggests continued value for attackers.
    
-   **timelineFirstReportedBotnet**: When botnet exploitation was first detected. Botnet adoption indicates scalable, automated attacks.
    
-   **timelineMostRecentReportedBotnet**: The latest botnet activity for this vulnerability. Continued botnet use suggests ongoing mass exploitation.
    
-   **timelineFirstReportedRansomware**: When ransomware groups first used this vulnerability. Ransomware adoption indicates high value for initial access.
    
-   **timelineMostRecentReportedRansomware**: The latest ransomware activity observed. Recent ransomware use represents active business risk.
    
-   **timelineVulncheckKevDateAdded**: When VulnCheck added this to their KEV catalog. VulnCheck often identifies exploitation before other sources.
    
-   **timelineVulncheckKevDateDue**: VulnCheck's recommended remediation deadline. This may differ from CISA's timeline based on threat intelligence.
    
-   **timelineCisaKevDateAdded**: When CISA confirmed exploitation and added to KEV. This triggers mandatory federal remediation requirements.
    
-   **timelineCisaKevDateDue**: CISA's mandatory remediation deadline for federal agencies. Missing this deadline requires explanation and compensating controls.
    

## Additional Properties

### CPE and Component Properties

-   **vulnerablecpes**: List of Common Platform Enumeration (CPE) strings identifying affected software versions. CPEs use a structured naming scheme to precisely identify vulnerable products.
    
-   **vcvulnerablecpes**: VulnCheck's enhanced CPE list with additional coverage. VulnCheck generates CPEs for vulnerabilities missing official CPE data, improving vulnerability scanning accuracy.
    
-   **categorizationTags**: VulnCheck's tags for categorizing the vulnerability type, affected components, or attack patterns. Tags enable filtering and prioritization workflows.
    

### Evaluation Properties

-   **evaluatorcomment**: Comments from security evaluators providing additional context or clarification. These may include exploitation notes or remediation guidance.
    
-   **evaluatorimpact**: The evaluator's assessment of real-world impact. This may differ from CVSS impact based on practical considerations.
    

### Other Properties

-   **open**: Status indicating whether the vulnerability is still open/unpatched in tracked systems. This helps identify remediation gaps.
    
-   **trendingGithub**: Boolean indicating whether this vulnerability is trending in GitHub discussions or repositories. GitHub trends often correlate with active research or exploitation.

---

Source: /reference/vulnerability-score

# JupiterOne Vulnerability Score

## Overview

JupiterOne calculates a comprehensive vulnerability score for each `UnifiedVulnerability` entity in your environment. This proprietary scoring system provides a more accurate risk assessment than traditional CVSS scores alone by incorporating multiple risk factors and real-world context from your specific environment.

The key advantage of JupiterOne's vulnerability score is that it includes a weighting based on the actual number of instances of the vulnerability that are attached to real assets in your entity graph. This contextual awareness makes the score significantly more relevant to your organization's actual risk posture.

## Score Calculation

The JupiterOne Vulnerability Score ranges from 0 (lowest risk) to 1.0 (highest risk), or 0% to 100% when expressed as a percentage. The score is derived from three weighted components:

### Component Weights

| Component | Weight | Description |
| --- | --- | --- |
| **CVSS Base Score** | 30% | Industry-standard vulnerability severity with non-linear scaling |
| **EPSS Percentile** | 40% | Exploit Prediction Scoring System - probability of exploitation |
| **Occurrence Count** | 30% | Proportion of your Device and Host entities affected |

### Detailed Component Calculations

#### 1\. CVSS Base Score (30% weight)

The CVSS Base Score component uses a non-linear function to de-emphasize mid and low CVSS scores. This ensures that critical and high-severity vulnerabilities are appropriately weighted while reducing noise from lower-severity issues.

-   **Calculation**: `0.3 * (cvssBaseScore / 10)^2`
-   **Non-linear scaling**: The squared function gives more weight to higher CVSS scores

#### 2\. EPSS Percentile (40% weight)

The Exploit Prediction Scoring System (EPSS) percentile is considered a stronger indicator for imminent risk as it predicts the likelihood of a vulnerability being exploited in the wild within the next 30 days.

-   **Calculation**: `0.4 * epssPercentile`
-   **Default value**: If EPSS data is not available (common for zero-day vulnerabilities), a default value of 0.5 is used

#### 3\. Occurrence Count (30% weight)

This unique component considers how widespread the vulnerability is across your infrastructure, providing critical context about your organization's exposure.

-   **Calculation**: `min(0.3, (vulnerabilityCount * 10.0) / totalDeviceCount)`
-   **Linear scaling**: Weight increases linearly from 0% to 10% of assets affected
-   **Maximum impact**: Above 10% of assets affected, the full 30% weight is applied

### Final Score Formula

```text
JupiterOne Vulnerability Score = CVSS Weight + EPSS Weight + Occurrence Weight
```

## Implementation Details

The vulnerability score is calculated as part of the VulnCheck enrichment process:

1.  **Device Count Collection**: At the start of enrichment, the total number of `UnifiedDevice` entities in your environment is counted
2.  **Vulnerability Analysis**: For each `UnifiedVulnerability`, the system counts incoming `IS` relationships from `Vulnerability` entities
3.  **Score Calculation**: The three components are calculated and combined using the weights described above
4.  **Property Assignment**: The final score is stored as the `jupiteroneVulnScore` property on the `UnifiedVulnerability` entity

## Data Requirements

For a vulnerability score to be calculated, the following data must be available:

-   **CVSS Base Score**: Required from vulnerability data sources
-   **EPSS Percentile**: Preferred but will default to 0.5 if unavailable
-   **Entity Relationships**: Valid `IS` relationships between `Vulnerability` and `UnifiedVulnerability` entities
-   **Device Inventory**: At least one `UnifiedDevice` entity in the environment

## Using the Score

The JupiterOne Vulnerability Score can be used to:

-   **Prioritize Remediation**: Focus on vulnerabilities with the highest scores first
-   **Risk Assessment**: Get a more accurate picture of your organization's vulnerability risk
-   **Trend Analysis**: Track how vulnerability scores change over time as patches are applied or new vulnerabilities emerge
-   **Compliance Reporting**: Demonstrate risk-based vulnerability management practices

## Example Query

To retrieve vulnerabilities with their JupiterOne scores:

```j1ql
FIND Vulnerability AS v
  THAT IS UnifiedVulnerability WITH jupiteroneVulnScore != undefined AS uv
RETURN 
  uv.cveId AS vulnerabilityId,
  uv.displayName AS vulnerability,
  uv.cvssBaseScore AS cvss,
  uv.epssPercentile AS epss,
  uv.jupiteroneVulnScore AS score,
  COUNT(v) AS affectedAssets
ORDER BY uv.jupiteroneVulnScore DESC
LIMIT 100
```

## Score Interpretation

| Score Range | Risk Level | Recommended Action |
| --- | --- | --- |
| 0.8 - 1.0 | Critical | Immediate remediation required |
| 0.6 - 0.8 | High | Prioritize for remediation within days |
| 0.4 - 0.6 | Medium | Schedule for remediation within weeks |
| 0.2 - 0.4 | Low | Include in regular patching cycles |
| 0.0 - 0.2 | Minimal | Monitor and patch as convenient |

## Benefits Over Traditional Scoring

1.  **Context-Aware**: Considers the actual prevalence of vulnerabilities in your environment
2.  **Exploitation Focus**: Heavily weights EPSS to prioritize likely-to-be-exploited vulnerabilities
3.  **Balanced Approach**: Combines multiple data sources for a comprehensive risk view
4.  **Dynamic**: Automatically adjusts as your infrastructure changes
5.  **Actionable**: Provides clear prioritization for remediation efforts

## Related Resources

-   [Vulnerability Reporting](/platform-overview/vulnerability-reporting-intro.md)
-   [UnifiedVulnerability Entity](/reference/unified-vulnerability.md)
-   [Vulnerability Schema](/data-model/schemas/Vulnerability.md)

---

Source: /release-notes

# Release Notes

We release a new publication monthly with information relating to all the cool new stuff we've implemented within the JupiterOne platform.

### Release Notes

-   [February 2025](/release-notes/feb-2025.md)
-   [January 2025](/release-notes/jan-2025.md)
-   [December 2024](/release-notes/dec-2024.md)
-   [November 2024](/release-notes/nov-2024.md)
-   [October 2024](/release-notes/oct-2024.md)
-   [July - September 2024](/release-notes/sep-2024.md)
-   [June 2024](/release-notes/jun-2024.md)
-   [May 2024](/release-notes/may-2024.md)
-   [April 2024](/release-notes/apr-2024.md)
-   [March 2024](/release-notes/mar-2024.md)
-   [February 2024](/release-notes/feb-2024.md)
-   [January 2024](/release-notes/jan-2024.md)
-   [December 2023](/release-notes/dec-2023.md)
-   [November 2023](/release-notes/nov-2023.md)
-   [October 2023](/release-notes/oct-2023.md)
-   [September 2023](/release-notes/sep-2023.md)
-   [August 2023](/release-notes/aug-2023.md)
-   [July 2023](/release-notes/jul-2023.md)
-   [June 2023](/release-notes/jun-2023.md)
-   [May 2023](/release-notes/may-2023.md)
-   [April 2023](/release-notes/apr-2023.md)
-   [March 2023](/release-notes/mar-2023.md)
-   [February 2023](/release-notes/feb-2023.md)
-   [January 2023](/release-notes/jan-2023.md)

---

Source: /release-notes/apr-2023

# JupiterOne April 2023 Release

## New Features and Improvements

-   Alert on only new outcomes for rules: you can now elect to receive an alert when your rule produces a new outcome that has not been seen before. This means you are able to efficiently monitor what matters and stay up-to-date with any new developments.
    
-   You can now download your policies in HTML format, in addition to other existing formats supported by J1.
    
-   When writing queries with J1 Query Builder, only data with relationships to the root class/entity are shown. This shows you directly the classes and entities available to you and reduces the noise of what is in your environment to only show you the possible options.
    
    ![2023-05-02 09 04 18](/assets/images/235690691-55a1bd15-61ba-486d-8cef-6d2fc1b1c40d-5cfde0506a6571b5619a56bb6467fbf1.gif)
    
-   You can now preview your J1 Insights charts while editing or creating new widget queries, allowing you to see how your query is represented so that you can make adjustments before publishing.
    
    ![2023-05-02 08 46 29](/assets/images/235687392-ab976b0b-470f-4deb-832a-16607c954b71-c92cc4019b11e6076e9ab1e36ae5dd59.gif)
    
-   The bar charts in Insights are now able to be oriented in horizontal format.
    
-   Your query results are now equipped with column filters. This leads to more performant queries and allows you to focus on the data that matters.
    
-   Uploading integrations via csv files just got easier with a new csv upload process.
    
    ![Screen Shot 2023-05-02 at 8 54 42 AM](/assets/images/235687908-3f8bb6e5-b26b-4218-bc7d-e7b6d4919182-e54154972eefc69ac39446f088346269.png)
    
-   J1 Settings has a new look-and-feel that makes managing your profile, API keys, and user management easier. Key highlights include:
    
    -   The ability to change your profile picture.
    -   Improved search capabilities for managing users and groups.
    -   Robust user management, including a full view of a user and their permissions, along with the groups they belong to.
-   Integrations that are currently in an early access phase are now visible within Integrations in the Platform. This gives you visibility into what new integrations are coming, as well as an opportunity to opt-in for early access use.
    
    ![Screen Shot 2023-05-02 at 8 54 27 AM](/assets/images/235687797-5cd1e975-fa88-439f-9e64-62ef51597f72-75a11cb0e2248c74b200a11ef00d6892.png)
    

## Integrations

#### Tenable

-   Created a relationship between tenable\_vulnerability\_finding and vsphere\_host.

#### Qualys

-   Created a relationship qualys\_host\_finding < HAS - azure\_vm.

---

Source: /release-notes/apr-2024

# JupiterOne April 2024 Release

## New Features and Improvements

### Insights Dashboards

-   Support for inline Insights dashboard filters to all widgets

### Content and Rule Packs

-   Added Cyberark EPM Misconfigurations Rule Pack
-   Added Cyberark Idaptive Misconfigurations Rule Pack
-   Added Known Malicious Software Versions Rule Pack

## Integrations

## New Integrations

### Mosyle MDM

Mosyle is an Apple MDM (mobile device management) and Apple security provider.

## Integration Updates

### AWS

-   AWS MSK Clusters added new entity `aws_msk_cluster`
-   AWS EC2 Transit Gateway VPC Attachment added entity `aws_ec2_transit_gateway_vpc_attachment`
-   AWS MQ/MQ Broker added entity `aws_mq_broker`
-   AWS VPC Endpoint added entity `aws_vpc_endpoint`
-   AWS Managed Workflows for Apache Airflow added entities `aws_mwaa`, `aws_mwaa_environment`
-   `copyTagsToSnapshot` added to the `aws_rds_cluster` entity

### Detectify

-   Detectify Users added entity `detectify_user`

### Kubernetes

-   Kubernetes Containers added entity `kube_container`
-   Kubernetes Pod added entity `kube_pod`

### Auth0

-   Auth0 Role Information added entity `auth0_role`

---

Source: /release-notes/apr-2025

# JupiterOne Release Notes - April 2025

## Executive Summary

The April 2025 release of JupiterOne introduces substantial enhancements across its Application, Platform, Integrations, and Content areas, with a keen focus on improving user experience, performance, and overall security compliance. Key themes of this release include the addition of advanced asset discovery capabilities, improved API functionalities, and a more intuitive user interface. With these updates, users can expect enhanced visibility into their assets, streamlined workflows through integrated tools, and a fortified security posture that aligns with industry standards. The release demonstrates a commitment to continuous improvement, focusing on user feedback and evolving security needs. As organizations face increasing complexity in managing their security and compliance requirements, these enhancements provide crucial tools to navigate these challenges effectively.

## Application

### Enhancements

-   **User Interface Overhaul**: The user interface has undergone a significant redesign, aimed at enhancing usability and navigation throughout the application. With improved visual elements and a more intuitive layout, users can more easily access and interpret information. The introduction of tooltips and onboarding guides further aids new users in their journey, reducing the learning curve and expediting the adoption process.
    
-   **Enhanced Reporting Capabilities**: The release expands reporting functionality to include customizable report templates and automated scheduling options. Users can now generate detailed compliance reports that align with their organizational requirements, streamlining the reporting process. This enhancement significantly reduces time spent on manual data compilation, thereby increasing efficiency and accuracy, which is crucial for timely compliance submissions.
    

### Bug Fixes

-   **Resolved Memory Leak Issues**: A critical memory leak affecting the asset inventory page has been addressed. Previous versions experienced performance degradation over time, often resulting in application crashes when handling large volumes of assets. By resolving this issue, overall application stability improves, ensuring that users can manage their asset inventories without interruptions.
    
-   **Fixed Data Synchronization Errors**: Several bugs related to data synchronization between on-premises and cloud environments have been corrected. This enhancement ensures that all asset data is accurately reflected across platforms, which reduces discrepancies and fosters greater trust in the data presented within the application.
    

## Platform

### Performance Improvements

-   **Database Optimization**: Major optimizations to the underlying database architecture have resulted in a 50% increase in query performance. This improvement allows for significantly faster data retrieval, enhancing overall application responsiveness, particularly during peak usage times. Users can expect a smoother experience when interacting with large datasets, which is essential for maintaining high productivity.
    
-   **Scalability Enhancements**: The platform has been refactored to improve scalability, enabling it to handle increased workloads without performance degradation. This enhancement is particularly crucial for large enterprises that experience fluctuating demands, ensuring consistent performance even during high-traffic scenarios.
    

### Infrastructure

-   **Migration to Cloud-Native Architecture**: The JupiterOne platform has transitioned to a cloud-native architecture, improving fault tolerance and availability. This migration supports automatic scaling and enhances disaster recovery capabilities, ensuring higher uptime for users and improved resilience against outages.
    
-   **Enhanced Security Protocols**: Security protocols have been upgraded to include advanced encryption standards for data both in transit and at rest. These enhancements significantly bolster the platform's security posture, providing users with better protection against unauthorized access to sensitive information.
    

## Integrations

### New Integrations

-   **Integration with AWS Security Hub**: A new integration with AWS Security Hub allows users to consolidate security alerts and compliance findings from their AWS resources seamlessly. This integration enhances the ability to monitor security posture effectively and streamlines incident response efforts by providing a centralized view of security events across AWS environments.

## Content

### Security Content

-   **New Security Alerts for Vulnerability Management**: The introduction of new security alerts focused specifically on vulnerability management allows users to proactively address potential threats. This feature provides timely notifications and actionable insights, empowering security teams to prioritize remediation efforts effectively, thereby enhancing overall security posture.
    
-   **Expanded Knowledge Base for Incident Response**: The security content knowledge base has been expanded to include new incident response playbooks and best practice guides. This enhancement equips users with the necessary knowledge to respond effectively to various security incidents, thereby improving overall incident management capabilities and reducing response times.
    

## Breaking Changes

-   **Change in User Role Permissions**: User role permissions have been redefined to enhance security and access control. Users may notice changes in their access levels and should review their roles to understand the updated permission sets. This change aims to reduce the risk of unauthorized access to sensitive areas of the application, ensuring better security governance.

## Additional Notes

-   **User Training Sessions**: To facilitate the adoption of new features and enhancements, training sessions will be conducted periodically. Users are encouraged to participate to maximize their understanding and utilization of the new tools and capabilities introduced in this release.
    
-   **Feedback Mechanism**: A feedback mechanism has been established to gather user input on the new features and improvements. Users can provide their thoughts directly through the application, which will help guide future enhancements and address areas of concern.
    

---

The April 2025 release of JupiterOne represents a comprehensive effort to enhance user experience, improve performance, and bolster the security capabilities of the platform. With these updates, JupiterOne continues to stand out as a robust solution for security and compliance management, empowering organizations to effectively navigate the complexities of today’s digital landscape.

---

Source: /release-notes/aug-2023

# JupiterOne August 2023 Release

  
  

> **NOTE**
> 
> We have officially migrated our documentation to our new site here at [docs.jupiterone.io](https://docs.jupiterone.io/)! 🥳

## New Features and Improvements

### Queries

#### Natural Language Queries

JupiterOne now supports **natural language to generate J1QL** (JupiterOne query language). You can now type questions like "What new IAM users have been created in the last week?" and "What s3 buckets do I have?" and J1 will convert these questions into J1QL syntax. **This feature is currently only available in the Query Anywhere Search Box**